joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d198
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503310
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
and dword [eax + 8], 0
call fcn.0049dc26
mov ecx, dword [esi + 0xc]
xor ebx, ebx
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
lea edx, [esi + 0x10]
or dword [esi + 0x38], 0xffffffff
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], edi
and dword [edx + 4], 0
mov dword [edx], 1
call fcn.0049d3d4
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x49dc47
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x178
mov esi, esp
mov dword [esi + 0x160], ebp
lea eax, [esi + 0x168]
mov dword [esi + 0x1c], edx
mov dword [esi + 8], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5033a0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov edi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
and dword [eax + 8], 0
mov byte [esi + 7], 1
lea ecx, [esi + 0x20]
push edi
call fcn.004eaafb
pop eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 8]
mov dword [esi + 0x14], eax
add edi, 0x10
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x30]
push 0x130
push dword [esi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, edi
mov dword [esi + 0x170], 1
mov dword [esi + 8], edi
call fcn.0049ccce
push 0x130
lea eax, [esi + 0x30]
push eax
push dword [esi + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
and dword [esi + 0x170], 0
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov byte [esi + 7], 0
push dword [esi + 0x14]
push dword [esi + 0x18]
call fcn.004eab7c
pop eax
pop ecx
mov eax, dword [esi + 0x168]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49ed74
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xab8
mov esi, esp
mov dword [esi + 0xaa0], ebp
lea eax, [esi + 0xaa8]
mov dword [esi + 0x1c], edx
mov dword [esi + 8], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503440
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov edi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
and dword [eax + 8], 0
mov byte [esi + 7], 1
lea ecx, [esi + 0x20]
push edi
call fcn.004eaafb
pop eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 8]
mov dword [esi + 0x14], eax
add edi, 0x10
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x30]
push 0xa70
push dword [esi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, edi
mov dword [esi + 0xab0], 1
mov dword [esi + 8], edi
call fcn.0049e756
push 0xa70
lea eax, [esi + 0x30]
push eax
push dword [esi + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
and dword [esi + 0xab0], 0
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov byte [esi + 7], 0
push dword [esi + 0x14]
push dword [esi + 0x18]
call fcn.004eab7c
pop eax
pop ecx
mov eax, dword [esi + 0xaa8]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x49f5c2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503490
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
and dword [eax + 8], 0
call fcn.0049f7f5
mov ecx, dword [esi + 0xc]
xor ebx, ebx
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
lea edx, [esi + 0x10]
or dword [esi + 0x38], 0xffffffff
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], edi
and dword [edx + 4], 0
mov dword [edx], 1
call fcn.0049eebd
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a6c09
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x44]
mov edx, dword [edx + 0x48]
push 0x57b2bc
push dword [edi + 0x38]
call fcn.004a6a02
pop ecx
pop ecx
test eax, eax
mov ecx, esp
xorps xmm0, xmm0
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
movsd qword [ecx + 0xc], xmm0
movsd qword [ecx + 0x14], xmm0
movsd qword [ecx + 0x1c], xmm0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x80]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x4a6d3c
test eax, eax
je 0x4a6cd2
cmp eax, 0x90317
je 0x4a6d35
cmp eax, 0x90321
jne 0x4a6d49
mov dword [edi + 0x68], 0x10000
mov byte [edi + 0x6c], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x38]
jne 0x4a6cbd
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004a6bc1
and dword [edi + 0xac], 0
jmp 0x4a6d5a
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x44]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x48]
and dword [edi + 0x30], 0
lea ebx, [edi + 0x28]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.004a6d67
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.00438d55
pop eax
and dword [edi + 0x24], 0
and dword [edi + 0x20], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x38]
jne 0x4a6d19
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004a6bc1
mov eax, dword [edi + 0x38]
xor ecx, ecx
or eax, dword [edi + 0x3c]
sete cl
mov dword [edi + 0xac], ecx
jmp 0x4a6d5a
mov word [esi], 0x104
jmp 0x4a6d5f
cmp dword [esp + 0x10], 4
jne 0x4a6d51
mov eax, dword [esp + 0xc]
jmp 0x4a6d54
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4a6d5f
xor eax, eax
inc eax
mov dword [edi + 0xac], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a8dda
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0xec]
mov edx, dword [edx + 0xf0]
push 0x57b2bc
push dword [edi + 0xe0]
call fcn.004a6a02
pop ecx
pop ecx
test eax, eax
mov ecx, esp
xorps xmm0, xmm0
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
movsd qword [ecx + 0xc], xmm0
movsd qword [ecx + 0x14], xmm0
movsd qword [ecx + 0x1c], xmm0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x128]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x4a8f3a
test eax, eax
je 0x4a8eb5
cmp eax, 0x90317
je 0x4a8f33
cmp eax, 0x90321
jne 0x4a8f47
mov dword [edi + 0x110], 0x10000
mov byte [edi + 0x114], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xe0]
jne 0x4a8ea0
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004a8d86
and dword [edi + 0x154], 0
jmp 0x4a8f58
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0xec]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
and dword [edi + 0xd8], 0
lea ebx, [edi + 0xd0]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.004a6d67
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.00438d55
pop eax
and dword [edi + 0xcc], 0
and dword [edi + 0xc8], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xe0]
jne 0x4a8f11
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004a8d86
mov eax, dword [edi + 0xe0]
xor ecx, ecx
or eax, dword [edi + 0xe4]
sete cl
mov dword [edi + 0x154], ecx
jmp 0x4a8f58
mov word [esi], 0x104
jmp 0x4a8f5d
cmp dword [esp + 0x10], 4
jne 0x4a8f4f
mov eax, dword [esp + 0xc]
jmp 0x4a8f52
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4a8f5d
xor eax, eax
inc eax
mov dword [edi + 0x154], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b1dd1
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x160
mov esi, esp
mov dword [esi + 0x148], ebp
lea eax, [esi + 0x150]
mov dword [esi + 0x1c], edx
mov dword [esi + 8], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5038e0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov edi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
and dword [eax + 8], 0
mov byte [esi + 7], 1
lea ecx, [esi + 0x20]
push edi
call fcn.004eaafb
pop eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 8]
mov dword [esi + 0x14], eax
add edi, 0x10
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x30]
push 0x118
push dword [esi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, edi
mov dword [esi + 0x158], 1
mov dword [esi + 8], edi
call fcn.004b1f1a
push 0x118
lea eax, [esi + 0x30]
push eax
push dword [esi + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
and dword [esi + 0x158], 0
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov byte [esi + 7], 0
push dword [esi + 0x14]
push dword [esi + 0x18]
call fcn.004eab7c
pop eax
pop ecx
mov eax, dword [esi + 0x150]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b1f9b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, esp
mov dword [esi + 0x70], ebp
lea eax, [esi + 0x78]
mov dword [esi + 0x1c], edx
mov dword [esi + 8], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5038f0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov edi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
and dword [eax + 8], 0
mov byte [esi + 7], 1
lea ecx, [esi + 0x20]
push edi
call fcn.004eaafb
pop eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 8]
mov dword [esi + 0x14], eax
add edi, 0x10
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x30]
push 0x40
push dword [esi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, edi
mov dword [esi + 0x80], 1
mov dword [esi + 8], edi
call fcn.004b1f54
push 0x40
lea eax, [esi + 0x30]
push eax
push dword [esi + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
and dword [esi + 0x80], 0
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov byte [esi + 7], 0
push dword [esi + 0x14]
push dword [esi + 0x18]
call fcn.004eab7c
pop eax
pop ecx
mov eax, dword [esi + 0x78]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b217e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, esp
mov dword [esi + 0x70], ebp
lea eax, [esi + 0x78]
mov dword [esi + 0x1c], edx
mov dword [esi + 8], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503910
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov edi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
and dword [eax + 8], 0
mov byte [esi + 7], 1
lea ecx, [esi + 0x20]
push edi
call fcn.004eaafb
pop eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 8]
mov dword [esi + 0x14], eax
add edi, 0x10
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x30]
push 0x40
push dword [esi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, edi
mov dword [esi + 0x80], 1
mov dword [esi + 8], edi
call fcn.004b20cc
push 0x40
lea eax, [esi + 0x30]
push eax
push dword [esi + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
and dword [esi + 0x80], 0
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov byte [esi + 7], 0
push dword [esi + 0x14]
push dword [esi + 0x18]
call fcn.004eab7c
pop eax
pop ecx
mov eax, dword [esi + 0x78]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b9b8c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503ac0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
and dword [eax + 8], 0
call fcn.004b1f81
mov ecx, dword [esi + 0xc]
xor ebx, ebx
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
lea edx, [esi + 0x10]
or dword [esi + 0x38], 0xffffffff
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], edi
and dword [edx + 4], 0
mov dword [edx], 1
call fcn.004b289c
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ba427
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503b30
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
and dword [eax + 8], 0
call fcn.004b2166
mov ecx, dword [esi + 0xc]
xor ebx, ebx
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
lea edx, [esi + 0x10]
or dword [esi + 0x38], 0xffffffff
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], edi
and dword [edx + 4], 0
mov dword [edx], 1
call fcn.004b28d5
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bb9ed
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503c40
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
and dword [eax + 8], 0
call fcn.004b1db4
mov ecx, dword [esi + 0xc]
xor ebx, ebx
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
lea edx, [esi + 0x10]
or dword [esi + 0x38], 0xffffffff
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], edi
and dword [edx + 4], 0
mov dword [edx], 1
call fcn.004b2860
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4bc460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
lea esi, [ebp - 0x18]
mov dword [ebp - 0x40], edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x4c]
mov dword [esi - 4], esp
or dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x503c90
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
push 0xb
call fcn.004bc30b
pop eax
and dword [ebp - 0x2c], 0
and dword [esi + 8], 0
lea ecx, [ebp - 0x38]
mov edx, 0x800
mov dword [ebp - 0x24], 0x800
call fcn.0049f867
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 1
push ecx
mov dword [ebp - 0x3c], eax
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x40]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x4bc4f7
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x38]
call fcn.00462f62
jmp 0x4bc4bf
test eax, eax
jne 0x4bc515
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xb
jbe 0x4bc532
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], 0xde
jmp 0x4bc51b
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
and dword [ecx + 4], 0
mov dword [ecx], 0x80000000
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
call fcn.00466c68
jmp 0x4bc547
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x38]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x28]
call fcn.004fef82
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c97c9
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], ecx
xorps xmm0, xmm0
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x503e60
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
and dword [ebp - 0x44], 0
movsd qword [ebp - 0x4c], xmm0
movsd qword [ebp - 0x54], xmm0
movsd qword [ebp - 0x5c], xmm0
movsd qword [ebp - 0x64], xmm0
movsd qword [ebp - 0x6c], xmm0
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x48], 0x400010
cmp dword [edx + 0xc], 0x80000000
je 0x4c9840
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ecx
cmp dword [edx + 0x18], 0x80000000
je 0x4c986a
mov eax, dword [edx + 0x20]
test eax, eax
je 0x4c9865
mov esi, dword [edx + 0x1c]
xor ecx, ecx
movzx edi, byte [esi]
inc esi
or ecx, dword [edi*4 + 0x5a9c14]
dec eax
jne 0x4c9855
jmp 0x4c9867
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [edx + 8]
test eax, eax
je 0x4c98b5
lea ecx, [eax*4]
cmp eax, 0x1fffffff
mov dword [ebp - 0x20], ecx
ja 0x4c995a
mov ebx, dword [edx + 4]
mov esi, eax
push 4
pop edi
mov edx, dword [ebp - 0x20]
mov ecx, edi
call fcn.004e9432
test eax, eax
je 0x4c995c
mov ecx, eax
mov edx, esi
xor eax, eax
mov esi, ecx
mov ecx, dword [ebx + eax*4]
mov dword [esi + eax*4], ecx
inc eax
cmp edx, eax
jne 0x4c98a8
jmp 0x4c98ba
xor edx, edx
push 4
pop esi
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x78]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x30]
mov dword [eax + 4], edx
mov dword [eax + 8], esi
push 0
push ecx
push 0
push 0
push eax
push 0
push 2
push 0x57cbcb
push 0
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x4c98fe
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
and dword [ecx], 0
mov ecx, dword [ebp - 0x20]
jmp 0x4c9944
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
inc edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
push 4
pop ecx
push 0x10
pop edx
call fcn.004e9432
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
test eax, eax
je 0x4c996a
movsd xmm0, qword [ebp - 0x40]
movsd xmm1, qword [ebp - 0x38]
mov esi, dword [ebp - 0x28]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [esi + 4], eax
mov byte [esi], 4
call fcn.00423e07
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
mov edx, dword [ebp - 0x20]
or dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call fcn.00526660
mov dword [ebp - 0x10], 1
push 4
pop ecx
push 0x10
pop edx
call fcn.00526680
ud2
Function at 0x4c9ffe
Capabilities:
Get remote cert context via schannel

Disassembly:
push esi
push eax
mov eax, esp
mov esi, ecx
and dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x4ca01d
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4ca026
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 4
pop esi
ret
Function at 0x4cb40e
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
lea eax, [esp + 0xc]
push 4
push eax
push dword [esp + 0x10]
push 0xffff
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4cb432
mov byte [esi], 4
jmp 0x4cb43e
call dword [sym.imp.kernel32.dll_GetLastError]
and dword [esi], 0
mov dword [esi + 4], eax
pop esi
ret

Function at 0x4cb440
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov ecx, dword [esp + 0x38]
cmp dl, 4
jne 0x4cb4b2
mov eax, dword [0x5c2f9c]
cmp eax, 3
jne 0x4cb596
cmp word [ecx], 0
push 2
pop eax
push 0x17
pop ebp
cmove ebp, eax
push 0x81
push 0
push 0
push 0
push 2
push ebp
mov ebx, ecx
call dword [sym.imp.ws2_32.dll_WSASocketW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4cb4cd
cmp word [ebx], 0
mov ecx, ebx
je 0x4cb51f
mov edx, dword [ecx + 0x18]
movups xmm0, xmmword [ecx + 4]
lea eax, [ecx + 0x14]
mov bx, 0x17
mov dword [esp + 4], edx
push 0x1c
pop ebp
mov edx, ebp
jmp 0x4cb535
mov eax, edx
shr eax, 8
mov word [esi + 1], ax
mov eax, edx
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi], dl
mov dword [esi + 4], ecx
jmp 0x4cb5c2
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x4cb4e7
mov ebx, eax
cmp eax, 0x2726
jne 0x4cb5b3
push 1
push 0
push 0
push 0
push 2
push ebp
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4cb58c
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x4cb5a4
mov ebx, dword [esp + 0x38]
jmp 0x4cb48a
lea eax, [ecx + 2]
xorps xmm0, xmm0
mov dword [esp], eax
push 0x10
pop edx
mov bx, 2
push 6
pop ebp
mov eax, dword [esp]
movzx ebp, word [ecx + ebp]
mov eax, dword [eax]
lea ecx, [esp + 8]
mov word [ecx], bx
rol bp, 8
mov word [ecx + 2], bp
mov dword [ecx + 4], eax
mov eax, dword [esp + 4]
movups xmmword [ecx + 8], xmm0
mov dword [ecx + 0x18], eax
push edx
push ecx
push edi
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4cb56e
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x4cb5c2
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi], cl
and word [esi + 1], 0
mov byte [esi + 3], cl
mov dword [esi + 4], eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4cb5c2
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ebx, eax
jmp 0x4cb5b3
mov edi, ecx
call fcn.00528ca0
mov ecx, edi
jmp 0x4cb460
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
and word [esi + 1], 0
xor eax, eax
mov byte [esi + 3], al
mov byte [esi], al
mov dword [esi + 4], ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret