joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c0
mov ebp, edx
mov ebx, ecx
mov edi, dword [esp + 0x1d8]
mov eax, dword [ecx + 8]
mov dword [esp], eax
lea esi, [esp + 0x5c]
push 0x100
push 0x9a480c
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 4], ebp
push ebp
push ebx
call fcn.0042cf00
add esp, 8
mov dword [esp + 8], eax
call fcn.005b62a0
mov ebp, eax
and eax, 0xff800000
cmp eax, 0xa000000
jne 0x47c438
mov eax, ebp
and eax, 0x7fffff
cmp eax, 0x414
jg 0x47c3db
cmp eax, 0x86
je 0x47c3ed
cmp eax, 0xcf
jne 0x47c438
mov eax, dword [esp]
or byte [eax + 0x2d8], 8
mov esi, str.QUIC_connection_has_been_shut_down
jmp 0x47c587
cmp eax, 0x45c
je 0x47c53d
cmp eax, 0x415
jne 0x47c438
mov eax, dword [esp]
push dword [eax + 0x10c]
call fcn.00507730
add esp, 4
mov edi, 0x3c
test eax, eax
je 0x47c582
mov ecx, dword [esp + 8]
mov dword [ecx + 0x48], eax
push eax
call fcn.00632250
add esp, 4
lea esi, [esp + 0x5c]
push eax
push str.SSL_certificate_problem:__s
push 0x100
push esi
call fcn.0040c960
add esp, 0x10
jmp 0x47c587
mov byte [esp + 0x5c], 0
push 0x100
push esi
push ebp
call fcn.005b6ac0
add esp, 0xc
cmp byte [esp + 0x5c], 0
je 0x47c461
mov eax, edi
xor eax, 0x23
or eax, ebp
je 0x47c48b
jmp 0x47c587
test ebp, ebp
mov eax, 0x9a49ad
mov ecx, 0x9a499f
cmove ecx, eax
lea eax, [esp + 0x5c]
push ecx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov eax, edi
xor eax, 0x23
or eax, ebp
jne 0x47c587
mov ebp, dword [esp + 0x1d4]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea edi, [esp + 0x15c]
push edi
push 0
push 0
push dword [esp + 0x10]
push dword [ebx + 4]
call fcn.0043a4a0
add esp, 0x14
test esi, esi
sete al
cmp ebp, 5
setne cl
or cl, al
jne 0x47c502
lea ebx, [esp + 0xc]
push 0x50
push ebx
push esi
call fcn.0041d090
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, str.SSL_ERROR_SYSCALL
cmovne eax, ebx
mov ecx, dword [esp]
jmp 0x47c516
mov eax, str.SSL_ERROR_unknown
cmp ebp, 0xa
mov ecx, dword [esp]
ja 0x47c516
mov eax, dword [ebp*4 + 0x9a52a4]
push edi
push dword [esp + 0x1bc]
push dword [ecx + 0xf4]
push eax
push str.QUIC_connect:__s_in_connection_to__s:_d___s_
push dword [esp + 0x18]
call fcn.00444f40
add esp, 0x18
mov edi, 0x23
jmp 0x47c599
mov byte [esp + 0x5c], 0
lea esi, [esp + 0x5c]
push 0x100
push esi
push ebp
call fcn.005b6ac0
add esp, 0xc
mov edi, 0x62
cmp byte [esp + 0x5c], 0
jne 0x47c587
mov word [esp + 0x68], 0x72
mov dword [esp + 0x64], 0x6f727265
mov dword [esp + 0x60], 0x206e776f
mov dword [esp + 0x5c], 0x6e6b6e55
jmp 0x47c587
mov esi, str.SSL_certificate_verification_failed
push esi
push 0x9a499c
push dword [esp + 0xc]
call fcn.00444f40
add esp, 0xc
mov eax, edi
add esp, 0x1c0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x486160
Capabilities:
Get hostname

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov byte [esi], 0
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
je 0x486181
pop esi
pop edi
ret
push 0x2e
push esi
mov esi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov ecx, eax
mov eax, esi
test ecx, ecx
je 0x48617e
mov byte [ecx], 0
pop esi
pop edi
ret

Function at 0x488640
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
lea eax, [ecx + eax*2]
add eax, 0xc
push str.hmac.c
push 0x43
push eax
call fcn.004071e0
add esp, 0xc
mov esi, eax
test eax, eax
je 0x488756
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esi], edi
add eax, 0xc
mov dword [esi + 4], eax
mov ecx, dword [edi + 0xc]
add ecx, eax
mov dword [esi + 8], ecx
cmp dword [edi + 0x10], ebx
jae 0x4886b5
push eax
call dword [edi]
add esp, 4
push ebx
push ebp
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
mov ebp, dword [esi + 8]
add ebp, dword [edi + 0xc]
push dword [esi + 4]
push ebp
call dword [edi + 8]
add esp, 8
mov ebx, dword [edi + 0x14]
mov eax, dword [esi + 4]
push eax
call dword [edi]
add esp, 4
push dword [esi + 8]
call dword [edi]
add esp, 4
test ebx, ebx
mov ecx, edi
je 0x48871a
xor edi, edi
mov dword [esp + 4], ebx
nop
movzx eax, byte [ebp + edi]
xor al, 0x36
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [esi + 4]
mov ebx, esi
mov esi, ebp
mov ebp, ecx
call dword [ecx + 4]
add esp, 0xc
movzx eax, byte [esi + edi]
xor al, 0x5c
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [ebx + 8]
call dword [ebp + 4]
mov ecx, ebp
mov ebp, esi
mov esi, ebx
mov ebx, dword [esp + 0x10]
add esp, 0xc
inc edi
cmp ebx, edi
jne 0x4886d0
cmp ebx, dword [ecx + 0x10]
jae 0x488756
mov edi, ecx
nop word cs:[eax + eax]
push 1
push str.6_s__s_s_s_s_HTTP_1._d_r_n
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
push 1
push 0x9a6865
push dword [esi + 8]
call dword [edi + 4]
add esp, 0xc
inc ebx
cmp ebx, dword [edi + 0x10]
jb 0x488730
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x488ea0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push esi
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 0
sub esp, 0x14
movaps xmm0, xmmword [0x9a6890]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 2
test eax, eax
je 0x488f6e
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x488f75
mov esi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.00427840
add esp, 4
push 0
push eax
push esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [esp + 8], 0
lea esi, [esp + 8]
push 0
push esi
push 0
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp + 8], 0x10
jne 0x488f4d
push 0
push esi
push dword [esp + 0x1c]
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 4]
test eax, eax
je 0x488f5c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp]
test eax, eax
je 0x488f6c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor esi, esi
mov eax, esi
add esp, 0xc
pop esi
ret
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
add esp, 0xc
pop esi
ret
Function at 0x49a7e0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 8]
mov ecx, eax
and ecx, 3
jmp dword [ecx*4 + 0x9afae0]
Function at 0x4b4950
Capabilities:
Get hostname

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp], 0
test byte [ecx + 0x44], 1
jne 0x4b4995
mov dword [esi], 0x100
cmp dword [esi + 0x38], 0
jne 0x4b499b
mov dword [esi + 0x38], 0x4d0
cmp dword [esi + 4], 0
jne 0x4b49a1
mov dword [esi + 4], 0x7d0
cmp dword [esi + 8], 0
jne 0x4b49a7
mov dword [esi + 8], 3
jmp 0x4b49a7
cmp dword [esi + 0x38], 0
je 0x4b4972
cmp dword [esi + 4], 0
je 0x4b497f
cmp dword [esi + 8], 0
je 0x4b498c
push dword [esi + 0x84]
call fcn.004bf3a0
add esp, 4
test eax, eax
je 0x4b4a05
xor ebx, ebx
cmp dword [esi + 0x28], 0
je 0x4b4a74
cmp dword [esi + 0x30], 0
je 0x4b4ad9
xor eax, eax
cmp dword [esi + 0x34], 0
je 0x4b4aec
test byte [esi + 0x46], 0x80
jne 0x4b4b12
mov word [esi + 0xd0], 0xa
mov dword [esi + 0xd4], 0x1388
test ebx, ebx
jne 0x4b4b16
jmp 0x4b4b26
mov eax, 0x1a
test byte [esi + 1], 2
jne 0x4b4b26
mov dword [esp + 4], 2
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov ecx, esp
push 0
push 0
push 0
push eax
push ecx
call fcn.004bb590
add esp, 0x14
test eax, eax
jne 0x4b4b26
push 0
push dword [esp + 4]
push esi
call fcn.004bbbe0
add esp, 0xc
mov edi, eax
push dword [esp]
call fcn.004bebf0
add esp, 4
test edi, edi
je 0x4b49b9
mov eax, edi
jmp 0x4b4b26
mov eax, dword [0xad5c20]
push 0x40
call dword [eax]
add esp, 4
test eax, eax
je 0x4b4b2e
mov edi, 0x40
mov ebp, 0x40
nop word cs:[eax + eax]
mov ebx, eax
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4b4b35
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x4b4b39
add ebp, ebp
add edi, edi
push ebp
push ebx
mov eax, dword [0xad5c24]
call dword [eax]
add esp, 8
test eax, eax
jne 0x4b4aa0
jmp 0x4b4b8e
mov dword [esi + 0x2c], 0
xor eax, eax
cmp dword [esi + 0x34], 0
jne 0x4b49db
push 0x9b8b44
call fcn.004c78a0
add esp, 4
mov dword [esi + 0x34], eax
xor ecx, ecx
test eax, eax
mov eax, 0xf
cmovne eax, ecx
test byte [esi + 0x46], 0x80
je 0x4b49e5
test ebx, ebx
je 0x4b4b26
mov ecx, dword [0xad5c18]
push ebx
mov esi, eax
call dword [ecx]
mov eax, esi
add esp, 4
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xf
jmp 0x4b4b26
test eax, eax
je 0x4b4b3c
mov byte [ebx], 0
push 0x2e
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test eax, eax
je 0x4b49c5
mov edi, eax
push 4
mov eax, dword [0xad5c20]
call dword [eax]
add esp, 4
mov ecx, eax
mov dword [esi + 0x24], eax
mov eax, 0xf
test ecx, ecx
je 0x4b4b16
inc edi
push edi
call fcn.004c78a0
add esp, 4
mov ecx, dword [esi + 0x24]
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
cmp dword [eax], 0
je 0x4b4b8e
mov dword [esi + 0x28], 1
jmp 0x4b49c5
mov eax, 0xf
jmp 0x4b4b16
Function at 0x4b5ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov edi, dword [ebx + 0x28]
push dword [edi + 0x84]
call fcn.004bf3a0
add esp, 4
mov esi, eax
mov dword [esp + 4], edi
imul esi, dword [edi + 8]
push dword [ebx + 0x2c]
call fcn.004bf400
add esp, 4
push dword [ebx + 0x30]
call fcn.004beac0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
test ebp, ebp
je 0x4b5f5b
mov dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x48]
cmp dword [esp + 8], 0
je 0x4b5f69
inc eax
mov dword [ebx + 0x48], eax
cmp eax, esi
jae 0x4b5f77
cmp dword [ebx + 0x5c], 0
je 0x4b6037
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x4b5f8a
mov dword [ebx + 0x54], 0xc
mov esi, 0xc
mov edi, dword [esp]
push edi
push esi
push 0
push ebx
call fcn.004cc320
add esp, 0x10
push edi
push dword [ebx + 0x58]
push esi
push dword [ebx + 0x44]
call dword [ebx + 0x40]
add esp, 0x10
push dword [ebx + 0x2c]
call fcn.004bf400
add esp, 4
push dword [ebx + 0x30]
call fcn.004beac0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebx]
push ecx
push dword [eax + 0x90]
call fcn.004be6f0
add esp, 8
push dword [ebx + 0x34]
call fcn.004beac0
add esp, 4
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
push dword [ebx + 0x3c]
call fcn.004c2ed0
add esp, 4
mov eax, dword [0xad5c18]
push ebx
call dword [eax]
add esp, 4
push dword [esp + 4]
call fcn.004c8880
add esp, 4
mov eax, 0xc
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004b6050
Function at 0x4b8350
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14c
mov ebp, dword [esp + 0x168]
mov esi, dword [esp + 0x164]
mov ecx, dword [esp + 0x160]
mov dword [esp + 8], 0
test ecx, ecx
sete al
test esi, esi
sete dl
or dl, al
test ebp, ebp
sete al
or al, dl
mov eax, 2
jne 0x4b843f
mov dword [ebp], 0
mov eax, 4
test byte [ecx], 0x40
jne 0x4b843f
push 0x2e
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov ecx, eax
mov eax, 4
test ecx, ecx
jne 0x4b843f
push str.HOSTALIASES
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
xor ebx, ebx
test eax, eax
je 0x4b8417
mov edi, eax
mov dword [esp], 4
call fcn.004c5ca0
test eax, eax
je 0x4b8420
push eax
push edi
mov ebx, eax
call fcn.004c77b0
add esp, 8
test eax, eax
jne 0x4b8412
lea eax, [esp + 8]
push eax
push 0
push 0x30
push 1
push 0x9b8c28
push ebx
call fcn.004c69c0
add esp, 0x18
test eax, eax
je 0x4b844a
mov dword [esp], eax
jmp 0x4b8427
mov dword [esp], 4
jmp 0x4b8427
mov dword [esp], 0xf
push ebx
call fcn.004c5d00
add esp, 4
push dword [esp + 8]
call fcn.004bebf0
add esp, 4
mov eax, dword [esp]
add esp, 0x14c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], ebx
push dword [esp + 8]
call fcn.004be960
add esp, 4
test eax, eax
je 0x4b85d1
mov edi, eax
jmp 0x4b8479
push edi
call fcn.004be9d0
add esp, 4
mov edi, eax
test eax, eax
je 0x4b85d1
push edi
call fcn.004be9f0
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp + 0x13c], xmm0
movups xmmword [esp + 0x12c], xmm0
movups xmmword [esp + 0x11c], xmm0
movups xmmword [esp + 0x10c], xmm0
movups xmmword [esp + 0xfc], xmm0
movups xmmword [esp + 0xec], xmm0
movups xmmword [esp + 0xdc], xmm0
movups xmmword [esp + 0xcc], xmm0
movups xmmword [esp + 0xbc], xmm0
movups xmmword [esp + 0xac], xmm0
movups xmmword [esp + 0x9c], xmm0
movups xmmword [esp + 0x8c], xmm0
movups xmmword [esp + 0x7c], xmm0
movups xmmword [esp + 0x6c], xmm0
movups xmmword [esp + 0x5c], xmm0
movups xmmword [esp + 0x4c], xmm0
push eax
call fcn.004c6200
add esp, 4
push ebx
call fcn.004c67e0
add esp, 4
push 0x40
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.004c6320
add esp, 0xc
test eax, eax
jne 0x4b8466
push esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4b8466
push 1
push ebx
call fcn.004c6740
add esp, 8
push ebx
call fcn.004c6200
add esp, 4
push ebx
call fcn.004c67e0
add esp, 4
push 0x100
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.004c6320
add esp, 0xc
test eax, eax
jne 0x4b8466
lea eax, [esp + 0x4c]
push eax
call fcn.004c7890
add esp, 4
test eax, eax
je 0x4b8466
lea eax, [esp + 0x4c]
push eax
call fcn.004c7b70
add esp, 4
test eax, eax
je 0x4b8466
lea eax, [esp + 0x4c]
push eax
call fcn.004c78a0
add esp, 4
mov dword [ebp], eax
xor ecx, ecx
test eax, eax
mov eax, 0xf
cmovne eax, ecx
mov dword [esp], eax
mov ebx, dword [esp + 4]
jmp 0x4b8427
Function at 0x4b9b60
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
push str.LOCALDOMAIN
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x4b9c1f
push eax
call fcn.004c78a0
add esp, 4
mov esi, eax
mov eax, 0xf
test esi, esi
je 0x4b9c52
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4b9bbc
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4b9bbc
push ecx
push eax
call fcn.004c7c20
add esp, 8
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
push ebx
push 0x9b8d2b
push esi
call fcn.004c7cf0
add esp, 0xc
mov dword [edi + 0xc], eax
test eax, eax
je 0x4b9c42
cmp dword [ebx], 2
jb 0x4b9c14
mov dword [esp], ebx
mov ebp, 1
mov ebx, dword [0xad5c18]
nop dword [eax + eax]
mov eax, dword [edi + 0xc]
push dword [eax + ebp*4]
call dword [ebx]
add esp, 4
mov eax, dword [edi + 0xc]
mov dword [eax + ebp*4], 0
inc ebp
cmp ebp, dword [edi + 0x10]
jb 0x4b9bf0
mov eax, dword [esp]
mov dword [eax], 1
mov eax, dword [0xad5c18]
push esi
call dword [eax]
add esp, 4
push str.RES_OPTIONS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x4b9c3e
push eax
push edi
call fcn.004b9880
add esp, 8
test eax, eax
jne 0x4b9c52
xor eax, eax
jmp 0x4b9c52
mov eax, dword [0xad5c18]
push esi
call dword [eax]
add esp, 4
mov eax, 0xf
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bd120
Capabilities:
Check if file exists

Disassembly:
push esi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, 0x17
je 0x4bd14a
cmp eax, 2
jne 0x4bd178
push 4
call fcn.004bcdf0
add esp, 4
mov esi, eax
cmp eax, 0xffffffff
jne 0x4bd16e
jmp 0x4bd15f
push 0x10
push edx
push ecx
push 0x17
call fcn.004bc900
add esp, 0x10
mov esi, eax
cmp eax, 0xffffffff
jne 0x4bd16e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 2
je 0x4bd176
sar esi, 0x1f
or esi, 1
mov eax, esi
pop esi
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
pop esi
ret

Function at 0x4c77b0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
test ecx, ecx
sete al
test ebx, ebx
sete dl
or dl, al
mov eax, 2
jne 0x4c7827
push 0x9ba0ad
push ecx
call fcn.00788c60
add esp, 8
test eax, eax
je 0x4c780e
mov esi, eax
push 2
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
mov ebp, 0xe
test eax, eax
je 0x4c782f
push esi
call fcn.00788c38
add esp, 4
mov eax, ebp
jmp 0x4c7827
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
cmp eax, 2
mov ecx, 4
mov eax, 0xe
cmove eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
add esp, 4
test eax, eax
js 0x4c7801
mov edi, eax
push 0
push 0
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
jne 0x4c7801
test edi, edi
je 0x4c787d
mov dword [esp], edi
mov eax, esp
push eax
push ebx
call fcn.004c6050
add esp, 8
test eax, eax
je 0x4c7881
push esi
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov dword [esp], eax
cmp eax, edi
jne 0x4c7801
add dword [ebx + 4], edi
xor ebp, ebp
jmp 0x4c7801
mov ebp, 0xf
jmp 0x4c7801

Function at 0x4c84e0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
test ebx, ebx
sete al
test edi, edi
sete cl
or cl, al
mov eax, 2
jne 0x4c853a
push 0x14
call fcn.004b4fe0
add esp, 4
test eax, eax
je 0x4c853e
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov eax, esi
add eax, 4
push eax
push 0
push esi
push 0x4c8560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x4c8547
mov dword [edi], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, 0xf
pop esi
pop edi
pop ebx
ret
mov eax, dword [0xad5c18]
push esi
call dword [eax]
add esp, 4
mov eax, 3
pop esi
pop edi
pop ebx
ret
Function at 0x4c8d60
Capabilities:
Generate random numbers via rtlgenrandom
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, edx
mov esi, ecx
mov ebx, dword [esp + 0x18]
jmp 0x4c8d81
mov ecx, esi
call fcn.004c8aa0
xor ecx, ecx
test ecx, ecx
jne 0x4c8e5d
mov eax, dword [esi]
cmp eax, 2
je 0x4c8da0
cmp eax, 1
je 0x4c8e46
cmp eax, 4
jne 0x4c8d70
jmp 0x4c8df9
xor ebp, ebp
nop word cs:[eax + eax]
lea eax, [edi + ebp]
mov ecx, ebx
sub ecx, ebp
push dword [esi + 8]
push ecx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
add ebp, eax
xor ecx, ecx
cmp ebp, ebx
sete cl
test eax, eax
mov eax, ecx
mov edx, 6
cmove eax, edx
test eax, eax
je 0x4c8db0
cmp eax, 6
jne 0x4c8d79
cmp dword [esi], 2
jne 0x4c8d70
push dword [esi + 8]
call fcn.00788c38
add esp, 4
jmp 0x4c8d70
mov eax, dword [esi + 0x108]
mov ecx, dword [esi + 0x10c]
test ebx, ebx
je 0x4c8e4f
xor edx, edx
mov ebx, ecx
mov dword [esp], edi
inc eax
movzx eax, al
mov ch, byte [esi + eax + 8]
add bl, ch
movzx ebp, bl
mov cl, byte [esi + ebp + 8]
mov byte [esi + eax + 8], cl
mov byte [esi + ebp + 8], ch
add ch, byte [esi + eax + 8]
movzx ecx, ch
movzx ecx, byte [esi + ecx + 8]
mov edi, dword [esp]
mov byte [edi + edx], cl
mov edi, dword [esp + 0x18]
inc edx
cmp edi, edx
jne 0x4c8e10
jmp 0x4c8e51
push ebx
push edi
call sub.ADVAPI32.dll_SystemFunction036
jmp 0x4c8e5d
mov ebp, ecx
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ca870
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
push esi
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0xb4]
test esi, esi
je 0x4ca8aa
mov esi, dword [esi + 0xc]
test esi, esi
je 0x4ca8aa
push dword [edi + 0xb8]
push 0
push 0
push 0
push edx
push ecx
push eax
call esi
add esp, 0x1c
pop esi
pop edi
ret
push 0
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
pop esi
pop edi
ret

Function at 0x4ca8c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ebp, dword [eax + 0xb4]
test ebp, ebp
je 0x4ca903
mov ebp, dword [ebp + 0xc]
test ebp, ebp
je 0x4ca903
push dword [eax + 0xb8]
push ebx
push edi
push esi
push edx
push ecx
push dword [esp + 0x30]
call ebp
add esp, 0x1c
jmp 0x4ca912
push ebx
push edi
push esi
push edx
push ecx
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_recvfrom]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ca920
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov esi, dword [eax]
mov edi, dword [esi + 0x208]
mov esi, dword [edi + 0xb4]
test esi, esi
je 0x4ca969
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4ca969
mov dword [esp], ecx
mov dword [esp + 4], edx
mov ecx, esp
push dword [edi + 0xb8]
push 1
push ecx
push dword [eax + 4]
call esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov ebx, dword [eax + 0x1c]
test bl, 4
je 0x4ca977
and ebx, 0xfffffffb
mov dword [eax + 0x1c], ebx
push 0
push edx
push ecx
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_send]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x4caf70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov dword [esp + 0xc], pe_nt_image_headers32
xor eax, eax
cmp dword [ecx + 8], 0
je 0x4caf93
lea esp, [ebp - 4]
pop esi
pop ebp
ret
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
lea eax, [esp + 0xc]
lea edx, [esp + 0x10]
push eax
push edx
mov esi, ecx
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, eax
mov eax, 0xb
test ecx, ecx
jne 0x4caf8d
movzx ecx, word [esp + 0x10]
cmp ecx, 0x17
je 0x4cb000
cmp ecx, 2
jne 0x4caf8d
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 2
mov dword [esi + 0xc], eax
jmp 0x4cb010
mov dword [esi + 8], 0x17
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0xc], xmm0
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x4cb060
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
nop word cs:[eax + eax]
mov eax, dword [edi + 0xb4]
test eax, eax
je 0x4cb0b0
mov eax, dword [eax + 8]
test eax, eax
je 0x4cb0b0
push dword [edi + 0xb8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push ebp
call eax
add esp, 0x10
jmp 0x4cb0bf
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebp
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call ebx
mov ecx, eax
cmp esi, 0xffffffff
sete al
lea edx, [ecx - 0x2735]
cmp edx, 0xfffffffe
setb dl
test al, dl
jne 0x4cb0ec
xor eax, eax
cmp esi, 0xffffffff
jne 0x4cb0f1
cmp ecx, 0x2714
je 0x4cb080
jmp 0x4cb0f1
mov eax, 0xb
pop esi
pop edi
pop ebx
pop ebp
ret