joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed5a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 + 0x190]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
shl eax, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1b4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 4]
sub edx, dword [ecx + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3a0]
mov edx, dword [ecx + 0x3c]
and edx, 3
je 0x4ed6fa
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax*4 + 0x1a4], 0x472fbc
jne 0x4ed6fa
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x4ed62b
cmp dword [ebp - 0xc], 0
je 0x4ed6fa
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call fcn.00470eab
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4ed6fa
mov ecx, dword [ebp - 0x10]
and ecx, 1
je 0x4ed6fa
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x4ed6a5
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x8000
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [0x56800c]
add esp, 4
cmp esi, esp
call fcn.00471e7d
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
mov dword [edx + 8], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4ed6f0
xor ecx, ecx
jne 0x4ed6ad
mov esi, esp
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 8]
push ecx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4ed6ee
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + 8], edx
jmp 0x4ed6fa
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x4eda00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x190], 0
je 0x4eda4b
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x11c]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x190]
call edx
add esp, 0x14
cmp esi, esp
call fcn.00471e7d
jmp 0x4eda9d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4eda9b
cmp dword [ebp - 4], 2
jle 0x4eda5f
jmp 0x4eda9b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x118]
push edx
push 1
push 2
imul eax, dword [ebp + 0xc], 3
add eax, 0x55f4b4
push eax
call fcn.004708b6
add esp, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x118]
push edx
push 1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004708b6
add esp, 0x10
xor eax, eax
pop esi
add esp, 4
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x4ef640
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
lea edi, [ebp - 0x34]
mov ecx, 0xd
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5759c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x49c]
test ecx, ecx
je 0x4ef678
mov dword [ebp - 0x34], 1
jmp 0x4ef67f
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0xc], edx
mov esi, esp
push 4
lea eax, [ebp - 0xc]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.00471e7d
test eax, eax
jge 0x4ef6c3
mov edx, dword [ebp + 0xc]
push edx
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov eax, dword [ebp + 8]
push eax
call fcn.00470e9c
add esp, 0xc
jmp 0x4ef767
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4a0]
push edx
call fcn.004709f1
add esp, 4
mov dword [ebp - 0xc], eax
imul eax, dword [ebp - 0xc], 0x3e8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4a4]
push eax
call fcn.004709f1
add esp, 4
mov dword [ebp - 0xc], eax
imul ecx, dword [ebp - 0xc], 0x3e8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 0x98000004
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp esi, esp
call fcn.00471e7d
test eax, eax
je 0x4ef767
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.00471e7d
push eax
mov eax, dword [ebp + 0xc]
push eax
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov ecx, dword [ebp + 8]
push ecx
call fcn.00470e9c
add esp, 0x10
push edx
mov ecx, ebp
push eax
lea edx, [0x4ef794]
call fcn.0047194b
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471225
add esp, 0x34
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x50f230
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
push 0xf0000000
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp esi, esp
call fcn.00471e7d
test eax, eax
je 0x50f27b
mov ecx, dword [ebp + 8]
add ecx, 4
mov esi, esp
push ecx
push 0
push 0
push 0x8003
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.00471e7d
pop esi
cmp ebp, esp
call fcn.00471e7d
pop ebp
ret
Function at 0x521680
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push esi
push edi
lea edi, [ebp - 0xa8]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5759c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x190]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xa0], 0x80
mov esi, esp
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp esi, esp
call fcn.00471e7d
test eax, eax
jne 0x521728
mov dword [ebp - 0xa0], 0x80
mov esi, esp
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_accept]
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00470140
add esp, 8
cmp dword [ebp - 0x10], 0xffffffff
jne 0x521759
push str.Error_accept__ing_server_connect
mov ecx, dword [ebp - 8]
push ecx
call fcn.00472a30
add esp, 8
mov eax, 0x1e
jmp 0x52180b
push str.Connection_accepted_from_server_n
mov edx, dword [ebp - 8]
push edx
call fcn.00470e9c
add esp, 8
mov eax, dword [ebp + 8]
mov byte [eax + 0x370], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + ecx + 0x190], eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004702ad
add esp, 8
mov edx, 1
shl edx, 0
mov eax, dword [ebp + 8]
mov byte [eax + edx + 0x1a0], 1
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x198], 0
je 0x521809
mov dword [ebp - 0xa8], 0
mov esi, esp
push 1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x19c]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x198]
call eax
add esp, 0xc
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x521809
mov ecx, dword [ebp + 8]
push ecx
call fcn.00521490
add esp, 4
mov eax, 0x2a
jmp 0x52180b
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x52183c]
call fcn.0047194b
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471225
add esp, 0xa8
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x5246d0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
cdq
mov ecx, 0x64
idiv ecx
cmp eax, 2
je 0x52471b
push str.Couldnt_set_desired_mode
mov edx, dword [ebp - 8]
push edx
call fcn.00472a30
add esp, 8
mov eax, 0x11
jmp 0x524796
cmp dword [ebp + 0xc], 0xc8
je 0x524739
mov eax, dword [ebp + 0xc]
push eax
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
mov ecx, dword [ebp - 8]
push ecx
call fcn.00470e9c
add esp, 0xc
cmp dword [ebp + 0x10], 0x13
jne 0x524750
mov edx, dword [ebp + 8]
push edx
call fcn.00523110
add esp, 4
mov dword [ebp - 4], eax
jmp 0x524793
cmp dword [ebp + 0x10], 0x14
jne 0x524767
mov eax, dword [ebp + 8]
push eax
call fcn.005231c0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x524793
cmp dword [ebp + 0x10], 0x15
jne 0x52477e
mov ecx, dword [ebp + 8]
push ecx
call fcn.005233f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x524793
cmp dword [ebp + 0x10], 0x16
jne 0x524793
mov edx, dword [ebp + 8]
push edx
call fcn.00523430
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 8
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret

Function at 0x528a30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push esi
push edi
lea edi, [ebp - 0x1a4]
mov ecx, 0x69
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5759c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
jne 0x528a57
mov ecx, 2
mov word [ebp - 0xc], cx
mov esi, esp
lea edx, [ebp - 0x1a0]
push edx
movzx eax, word [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x528aa4
mov ecx, dword [ebp - 8]
push ecx
push str.WSAStartup_failed___d_
mov edx, dword [ebp + 8]
push edx
call fcn.00472a30
add esp, 0xc
mov eax, 2
jmp 0x528b13
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp esi, esp
call fcn.00471e7d
movzx eax, word [ebp - 0x1a0]
and eax, 0xff
movzx ecx, al
movzx edx, word [ebp - 0xc]
and edx, 0xff
movzx eax, dl
cmp ecx, eax
jne 0x528af9
movzx ecx, word [ebp - 0x1a0]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
movzx eax, word [ebp - 0xc]
shr eax, 8
and eax, 0xff
movzx ecx, al
cmp edx, ecx
je 0x528b11
push str.insufficient_winsock_version_to_support_telnet
mov edx, dword [ebp + 8]
push edx
call fcn.00472a30
add esp, 8
mov eax, 2
jmp 0x528b13
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x528b44]
call fcn.0047194b
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471225
add esp, 0x1a4
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x529410
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 8], 0xff
mov ecx, 1
shl ecx, 0
mov dl, byte [ebp + 0xc]
mov byte [ebp + ecx - 8], dl
mov eax, 1
shl eax, 1
mov cl, byte [ebp + 0x10]
mov byte [ebp + eax - 8], cl
mov esi, esp
push 0
push 3
lea edx, [ebp - 8]
push edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x190]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x5294ba
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
push str.Sending_data_failed___d_
mov edx, dword [ebp - 0x18]
push edx
call fcn.00472a30
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SENT
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.005291d0
add esp, 0x10
push edx
mov ecx, ebp
push eax
lea edx, [0x5294f8]
call fcn.0047194b
pop eax
pop edx
pop esi
add esp, 0x18
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x5329f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push edi
lea edi, [ebp - 0x11c]
mov ecx, 0x47
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5759c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00471059
add esp, 4
mov dword [ebp - 0x114], eax
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 0x104
jae 0x532a45
jmp 0x532a4a
call fcn.00470343
mov eax, dword [ebp - 0x118]
mov byte [ebp + eax - 0x10c], 0
cmp dword [ebp - 0x114], 0
je 0x532a83
mov esi, esp
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp esi, esp
call fcn.00471e7d
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x10c]
test edx, edx
je 0x532ab8
mov esi, esp
lea eax, [ebp - 0x10c]
push eax
call dword [0x568018]
add esp, 4
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 0x11c], eax
jmp 0x532ac2
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
push edx
mov ecx, ebp
push eax
lea edx, [0x532af8]
call fcn.0047194b
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471225
add esp, 0x11c
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x53a000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx + 4], 3
jne 0x53a02c
mov dword [ebp - 0xc], 1
jmp 0x53a033
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x53a042
mov dword [ebp - 0x10], 0
jmp 0x53a049
mov dword [ebp - 0x10], 1
mov dl, byte [ebp - 0x10]
mov byte [ebp - 5], dl
movzx eax, byte [ebp - 5]
test eax, eax
je 0x53a093
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc], 0
jne 0x53a067
xor eax, eax
jmp 0x53a119
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
cmp esi, esp
call fcn.00471e7d
mov dword [ebp - 4], eax
jmp 0x53a0e2
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x53a0c6
push 0x5740d8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push eax
call fcn.00472fd0
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
jne 0x53a0c6
or eax, 0xffffffff
jmp 0x53a119
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.00472788
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x53a116
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x53a10a
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call fcn.00470e29
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
pop esi
add esp, 0x10
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x542510
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
lea edi, [ebp - 0x44]
mov ecx, 0x11
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5759c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 8
mov esi, esp
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp esi, esp
call fcn.00471e7d
test eax, eax
jne 0x542561
xor al, al
jmp 0x542644
push 0x14
push 0
lea ecx, [ebp - 0x34]
push ecx
call fcn.00471293
add esp, 0xc
mov byte [ebp - 0x34], 8
mov byte [ebp - 0x33], 2
mov dword [ebp - 0x30], 0x6601
mov dword [ebp - 0x2c], 8
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00542370
add esp, 8
push 8
lea ecx, [ebp - 0x28]
push ecx
call fcn.00472076
add esp, 8
mov esi, esp
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
cmp esi, esp
call fcn.00471e7d
test eax, eax
jne 0x5425e3
mov esi, esp
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.00471e7d
xor al, al
jmp 0x542644
push 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0047289b
add esp, 0xc
mov esi, esp
mov edx, dword [ebp - 0x40]
push edx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
cmp esi, esp
call fcn.00471e7d
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp esi, esp
call fcn.00471e7d
mov esi, esp
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.00471e7d
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x542670]
call fcn.0047194b
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471225
add esp, 0x44
cmp ebp, esp
call fcn.00471e7d
mov esp, ebp
pop ebp
ret
Function at 0x4034a0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5cdb40]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403670
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_chacha8rand.setup
Function at 0x40d090
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x5cdb40]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d25b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40d0b9
mov eax, 0x7000000
jmp 0x40d0c1
test eax, eax
je 0x40d236
mov dword [esp + 0x34], eax
mov ecx, dword [0x5cdb40]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x584ee0]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40d24e
cmp edx, 0x21
jae 0x40d242
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x501c68]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x501cb0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40d211
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x501ce0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand