joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1480
Capabilities:
Enumerate process modules
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x588b26
mov eax, dword fs:[0]
push eax
sub esp, 0xe58
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0xe50], eax
push ebx
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0xe68]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b1637
push 0x424
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x40], 0x428
call fcn.00552500
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
push ebx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4b1630
cmp dword [esp + 0x3c], 0
jne 0x4b151a
lea edx, [esp + 0x34]
push edx
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x4b1630
push 0x1fe
lea eax, [esp + 0x462]
push 0
push eax
call fcn.00552500
mov ecx, 0x3f
lea esi, [esp + 0x60]
lea edi, [esp + 0x468]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x468]
push ecx
movsb byte es:[edi], byte [esi]
call fcn.0057d6e0
lea edx, [esp + 0x46c]
push str.sxin.dll
push edx
call fcn.005570e2
add esp, 0x18
test eax, eax
je 0x4b158a
lea eax, [esp + 0x45c]
push str.sxin64.dll
push eax
call fcn.005570e2
add esp, 8
test eax, eax
jne 0x4b1604
xor edi, edi
push 0x7fe
lea ecx, [esp + 0x662]
push edi
push ecx
mov word [esp + 0x668], di
call fcn.00552500
add esp, 0xc
lea edx, [esp + 0x65c]
push edx
push 0x400
push edi
lea eax, [esp + 0x60]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea esi, [esp + 0x65c]
lea esp, [esp]
cmp word [esi], 0x33
jne 0x4b15f6
cmp word [esi + 2], 0x36
jne 0x4b15f6
cmp word [esi + 4], 0x30
jne 0x4b15f6
push str.360_
push esi
call fcn.00556166
add esp, 8
test eax, eax
jne 0x4b165d
add edi, 1
add esi, 2
cmp edi, 0x3fe
jl 0x4b15d0
lea ecx, [esp + 0x45c]
push str.SbieDll.dll
push ecx
call fcn.005570e2
add esp, 8
test eax, eax
je 0x4b165d
lea edx, [esp + 0x34]
push edx
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4b1522
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0xe68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe50]
xor ecx, esp
call fcn.00552d63
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4b1639
Function at 0x4b26c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 8], eax
push esi
push edi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x14]
mov ecx, eax
mov edx, eax
shr eax, 8
shr ecx, 0x18
mov byte [esp + 0xd], al
mov al, byte [esi + 0x14]
mov byte [esp + 0xf], cl
shr edx, 0x10
mov byte [esp + 0xc], al
mov eax, dword [esi + 0x10]
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0xe], dl
mov edx, eax
mov byte [esp + 0xb], cl
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [esp + 0xa], dl
mov dl, al
shr eax, 3
mov byte [esp + 9], cl
and eax, 0x3f
mov ecx, 0x40
sub ecx, eax
cmp ecx, 9
mov edi, dword [esp + 0x18]
mov byte [esp + 8], dl
jae 0x4b2734
add ecx, 0x40
add ecx, 0xfffffff8
push ecx
push 0x5c91b8
push esi
call fcn.004b2610
push 8
lea eax, [esp + 0x18]
push eax
push esi
call fcn.004b2610
add esp, 0x18
test edi, edi
je 0x4b27cc
movzx ecx, byte [esi + 3]
mov byte [edi + 3], cl
movzx edx, byte [esi + 2]
mov byte [edi + 2], dl
mov eax, dword [esi]
shr eax, 8
mov byte [edi + 1], al
movzx ecx, byte [esi]
mov byte [edi], cl
movzx edx, byte [esi + 7]
mov byte [edi + 7], dl
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
mov ecx, dword [esi + 4]
shr ecx, 8
mov byte [edi + 5], cl
movzx edx, byte [esi + 4]
mov byte [edi + 4], dl
movzx eax, byte [esi + 0xb]
mov byte [edi + 0xb], al
movzx ecx, byte [esi + 0xa]
mov byte [edi + 0xa], cl
mov edx, dword [esi + 8]
shr edx, 8
mov byte [edi + 9], dl
movzx eax, byte [esi + 8]
mov byte [edi + 8], al
movzx ecx, byte [esi + 0xf]
mov byte [edi + 0xf], cl
movzx edx, byte [esi + 0xe]
mov byte [edi + 0xe], dl
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 0xd], al
movzx ecx, byte [esi + 0xc]
mov byte [edi + 0xc], cl
push 0x58
push 0
push esi
call fcn.00552500
mov ecx, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.00552d63
add esp, 0xc
ret

Function at 0x4b27f0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x64]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
push ecx
push eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.004b2610
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004b26c0
mov ecx, dword [esp + 0x70]
add esp, 0x14
pop esi
xor ecx, esp
call fcn.00552d63
add esp, 0x5c
ret

Function at 0x4b2870
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
Function at 0x4b2890
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov eax, edx
push edi
mov esi, ecx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4b28a0
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edx
mov edx, dword [esi + 4]
push edx
call edi
test eax, eax
jne 0x4b28c9
pop edi
pop esi
ret 4
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push 2
push 0x596ee4
push ecx
call edi
neg eax
sbb eax, eax
pop edi
add eax, 1
pop esi
ret 4

Function at 0x4b28f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
add eax, 1
ret 0xc

Function at 0x4b2a50
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4b2a6f
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
pop ebx
add esp, 0x10
ret
push esi
push edi
push 1
lea esi, [esp + 0x10]
push esi
xor edx, edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4b2a8f
xor esi, esi
xor edi, edi
jmp 0x4b2a97
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp esi, dword [esp + 0x14]
jne 0x4b2abe
cmp edi, dword [esp + 0x18]
jne 0x4b2abe
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x4b2ad0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [ecx + 4]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x4b2b00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5cca0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
je 0x4b2b59
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 1
cmp edi, 0x3fffffff
jg 0x4b2b59
lea eax, [edi + edi]
call fcn.00553150
mov esi, esp
test esi, esi
je 0x4b2b59
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0x3a8
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x4b2b5b
xor eax, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4b2b8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4b2b8b
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552d63
mov esp, ebp
pop ebp
ret
mov eax, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552d63
mov esp, ebp
pop ebp
ret
Function at 0x4b3150
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x588c32
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.00554a50
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x2018], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0x2030]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2040]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], edi
mov esi, ecx
mov dword [esp + 0x28], ebx
mov byte [ebx + 4], 0
mov eax, dword [esi + 4]
cmp eax, edi
mov dword [esp + 0x2038], edi
mov dword [esp + 0x1c], 1
mov byte [esp + 0x16], 0
jne 0x4b31d5
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4b31e9
push 1
lea ebp, [esp + 0x24]
push ebp
xor edx, edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, esi
call fcn.004b2a50
test eax, eax
jne 0x4b32ea
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, edi
mov edx, dword [esi + 4]
push edi
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x23]
push ecx
push edx
call ebp
mov al, byte [esp + 0x17]
cmp al, 0xd
je 0x4b321f
cmp al, 0xa
jne 0x4b322f
mov ecx, esi
call fcn.004b2a50
test eax, eax
je 0x4b3200
jmp 0x4b32ea
mov edx, dword [esi + 4]
cmp edx, edi
jne 0x4b3240
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4b3257
push 1
or eax, 0xffffffff
lea edi, [esp + 0x24]
push edi
or ecx, eax
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor edi, edi
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x22]
push ecx
push edx
call ebp
mov eax, dword [esi + 4]
test eax, eax
jne 0x4b327c
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4b3291
push 1
or ecx, 0xffffffff
lea ebp, [esp + 0x24]
push ebp
or edx, ecx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov al, byte [esp + 0x16]
cmp al, 0xd
je 0x4b32d9
lea esp, [esp]
cmp al, 0xa
je 0x4b32d9
mov ecx, esi
call fcn.004b2a50
test eax, eax
jne 0x4b32d9
cmp edi, 0x1fff
jae 0x4b32d9
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1e]
push ecx
mov ecx, esi
call fcn.004b28f0
mov al, byte [esp + 0x16]
mov byte [esp + edi + 0x2c], al
add edi, 1
cmp al, 0xd
jne 0x4b32a0
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
mov byte [esp + edi + 0x30], 0
call fcn.0040dd10
mov eax, ebx
mov ecx, dword [esp + 0x2030]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2018]
xor ecx, esp
call fcn.00552d63
add esp, 0x2028
ret 4
Function at 0x4b6400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x589100
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov dword [esp + 0x24], ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x88], ebx
call fcn.004bb870
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x8c], 1
call fcn.004bbc40
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
lea ecx, [esp + 0x14]
mov byte [esp + 0x88], 2
xor esi, esi
call fcn.004ba7f0
test eax, eax
jbe 0x4b660b
nop
push esi
lea ecx, [esp + 0x18]
call fcn.004ba7a0
push 1
push ebx
push 0x59a408
mov ecx, eax
call fcn.004050c0
push esi
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.004ba7a0
push 1
push ebx
push 0x59a404
mov ecx, eax
call fcn.004050c0
cmp edi, ebx
jl 0x4b6519
sub eax, edi
sub eax, 1
push eax
add edi, 1
push edi
lea ecx, [esp + 0x30]
push ecx
push esi
lea ecx, [esp + 0x24]
call fcn.004ba7a0
mov ecx, eax
call fcn.0040dd40
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x94], 3
call fcn.0040a080
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x88], 2
jb 0x4b65f7
mov edx, dword [esp + 0x2c]
jmp 0x4b65ee
push esi
lea ecx, [esp + 0x18]
call fcn.004ba7a0
push 1
push ebx
push 0x59a400
mov ecx, eax
call fcn.004050c0
mov edi, eax
cmp edi, ebx
jl 0x4b65f7
push esi
lea ecx, [esp + 0x18]
call fcn.004ba7a0
mov eax, dword [eax + 0x14]
sub eax, edi
add eax, 1
push eax
lea eax, [edi + 1]
push eax
lea ecx, [esp + 0x4c]
push ecx
push esi
lea ecx, [esp + 0x24]
call fcn.004ba7a0
mov ecx, eax
call fcn.0040dd40
mov ebp, eax
push edi
push ebx
lea edx, [esp + 0x30]
push edx
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x98], 4
call fcn.004ba7a0
mov ecx, eax
call fcn.0040dd40
mov ecx, dword [esp + 0x24]
push eax
lea eax, [esp + 0x64]
push eax
mov byte [esp + 0x90], 5
call fcn.004b5330
mov ecx, eax
call fcn.0046dc30
push 0xffffffffffffffff
push ebx
push ebp
mov ecx, eax
call fcn.0040a080
mov edi, 0x10
cmp dword [esp + 0x40], edi
jb 0x4b65cc
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0055215c
add esp, 4
cmp dword [esp + 0x5c], edi
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x88], 2
jb 0x4b65f7
mov edx, dword [esp + 0x48]
push edx
call fcn.0055215c
add esp, 4
lea ecx, [esp + 0x14]
add esi, 1
call fcn.004ba7f0
cmp esi, eax
jb 0x4b6490
mov esi, 0x10
cmp dword [esp + 0x78], esi
jb 0x4b6623
mov eax, dword [esp + 0x64]
push eax
call fcn.0055215c
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov byte [esp + 0x88], bl
call fcn.004bb880
cmp dword [esp + 0xa8], esi
jb 0x4b665c
mov ecx, dword [esp + 0x94]
push ecx
call fcn.0055215c
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00552d63
add esp, 0x78
ret 0x1c
Function at 0x4b72c0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x4b72cf
mov eax, 1
pop edi
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push esi
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0x59a4b0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4b7352
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4b7352
push 0x20
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4b7352
push 0x28
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4b7352
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0x59a4b0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4b7352
mov eax, dword [edi]
test eax, eax
je 0x4b735c
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [edi], esi
mov eax, esi
pop esi
pop ebx
pop edi
ret
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x4b7370
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x1c
push ebp
xor ebp, ebp
cmp dword [esp + 0x28], ebp
push esi
mov esi, ecx
jle 0x4b74fb
call fcn.004b72c0
test eax, eax
je 0x4b74fb
lea eax, [esi + 4]
push edi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x34]
cmp edi, ebp
je 0x4b74a6
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push ebp
push ebp
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4b73f1
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptCreateHash_error
call fcn.0055258b
push 0x5b87a8
lea eax, [esp + 0x20]
push eax
call fcn.005523f9
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0xc]
push ebp
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4b742c
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptHashData_error
call fcn.0055258b
push 0x5b87a8
lea ecx, [esp + 0x20]
push ecx
call fcn.005523f9
mov eax, dword [esp + 0xc]
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
push ebp
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x4b746e
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptDeriveKey_error
call fcn.0055258b
push 0x5b87a8
lea eax, [esp + 0x20]
push eax
call fcn.005523f9
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x4b74a2
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptDestroyHash_error
call fcn.0055258b
push 0x5b87a8
lea eax, [esp + 0x20]
push eax
call fcn.005523f9
mov dword [esp + 0xc], ebp
push ebx
mov ebx, dword [esp + 0x30]
xor edi, edi
mov ebp, 0x3e8
mov eax, dword [esp + 0x34]
sub eax, edi
cmp eax, ebp
jbe 0x4b74c6
add edi, ebp
mov dword [esp + 0x14], ebp
xor esi, esi
jmp 0x4b74cf
mov dword [esp + 0x14], eax
mov esi, 1
mov edx, dword [esp + 0x18]
push ebp
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0
push esi
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test esi, esi
jne 0x4b74ee
add ebx, ebp
jmp 0x4b74b2
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x4b737a
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x1c
push ebp
xor ebp, ebp
cmp dword [esp + 0x28], ebp
push esi
mov esi, ecx
jle 0x4b74fb
call fcn.004b72c0
test eax, eax
je 0x4b74fb
lea eax, [esi + 4]
push edi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x34]
cmp edi, ebp
je 0x4b74a6
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push ebp
push ebp
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4b73f1
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptCreateHash_error
call fcn.0055258b
push 0x5b87a8
lea eax, [esp + 0x20]
push eax
call fcn.005523f9
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0xc]
push ebp
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4b742c
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptHashData_error
call fcn.0055258b
push 0x5b87a8
lea ecx, [esp + 0x20]
push ecx
call fcn.005523f9
mov eax, dword [esp + 0xc]
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
push ebp
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x4b746e
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptDeriveKey_error
call fcn.0055258b
push 0x5b87a8
lea eax, [esp + 0x20]
push eax
call fcn.005523f9
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x4b74a2
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], str.CryptDestroyHash_error
call fcn.0055258b
push 0x5b87a8
lea eax, [esp + 0x20]
push eax
call fcn.005523f9
mov dword [esp + 0xc], ebp
push ebx
mov ebx, dword [esp + 0x30]
xor edi, edi
mov ebp, 0x3e8
mov eax, dword [esp + 0x34]
sub eax, edi
cmp eax, ebp
jbe 0x4b74c6
add edi, ebp
mov dword [esp + 0x14], ebp
xor esi, esi
jmp 0x4b74cf
mov dword [esp + 0x14], eax
mov esi, 1
mov edx, dword [esp + 0x18]
push ebp
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0
push esi
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test esi, esi
jne 0x4b74ee
add ebx, ebp
jmp 0x4b74b2
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x4b7da0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x10
mov dword [esp + 8], ecx
lea ecx, [esp + 4]
push ecx
push 0
mov word [esp + 0xe], dx
mov edx, dword [esp + 0x2c]
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00552d63
add esp, 0x14
ret

Function at 0x4b8e30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x4b8e4d
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4b8e97
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00552de0
add esp, 0xc
cmp dword [esp + 0x30], 0x10
jb 0x4b8e84
mov edx, dword [esp + 0x1c]
push edx
call fcn.0055215c
add esp, 4
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00552d63
add esp, 0x14
ret
cmp dword [esp + 0x30], 0x10
jb 0x4b8eab
mov eax, dword [esp + 0x1c]
push eax
call fcn.0055215c
add esp, 4
mov ecx, dword [esp + 0x10]
xor ecx, esp
xor eax, eax
call fcn.00552d63
add esp, 0x14
ret

Function at 0x4b9190
Capabilities:
Create udp socket

Disassembly:
push 0xffffffffffffffff
push 0x589258
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x48]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov dword [esp + 0x44], 0
mov byte [ecx + 4], 0
call fcn.0040a080
call fcn.004b8e30
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x4b9220
cmp dword [esp + 0x3c], 0x10
jb 0x4b920b
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0055215c
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b925c
cmp dword [esp + 0x3c], 0x10
jb 0x4b920b
mov edx, dword [esp + 0x28]
push edx
call fcn.0055215c
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
push eax
push ebp
push ecx
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov ecx, edi
mov edx, eax
call fcn.004b7da0
add esp, 0xc
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [esp + 0x3c], 0x10
jb 0x4b9297
mov edx, dword [esp + 0x28]
push edx
call fcn.0055215c
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret