joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d5838
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x7263ef
call fcn.006db31c
sub esp, 0x270
cmp byte [0x7ed364], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x24], ebx
je 0x4d5875
lea ecx, [ebp - 0xd]
call fcn.004d2c83
mov esi, eax
mov ecx, esi
call fcn.00451894
push dword [ebp + 0x10]
push esi
call fcn.004cbae5
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.004d579a
test al, al
jne 0x4d58b5
cmp byte [0x7ed364], al
je 0x4d58ae
cmp dword [edi + 0x14], 8
jb 0x4d5894
mov edi, dword [edi]
lea ecx, [ebp + 0x13]
call fcn.004d2780
mov esi, eax
mov ecx, esi
call fcn.004ba5d9
push edi
push esi
call fcn.004cbae5
pop ecx
pop ecx
xor al, al
jmp 0x4d5a2b
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push 0xf003f
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.004c8ab0
test eax, eax
je 0x4d5907
cmp byte [0x7ed364], bl
je 0x4d5a1a
lea ecx, [ebp + 0xf]
call fcn.004d15aa
mov esi, eax
mov ecx, esi
call fcn.004cc15a
push dword [ebp + 0x10]
push esi
call fcn.004cbae5
pop ecx
pop ecx
jmp 0x4d5a1a
push 0x208
lea eax, [ebp - 0x27c]
mov esi, ebx
push ebx
push eax
call fcn.006dca70
add esp, 0xc
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], 0x104
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x27c]
push eax
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
test eax, eax
jne 0x4d5a15
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x3c]
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x27c]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 7
call fcn.004b6b96
push 0x72aa80
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.004bdad8
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
push ecx
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x5c]
call fcn.004cdc7b
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x20]
call fcn.004d5838
neg al
lea ecx, [ebp - 0x5c]
sbb al, al
inc al
mov byte [ebp + 0x13], al
call fcn.004b6a96
lea ecx, [ebp - 0x74]
call fcn.004b6a96
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], bl
cmp eax, 8
jb 0x4d5a07
mov ecx, dword [ebp - 0x3c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ecx
cmp eax, 0x1000
jb 0x4d59fe
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00450606
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
cmp byte [ebp + 0x13], 0
je 0x4d591e
mov al, bl
jmp 0x4d5a18
xor eax, eax
inc eax
mov bl, al
cmp dword [ebp - 0x20], 0
je 0x4d5a29
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4d5c43
Capabilities:
Create thread

Disassembly:
mov eax, 0x726445
call fcn.006db31c
push ecx
push esi
push 0x7af994
push 0xf0
call fcn.006db7e4
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
je 0x4d5c95
mov ecx, eax
call fcn.004cde19
mov dword [0x7eda00], eax
test eax, eax
je 0x4d5c9b
push esi
push esi
push eax
push 0x4d5a98
push esi
push esi
call fcn.006e6d4e
add esp, 0x18
mov dword [0x7eda04], eax
jmp 0x4d5c9b
mov dword [0x7eda00], esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4d5ecf
Capabilities:
Terminate thread

Disassembly:
push ecx
mov eax, dword [0x7eda04]
test eax, eax
je 0x4d5f3c
cmp byte [0x7ed364], 0
je 0x4d5f02
push esi
lea ecx, [esp + 7]
call fcn.004ceeb0
mov esi, eax
mov ecx, esi
call fcn.004cc0e8
push esi
call fcn.004cbae5
mov eax, dword [0x7eda04]
pop ecx
pop esi
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4d5f20
push 1
push dword [0x7eda04]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x7eda04]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x7eda00]
test ecx, ecx
je 0x4d5f3c
mov eax, dword [ecx]
push 1
call dword [eax]
pop ecx
ret

Function at 0x4d6b43
Capabilities:
Get token privileges

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0xc]
push edi
push eax
xor ebp, ebp
push ebp
push ebp
push 3
push dword [esp + 0x30]
mov dword [esp + 0x24], ebp
mov ebx, ebp
call esi
push dword [esp + 0x10]
call fcn.006db7db
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push edi
push 3
push dword [esp + 0x30]
call esi
test eax, eax
jne 0x4d6b9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.006db30c
pop ecx
mov eax, esi
jmp 0x4d6bfe
lea eax, [esp + 0x14]
push eax
push str.SeTcbPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, ebp
cmp dword [edi], eax
jbe 0x4d6bdc
mov edx, dword [esp + 0x18]
lea ecx, [edi + 4]
mov esi, dword [esp + 0x14]
cmp dword [ecx + 4], edx
jne 0x4d6bc7
cmp dword [ecx], esi
je 0x4d6bd1
inc eax
add ecx, 0xc
cmp eax, dword [edi]
jb 0x4d6bbe
jmp 0x4d6bdc
inc eax
xor ebx, ebx
imul eax, eax, 0xc
or dword [eax + edi], 2
inc ebx
push ebp
push ebp
push ebp
push edi
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push edi
call fcn.006db30c
pop ecx
xor ecx, ecx
mov eax, 0x80004005
test ebx, ebx
cmovne eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4d79e7
Capabilities:
Get process image filename
Terminate process

Disassembly:
mov eax, 0x726596
call fcn.006db31c
mov eax, dword [ebp + 8]
sub esp, 0x32c
push ebx
push edi
push dword [eax + 0x18]
xor ebx, ebx
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4d7b7e
push 0x20a
lea eax, [ebp - 0x338]
push ebx
push eax
call fcn.006dca70
add esp, 0xc
lea eax, [ebp - 0x338]
push 0x105
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4d7b7e
xor eax, eax
mov dword [ebp - 0x28], ebx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
push esi
lea eax, [ebp - 0x338]
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x14], 7
call fcn.004b6b96
mov edx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp edx, 8
mov dword [ebp - 4], ebx
cmovae esi, dword [ebp - 0x28]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x4d7b3f
dec eax
or ecx, 0xffffffff
cmp eax, ecx
push 0x5c
cmovb ecx, eax
mov eax, dword [ebp - 0x10]
lea esi, [esi + ecx*2]
pop ecx
cmp word [esi], cx
je 0x4d7aab
cmp esi, eax
je 0x4d7b3f
sub esi, 2
jmp 0x4d7a99
sub esi, eax
sar esi, 1
cmp esi, 0xffffffff
je 0x4d7b3f
mov eax, dword [ebp + 8]
add eax, 0x1c
cmp dword [eax + 0x14], 0x10
jb 0x4d7ac6
mov eax, dword [eax]
lea ecx, [ebp - 0x128]
push 3
mov dword [ebp - 0x12c], ecx
lea ecx, [ebp - 0x12c]
push eax
call fcn.004b991c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x12c]
cmovae eax, dword [ebp - 0x28]
lea eax, [eax + esi*2]
add eax, 2
push eax
call fcn.006e75a6
pop ecx
test eax, eax
pop ecx
setne al
lea ecx, [ebp - 0x128]
mov byte [ebp + 0xb], al
cmp dword [ebp - 0x12c], ecx
je 0x4d7b24
push dword [ebp - 0x12c]
call fcn.006e60fe
mov al, byte [ebp + 0xb]
pop ecx
test al, al
jne 0x4d7b3c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
pop esi
cmp edx, 8
jb 0x4d7b7a
mov ecx, dword [ebp - 0x28]
lea eax, [edx*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x4d7b71
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00450606
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
mov al, bl
jmp 0x4d7b80
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4d7de5
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x660
push ebx
push ebp
push esi
mov esi, dword [esp + 0x670]
push edi
test esi, esi
je 0x4d7ef2
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4d7e05
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jb 0x4d7ef2
push esi
push 0x72efd4
mov ebp, 0x104
lea eax, [esp + 0x470]
push ebp
push eax
call fcn.004d8c2e
add esp, 0x10
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d7e61
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4d7ef5
push 0x208
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.006dca70
lea eax, [esp + 0x250]
push eax
push esi
push 0x72d970
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.004d8c2e
add esp, 0x20
test byte [esp + 0x218], 0x10
je 0x4d7ec5
lea eax, [esp + 0x218]
push eax
call fcn.004d7726
pop ecx
test eax, eax
jne 0x4d7ed0
lea eax, [esp + 0x10]
push eax
call fcn.004d693a
lea eax, [esp + 0x14]
push eax
call fcn.004d7de5
pop ecx
pop ecx
test eax, eax
jne 0x4d7ee7
jmp 0x4d7ed0
lea eax, [esp + 0x10]
push eax
call fcn.004d693a
pop ecx
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4d7e61
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4d7ef5
push 0xd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x660
ret

Function at 0x4d7fd3
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
push 3
push dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x120], eax
call fcn.004b991c
push 0x24
push dword [ebp - 0x120]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x120], eax
je 0x4d8026
push dword [ebp - 0x120]
call fcn.006e60fe
pop ecx
test esi, esi
jne 0x4d802e
xor al, al
jmp 0x4d807e
push ebx
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4d8044
xor bl, bl
jmp 0x4d8074
xor ebx, ebx
push edi
mov edi, ebx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4d8073
cmp dword [ebp - 0x18], 1
je 0x4d8071
inc edi
cmp edi, 0xa
jb 0x4d8049
jmp 0x4d8073
mov bl, 1
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop ebx
pop esi
leave
ret 8
Function at 0x4d8083
Capabilities:
Set registry value

Disassembly:
mov eax, 0x7265e0
call fcn.006db31c
sub esp, 0x2c
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4d8178
mov eax, dword [edi + 4]
xor edx, edx
mov ecx, dword [edi]
sub eax, ecx
push esi
mov dword [ebp + 8], edx
push 0x38
pop esi
cdq
idiv esi
mov dword [ebp - 0x14], esi
test eax, eax
je 0x4d812b
xor esi, esi
lea eax, [esi + ecx]
cmp dword [eax + 0x10], 0
je 0x4d80f4
cmp dword [eax + 0x14], 0x10
jb 0x4d80de
mov eax, dword [eax]
push eax
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.004d7fd3
mov ecx, dword [edi]
test al, al
je 0x4d80f4
lea eax, [ecx + 0x1c]
jmp 0x4d8108
lea eax, [esi + ecx]
mov ecx, ebx
push eax
call fcn.004d79e7
test al, al
je 0x4d8113
mov eax, dword [edi]
add eax, 0x1c
add eax, esi
lea ecx, [ebx + 4]
push eax
call fcn.004524bf
mov ecx, dword [edi]
push 0x38
pop eax
add esi, eax
inc dword [ebp + 8]
mov eax, dword [edi + 4]
sub eax, ecx
cdq
idiv dword [ebp - 0x14]
cmp dword [ebp + 8], eax
jb 0x4d80cd
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [edi + 4]
xor esi, esi
mov ecx, dword [edi]
sub eax, ecx
push 0x38
cdq
pop ebx
idiv ebx
test eax, eax
je 0x4d8156
add ecx, 0x34
cmp byte [ecx], 0
jne 0x4d8188
inc esi
add ecx, ebx
cmp esi, eax
jb 0x4d814a
cmp byte [0x7ed364], 0
je 0x4d8177
lea ecx, [ebp + 0xb]
call fcn.004d66a5
mov esi, eax
mov ecx, esi
call fcn.004cc180
push esi
call fcn.004cbae5
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 4], eax
lea eax, [ebp - 0x38]
push 0x7e1014
push eax
call fcn.004bdad8
add esp, 0xc
cmp byte [0x7ed364], 0
mov byte [ebp - 4], 1
je 0x4d81de
cmp dword [ebp - 0x24], 8
lea edi, [ebp - 0x38]
lea ecx, [ebp + 0xb]
cmovae edi, dword [ebp - 0x38]
call fcn.004d6541
mov esi, eax
mov ecx, esi
call fcn.004d8bae
push edi
push esi
call fcn.004cbae5
pop ecx
pop ecx
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push 0xf013f
cmovae eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x20]
push eax
push reloc.WS2_32.dll_closesocket
call fcn.004c8ab0
mov ebx, dword [ebp - 0x20]
test eax, eax
jne 0x4d824b
cmp byte [0x7ed364], 0
je 0x4d8231
cmp dword [ebp - 0x24], 8
lea edi, [ebp - 0x38]
lea ecx, [ebp + 0xb]
cmovae edi, dword [ebp - 0x38]
call fcn.004d6761
mov esi, eax
mov ecx, esi
call fcn.004cc076
push edi
push esi
call fcn.004cbae5
pop ecx
pop ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push str.ProxyEnable
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x38]
call fcn.004b6a96
test ebx, ebx
je 0x4d8177
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d8177
Function at 0x4d8695
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x726662
call fcn.006db31c
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.004d6a52
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
mov dword [ebp - 0x28], 0xb4
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.004d7609
call esi
mov ebx, eax
sub ebx, edi
cmp byte [0x7ed364], 0
je 0x4d86fa
lea ecx, [ebp - 0xd]
call fcn.004d65df
mov esi, eax
mov ecx, esi
call fcn.004ba541
push ebx
push esi
call fcn.004cbae5
pop ecx
pop ecx
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x4d874c
push 0x18
mov edi, esi
pop ebx
jmp 0x4d8711
mov ecx, edi
call fcn.00451984
add edi, ebx
cmp edi, dword [ebp - 0x20]
jne 0x4d8708
mov eax, dword [ebp - 0x1c]
sub eax, esi
mov dword [ebp - 0x18], esi
cdq
idiv ebx
imul eax, eax, 0x18
mov dword [ebp - 0x14], eax
cmp eax, 0x1000
jb 0x4d8743
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00450606
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
pop ecx
pop ecx
push eax
push esi
call fcn.006db2db
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x569b40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.006db7b0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 5
je 0x569b7c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0056a510
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x569b7c
mov eax, dword [ebp - 4]
jmp 0x569bd3
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov eax, dword [ebp + 8]
push eax
call fcn.00539d60
add esp, 8
cmp dword [ebp - 4], 0
jg 0x569bd0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00578a10
add esp, 4
test eax, eax
je 0x569bd0
push 0xa
mov edx, dword [ebp + 8]
push edx
call fcn.0053a8a0
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5731d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006db7b0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0x18]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5732a8
mov eax, dword [ebp - 4]
movsx ecx, word [eax + 8]
cmp ecx, 2
jne 0x573288
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0xa]
cmp eax, 4
jne 0x573288
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x573245
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
je 0x573288
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
movzx edx, word [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00573090
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x57327b
mov eax, 8
jmp 0x5732ed
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add edx, 0x1c
mov dword [ebp - 8], edx
jmp 0x57323c
push 0x400
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
push 0x401
mov edx, dword [ebp + 0x18]
push edx
call fcn.006f5266
add esp, 0x10
xor eax, eax
jmp 0x5732ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x2af9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
ja case.default.0x5732c5
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x5732f4]
mov eax, 0x2af9
jmp 0x5732ed
mov eax, 0x2afa
jmp 0x5732ed
mov eax, 0x2afb
jmp 0x5732ed
mov eax, 0x2af9
jmp 0x5732ed
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18

Function at 0x578610
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006db7b0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov ecx, dword [ebp + 8]
push ecx
call fcn.00539d60
add esp, 8
cmp dword [ebp - 4], 0
jg 0x578678
mov edx, dword [ebp - 4]
push edx
call fcn.00578a10
add esp, 4
test eax, eax
je 0x578678
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.0053a8a0
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5ab7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006db7b0
mov dword [ebp - 0xc], 0
jmp 0x5ab7bf
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jge 0x5ab7df
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp eax, edx
jne 0x5ab7df
jmp 0x5ab7b6
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x5ab7f3
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jl 0x5ab819
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
test eax, eax
jne 0x5ab819
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx]
cmp edx, 0xff
jne 0x5ab819
jmp 0x5ab7ea
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x5ab829
or eax, 0xffffffff
jmp 0x5ab8f6
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jle 0x5ab83c
mov eax, dword [ebp - 0xc]
shl eax, 3
jmp 0x5ab8f6
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x7e
ja case.0x5ab873.1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x5ab91c]
jmp dword [eax*4 + 0x5ab8fc]
mov dword [ebp - 8], 7
jmp 0x5ab8be
mov dword [ebp - 8], 6
jmp 0x5ab8be
mov dword [ebp - 8], 5
jmp 0x5ab8be
mov dword [ebp - 8], 4
jmp 0x5ab8be
mov dword [ebp - 8], 3
jmp 0x5ab8be
mov dword [ebp - 8], 2
jmp 0x5ab8be
mov dword [ebp - 8], 1
jmp 0x5ab8be
or eax, 0xffffffff
jmp 0x5ab8f6
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 1]
and edx, eax
jne 0x5ab8e6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 1]
and edx, eax
movzx ecx, byte [ebp - 1]
cmp edx, ecx
je 0x5ab8ed
or eax, 0xffffffff
jmp 0x5ab8f6
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
lea eax, [eax + edx*8]
mov esp, ebp
pop ebp
ret

Function at 0x5b2530
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7ee068], 0
jne 0x5b25d3
mov dword [0x7ee068], 1
push 0x190
push 0
push 0x7ee070
call fcn.006dca70
add esp, 0xc
push 0x7ee070
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x5b25d3
call fcn.005798d0
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.00579920
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00579970
add esp, 0xc
call fcn.005798d0
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.00579920
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.00579970
add esp, 0xc
or eax, 0xffffffff
jmp 0x5b25d8
mov eax, 1
pop ebp
ret
Function at 0x5b25e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006db7b0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x5b263a
call fcn.005798d0
push str.BIO_socket_ioctl
push 0xd1
push str.crypto_bio_bio_sock.c
call fcn.00579920
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00579970
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5b26b0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124
call fcn.006db7b0
mov eax, dword [0x7eba44]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jl 0x5b26d3
cmp dword [ebp + 8], 0x40
jl 0x5b26db
or eax, 0xffffffff
jmp 0x5b281e
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
jne 0x5b26ed
mov eax, 1
jmp 0x5b281e
push 0
call fcn.004e3130
add esp, 4
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], edx
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x118]
jg 0x5b2722
jl 0x5b271b
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x11c]
jae 0x5b2722
xor eax, eax
jmp 0x5b281e
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
jmp 0x5b2747
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x108]
jae 0x5b276b
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp + edx*4 - 0x104]
cmp eax, dword [ebp + 8]
jne 0x5b2769
jmp 0x5b276b
jmp 0x5b2738
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x108]
jne 0x5b27a1
cmp dword [ebp - 0x108], 0x40
jae 0x5b27a1
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
jne 0x5b272c
mov dword [ebp - 0x120], 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x11c]
mov dword [ebp - 0x124], eax
cmp dword [ebp + 0xc], 0
je 0x5b27d0
mov dword [ebp - 0x110], 0
jmp 0x5b27dc
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x110], ecx
cmp dword [ebp + 0xc], 0
je 0x5b27f0
lea edx, [ebp - 0x108]
mov dword [ebp - 0x114], edx
jmp 0x5b27fa
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x124]
push eax
push 0
mov ecx, dword [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp + 8]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006dbabd
mov esp, ebp
pop ebp
ret