joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405150
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
xorps xmm0, xmm0
mov esi, edx
mov edi, ecx
mov ebp, esp
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
push 2
push 0x20
push ebp
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x40518c
mov ebx, eax
push 0x20
push ebp
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x4051d5
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [edi], xmm0
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm1
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 0x28], xmm0
mov dword [edi + 0x40], 0
mov ecx, 0xffffff00
mov edx, esi
mov eax, dword [edi + 0x34]
add ecx, dword [edi + 0x30]
adc eax, 0xffffffff
mov dword [edi + 0x38], ecx
mov ecx, edi
mov dword [edi + 0x3c], eax
call fcn.00408240
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 4
call fcn.00494530
test eax, eax
je 0x405205
and ebx, 0x7fffffff
mov dword [eax], ebx
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4051a9
ud2
Function at 0x41ba80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x80
jb 0x41bc54
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x4eb3d0]
add edx, 0x40
add eax, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movq xmm4, qword [0x4eb3c0]
nop word cs:[eax + eax]
nop dword [eax]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x41bad0
movq xmm4, qword [0x4eb3e0]
pmovzxdq xmm5, qword [0x4eb420]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x41bbe7
nop word cs:[eax + eax]
nop
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add eax, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x41bbc0
pmovzxdq xmm1, qword [0x4eb420]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x4eb3f0], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x4eb400], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x4eb410], 0
pxor xmm2, xmm0
pextrd ecx, xmm2, 1
not ecx
je 0x41bc5e
push eax
call fcn.0041b6e0
add esp, 4
ret
mov eax, ecx
ret

Function at 0x41da20
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x128
cmp dword [esp + 0x140], 0
call fcn.0041da37
Function at 0x440490
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
cmp dword [esp + 0x30], 0x10
mov esi, ecx
jne 0x440552
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 0xf8]
mov edi, dword [esp + 0x3c]
lea ebx, [esp + 0xc]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov ecx, dword [ecx + 4]
lea eax, [esp + 7]
movsd qword [esp + 0x14], xmm1
movsd qword [esp + 0xc], xmm0
push ebx
push edx
push eax
call ecx
add esp, 0xc
movzx eax, word [esp + 7]
movzx edx, byte [esp + 9]
movzx ecx, word [esp + 0xa]
cmp edi, 4
mov word [esp], ax
mov byte [esp + 2], dl
mov word [esp + 3], cx
jbe 0x4405ad
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x16
mov edi, 0x16
call fcn.00494530
test eax, eax
je 0x440607
mov word [eax + 0x14], 0x676e
mov dword [eax + 0x10], 0x6f6c206f
mov dword [eax + 0xc], 0x6f742072
mov dword [eax + 8], 0x65626d75
mov dword [eax + 4], 0x6e207465
mov dword [eax], 0x6b636170
mov byte [esi], 0xd
mov dword [esi + 4], 0x16
jmp 0x4405a5
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x18
mov edi, 0x18
call fcn.00494530
test eax, eax
je 0x440607
mov dword [eax + 0x14], 0x6874676e
mov dword [eax + 0x10], 0x656c2064
mov dword [eax + 0xc], 0x696c6176
mov dword [eax + 8], 0x6e692066
mov dword [eax + 4], 0x6f20656c
mov dword [eax], 0x706d6173
mov byte [esi], 0xd
mov dword [esi + 4], 0x18
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
jmp 0x440600
mov eax, dword [esp + 0x34]
movzx ecx, byte [esp]
movzx edx, byte [eax]
mov ch, dl
not ch
shr ch, 3
or ch, 0xf
and ch, cl
xor ch, dl
test edi, edi
mov byte [eax], ch
je 0x4405fd
movzx ebx, cl
xor ecx, ecx
cmp byte [esp + 0x40], 0
mov eax, dword [esp + 0x38]
cmove ebx, ecx
dec edi
xor bl, dl
and bl, 3
movzx edx, bl
cmp edi, edx
cmovae edi, edx
inc edi
nop dword [eax]
movzx edx, byte [esp + ecx + 1]
xor byte [eax + ecx], dl
inc ecx
cmp edi, ecx
jne 0x4405f0
mov byte [esi], 0x16
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
ud2

Function at 0x452600
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xe8
mov edi, ecx
mov esi, edx
call fcn.00452613
Function at 0x45ddc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5b0
mov eax, dword [ebp + 0x28]
mov edi, dword [ebp + 0x20]
mov esi, edx
call fcn.0045dddc
Function at 0x464600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov esi, dword [ebp + 0x14]
call fcn.00464617
Function at 0x483940
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x44]
mov esi, ecx
mov ecx, dword [esp + 0x48]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x483995
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x4839b6
test eax, eax
js 0x4839a1
mov eax, dword [esp + 8]
mov bl, 4
jmp 0x4839aa
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
ret
mov eax, esp
mov dword [esp + 0x1c], 0xf94cd8
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.00483d50
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00405000
mov ecx, 7
int 0x29
ud2
Function at 0x4864e0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x48652d
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x48653d
mov dword [esi + 4], 0
jmp 0x48654f
cmp eax, 0x103
je 0x48656b
test eax, eax
js 0x486558
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0xf94cd8
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.00483d50
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00405000
mov ecx, 7
int 0x29
ud2
Function at 0x48a880
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push edi
push esi
test dl, 1
mov eax, 0x17
mov edi, 2
mov esi, ecx
cmovne edi, eax
push 0x81
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x48a8b6
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
pop edi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x48a8ca
cmp eax, 0x2739
jne 0x48a8fa
push 1
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x48a903
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x48a915
mov dword [esi + 4], edi
mov byte [esi], 4
pop esi
pop edi
ret
mov byte [esi], 0
mov dword [esi + 4], eax
pop esi
pop edi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
pop esi
pop edi
ret

Function at 0x48aa90
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov edi, edx
cmp ecx, 0x3b9aca00
je 0x48aaf6
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x20]
mov ebp, 0x3e8
mul ebp
mov ebx, eax
mov eax, edi
seto byte [esp + 3]
mul ebp
mov ebp, edx
mov edi, eax
add ebp, ebx
mov ebx, 0xffffffff
setb al
or al, byte [esp + 3]
jne 0x48aaf2
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebp
adc eax, 0
jae 0x48ab38
mov edi, dword [esp + 4]
mov dword [esp + 8], ebx
lea eax, [esp + 8]
push 4
push eax
push 0x1006
push 0xffff
push edi
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x48ab2e
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebp, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [esp + 4]
mov eax, ebp
adc eax, 0
jb 0x48aaf6
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebp, 0
xor ebx, ebx
neg ebp
sbb ebx, ebx
or ebx, edx
jne 0x48aaf6
mov eax, dword [0xf94d10]
mov ecx, dword [0xf94d14]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x48ab30
Function at 0x48ab90
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov edi, edx
cmp ecx, 0x3b9aca00
je 0x48abf6
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x20]
mov ebp, 0x3e8
mul ebp
mov ebx, eax
mov eax, edi
seto byte [esp + 3]
mul ebp
mov ebp, edx
mov edi, eax
add ebp, ebx
mov ebx, 0xffffffff
setb al
or al, byte [esp + 3]
jne 0x48abf2
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebp
adc eax, 0
jae 0x48ac38
mov edi, dword [esp + 4]
mov dword [esp + 8], ebx
lea eax, [esp + 8]
push 4
push eax
push 0x1005
push 0xffff
push edi
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x48ac2e
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebp, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [esp + 4]
mov eax, ebp
adc eax, 0
jb 0x48abf6
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebp, 0
xor ebx, ebx
neg ebp
sbb ebx, ebx
or ebx, edx
jne 0x48abf6
mov eax, dword [0xf94d10]
mov ecx, dword [0xf94d14]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x48ac30
Function at 0x490740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.00485be0
add esp, 4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov edx, ecx
neg edx
jo 0x490794
mov dword [esp + 0x18], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
call fcn.00490820
mov edi, dword [esp]
mov eax, edi
neg eax
jno 0x4907e5
movzx eax, byte [esp + 4]
mov edi, dword [esp + 8]
cmp al, 3
jne 0x4907d7
mov ebp, dword [edi + 4]
mov ebx, dword [edi]
mov eax, dword [ebp]
test eax, eax
je 0x4907aa
push ebx
call eax
add esp, 4
cmp dword [ebp + 4], 0
je 0x4907c8
cmp dword [ebp + 8], 9
jb 0x4907b9
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x490803
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x4907dd
test edi, edi
mov dword [esi], 0x80000000
je 0x4907dd
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4907dd
Function at 0x492730
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
movzx eax, byte [0xfd520d]
mov ebx, edx
mov esi, ecx
xor ecx, ecx
mov edx, 8
call fcn.00494530
test eax, eax
je 0x4927d4
mov edi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [edi + 4], eax
push 0
push 0x10000
push edi
push 0x492930
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x492784
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4927cf
mov ebp, dword [edi + 4]
mov ebx, dword [edi]
mov eax, dword [ebp]
test eax, eax
je 0x492796
push ebx
call eax
add esp, 4
cmp dword [ebp + 4], 0
je 0x4927b4
cmp dword [ebp + 8], 9
jb 0x4927a5
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4941c0
Capabilities:
Read file on windows

Disassembly:
cmp dword [edx], 0
jne 0x494298
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [edx + 0xc]
mov edi, edx
mov esi, ecx
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x494270
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [esp + 4], 0
lea ebx, [esp + 4]
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49421d
mov eax, dword [esp + 4]
mov ecx, 2
test eax, eax
jne 0x494253
mov word [esi], 4
jmp 0x49425d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x49423c
cmp eax, 0x6d
jne 0x494265
lea eax, [esp + 8]
mov dword [esp], 1
jmp 0x49423e
mov eax, esp
mov dword [eax], 0
mov ecx, 1
mov eax, dword [esp + 8]
test byte [esp], 1
jne 0x49420d
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x49425d
mov eax, 0x10
test edx, edx
mov ebp, 1
mov ecx, ebx
cmove ebp, eax
push 1
push 1
push ebp
call fcn.004ea1e0
add esp, 0xc
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x4941e4
ud2

Function at 0x494550
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
movzx eax, byte [edx]
mov esi, ecx
cmp al, 4
jne 0x4945ae
mov ebp, dword [edx + 4]
mov eax, dword [0xfd51e8]
cmp eax, 3
jne 0x494656
mov edx, dword [ebp]
lea ecx, [esp + 8]
call fcn.0048a880
movzx eax, byte [esp + 8]
cmp al, 4
jne 0x4945c2
mov ebx, dword [esp + 0xc]
test byte [ebp], 1
je 0x4945e4
mov ecx, dword [ebp + 0x18]
movups xmm0, xmmword [ebp + 4]
lea eax, [ebp + 0x14]
mov edi, 0x1c
mov edx, 0x1c
mov dword [esp + 4], ecx
mov cx, 0x17
jmp 0x4945fe
movzx ecx, byte [edx + 3]
mov byte [esi + 3], cl
movzx ecx, word [edx + 1]
mov word [esi + 1], cx
mov ecx, dword [edx + 4]
jmp 0x4945d7
movzx ecx, byte [esp + 0xb]
mov byte [esi + 3], cl
movzx ecx, word [esp + 9]
mov word [esi + 1], cx
mov ecx, dword [esp + 0xc]
mov byte [esi], al
mov dword [esi + 4], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], ebx
lea eax, [ebp + 2]
xorps xmm0, xmm0
mov edx, 0x10
mov cx, 2
mov edi, 6
mov ebx, dword [esp]
movzx edi, word [ebp + edi]
mov eax, dword [eax]
mov word [esp + 8], cx
rol di, 8
mov word [esp + 0xa], di
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x49463e
mov dword [esi + 4], ebx
mov byte [esi], 4
jmp 0x4945dc
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push ebx
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4945dc
call fcn.004e99b0
jmp 0x494571
Function at 0x4a48f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ecx]
mov dword [esp + 4], ecx
mov ebp, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
test ebp, ebp
mov dword [esp], eax
je 0x4a493a
mov eax, dword [esp]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
lea esi, [eax + 4]
jmp 0x4a4926
add esi, 0xc
dec ebp
je 0x4a493a
cmp dword [esi - 4], 0
je 0x4a4920
push dword [esi]
push 0
push dword [0xfd5200]
call ebx
jmp 0x4a4920
cmp dword [edi + 0x10], 0
je 0x4a4951
push dword [esp]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 0x78]
lock dec dword [eax]
je 0x4a4a14
mov eax, dword [edi + 0x84]
lock dec dword [eax]
je 0x4a4a2e
mov eax, dword [edi + 0x8c]
lock dec dword [eax]
je 0x4a4a4e
mov eax, dword [edi + 0x94]
lock dec dword [eax]
je 0x4a4a6e
mov eax, dword [edi + 0x9c]
lock dec dword [eax]
je 0x4a4a8e
mov eax, dword [edi + 0xa0]
lock dec dword [eax]
je 0x4a4aa8
cmp dword [edi + 0x1c], 0
je 0x4a49bf
push dword [edi + 0x20]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [edi + 0x28], 0
je 0x4a49d6
push dword [edi + 0x2c]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 0xa8]
lock dec dword [eax]
jne 0x4a49ec
lea ecx, [edi + 0xa8]
call fcn.004a4b10
mov eax, dword [edi + 0x34]
cmp eax, 0x80000001
je 0x4a4ac8
cmp eax, 0x80000002
je 0x4a4adf
add edi, 0x34
mov ecx, edi
call fcn.004a1840
jmp 0x4a4adf
mov ecx, dword [edi + 0x78]
mov edx, dword [edi + 0x7c]
call fcn.00441050
mov eax, dword [edi + 0x84]
lock dec dword [eax]
jne 0x4a496c
mov ecx, dword [edi + 0x84]
mov edx, dword [edi + 0x88]
call fcn.00441050
mov eax, dword [edi + 0x8c]
lock dec dword [eax]
jne 0x4a497b
mov ecx, dword [edi + 0x8c]
mov edx, dword [edi + 0x90]
call fcn.00441050
mov eax, dword [edi + 0x94]
lock dec dword [eax]
jne 0x4a498a
mov ecx, dword [edi + 0x94]
mov edx, dword [edi + 0x98]
call fcn.00441050
mov eax, dword [edi + 0x9c]
lock dec dword [eax]
jne 0x4a4999
mov ecx, dword [edi + 0x9c]
call fcn.00498230
mov eax, dword [edi + 0xa0]
lock dec dword [eax]
jne 0x4a49a8
mov ecx, dword [edi + 0xa0]
mov edx, dword [edi + 0xa4]
call fcn.00441050
cmp dword [edi + 0x1c], 0
jne 0x4a49ae
jmp 0x4a49bf
cmp dword [edi + 0x38], 0
je 0x4a4adf
push dword [edi + 0x3c]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 4]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4a4aff
lock dec dword [eax + 4]
jne 0x4a4aff
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b44d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov esi, dword [ebp + 0xc]
call fcn.004b44e7
Function at 0x4be3f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4be440
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov esi, dword [sym.imp.ws2_32.dll_send]
mov ebp, dword [eax]
nop
cmp edi, 0x7fffffff
mov eax, 0x7fffffff
cmovb eax, edi
push 0
push eax
push ebx
push ebp
call esi
cmp eax, 0xffffffff
je 0x4be449
test eax, eax
mov byte [esp], 4
mov dword [esp + 4], eax
je 0x4be467
cmp edi, eax
jb 0x4be480
add ebx, eax
sub edi, eax
jne 0x4be410
mov eax, dword [esp + 0x1c]
mov byte [eax], 4
jmp 0x4be478
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esp + 3], 0
mov word [esp + 1], 0
mov byte [esp], 0
mov dword [esp + 4], eax
mov eax, esp
jmp 0x4be46c
mov eax, 0xfb8678
movsd xmm0, qword [eax]
mov eax, dword [esp + 0x1c]
movsd qword [eax], xmm0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4beb90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, dword [esp + 0x38]
xorps xmm0, xmm0
mov esi, ecx
lea edi, [esp + 4]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 4], xmm0
push 0
push 0x20
push edi
push dword [edx]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4bebf2
mov ebx, eax
cmp eax, 0x20
mov dword [esp], esi
ja 0x4bec3a
mov eax, dword [ebp]
mov esi, ebp
mov ebp, dword [ebp + 8]
sub eax, ebp
cmp eax, ebx
jae 0x4bec09
mov ecx, esi
mov edx, ebp
push 1
push 1
push ebx
call fcn.004ea1e0
add esp, 0xc
mov eax, dword [esp + 0x38]
mov ebp, dword [eax + 8]
jmp 0x4bec09
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x4bec2f
mov dword [esp], esi
mov esi, ebp
mov ebp, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [esi + 4]
add eax, ebp
push ebx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
add ebp, ebx
mov dword [esi + 8], ebp
mov dword [eax + 4], ebx
mov byte [eax], 4
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4bec27
ud2
Function at 0x4c1c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov edi, dword [esp + 0xa8]
call fcn.004c1c86

Function at 0x4c2aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, 2
test edx, edx
je 0x4c2ada
cmp edx, 1
jne 0x4c2adf
xor esi, esi
nop word cs:[eax + eax]
cmp edx, esi
je 0x4c2b60
movzx ebx, byte [ecx + esi]
inc esi
add bl, 0xd0
cmp bl, 0xa
jb 0x4c2ac0
jmp 0x4c2b70
jmp 0x4c2ba1
cmp word [ecx], 0x7830
je 0x4c2b23
cmp word [ecx], 0x5830
je 0x4c2b23
cmp byte [ecx], 0x30
jne 0x4c2ab4
cmp byte [ecx + 1], 0xbf
jle 0x4c2ba8
inc ecx
dec edx
mov esi, edx
mov edi, ecx
nop word cs:[eax + eax]
nop dword [eax]
test esi, esi
je 0x4c2b7f
movzx ebx, byte [edi]
inc edi
dec esi
and bl, 0xf8
cmp bl, 0x30
je 0x4c2b10
jmp 0x4c2b70
cmp edx, 3
jb 0x4c2b6b
cmp byte [ecx + 2], 0xbf
jle 0x4c2ba8
add ecx, 2
add edx, 0xfffffffe
mov esi, edx
mov edi, ecx
nop dword [eax + eax]
test esi, esi
je 0x4c2b74
movzx ebx, byte [edi]
inc edi
dec esi
mov bh, bl
add bh, 0xd0
cmp bh, 0xa
jb 0x4c2b40
and bl, 0xdf
add bl, 0xbf
cmp bl, 6
jb 0x4c2b40
jmp 0x4c2b70
mov eax, ecx
mov esi, edx
mov edi, 0xa
jmp 0x4c2b88
mov eax, 1
xor edx, edx
jmp 0x4c2ba1
mov eax, ecx
mov esi, edx
mov edi, 0x10
jmp 0x4c2b88
mov eax, ecx
mov esi, edx
mov edi, 8
mov edx, eax
mov ecx, esp
push edi
push esi
call fcn.0041af60
add esp, 8
movzx eax, byte [esp]
mov edx, dword [esp + 4]
xor eax, 1
add esp, 8
pop esi
pop edi
pop ebx
ret
ud2