joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a8e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x601860
call fcn.004291c0
mov eax, dword [ebp + 8]
push 0x601860
lea edi, [eax*4]
mov eax, dword [0x60188c]
mov esi, dword [edi + eax]
call fcn.004291d0
add esp, 8
cmp dword [esi + 0x3c], 0
je 0x43a97b
cmp dword [esi + 0xc], 2
jne 0x43a97b
cmp word [esi + 0x5c], 0
je 0x43a97b
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x10
jae 0x43a94d
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43a940
call fcn.005414b2
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], 0x10
mov eax, 2
pop edi
movups xmmword [ecx], xmm0
mov word [ecx], ax
mov eax, dword [esi + 0x80]
mov dword [ecx + 4], eax
mov ax, word [esi + 0x78]
mov word [ecx + 2], ax
xor eax, eax
pop esi
pop ebp
ret
push 0x601860
call fcn.004291c0
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [edi + eax]
call fcn.004291d0
add esp, 8
cmp dword [esi + 0x3c], 0
jne 0x43a9bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.0053b370
add esp, 4
pop edi
pop esi
pop ebp
ret
or eax, 0xffffffff
push eax
call fcn.0053b370
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x43aa10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.004291c0
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.004291d0
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x43aaee
test al, 1
je 0x43aa7c
cmp dword [esi + 0x3c], 0
je 0x43aa58
cmp dword [esi + 0xc], 2
jne 0x43aa58
cmp word [esi + 0x5c], 0
jne 0x43aa7c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recvfrom]
push eax
call fcn.0053b370
add esp, 4
pop esi
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
jne 0x43aab6
cmp dword [esi + 0x3c], 0
je 0x43aa96
cmp dword [esi + 0xc], 2
jne 0x43aa96
cmp word [esi + 0x5c], 0
jne 0x43aab6
push eax
push str.invalid_type:__d
push 0x76d
push str.vsock_recvfrom
push 0x360202
call fcn.00424570
add esp, 0x14
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 0
jne 0x43aad3
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a1b0
add esp, 0x14
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a3b0
add esp, 0x18
pop esi
pop ebp
ret
push str.recvfrom_from_non_packet_socket
push 0x360000
call fcn.00424760
int3
Function at 0x43ab10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.004291c0
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.004291d0
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
jne 0x43ab5d
push eax
push str.invalid_type:__d
push 0x72e
push str.vsock_send
push 0x360202
call fcn.00424570
mov eax, dword [esi + 0x58]
add esp, 0x14
mov ecx, dword [esi + 0x3c]
test eax, reloc.WS2_32.dll_connect
jne 0x43abba
test ecx, ecx
je 0x43ab78
cmp dword [esi + 0xc], 2
jne 0x43ab78
cmp word [esi + 0x5c], 0
jne 0x43abba
test al, 1
je 0x43ab9a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_send]
push eax
call fcn.0053b370
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x733
push str.vsock_send
push 0x360202
call fcn.00424570
add esp, 0x14
pop esi
pop ebp
ret
test ecx, ecx
je 0x43ac01
cmp dword [esi + 0xc], 2
jne 0x43ac01
cmp word [esi + 0x5c], 0
je 0x43ac01
test eax, 0x1000000
je 0x43ac16
cmp dword [esi + 0x14], 0x11
lea eax, [esi + 0x94]
push 0x10
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
jne 0x43abf6
call fcn.0043a780
add esp, 0x18
pop esi
pop ebp
ret
call fcn.0043a6d0
add esp, 0x18
pop esi
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a470
add esp, 0x10
pop esi
pop ebp
ret
push str.cannot_use_send_when_socket_not_connected
push 0x360000
call fcn.00424760
int3
Function at 0x43ac30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x601860
call fcn.004291c0
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.004291d0
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x43ad3c
test eax, reloc.WS2_32.dll_connect
jne 0x43acc3
cmp dword [esi + 0x3c], 0
je 0x43ac7b
cmp dword [esi + 0xc], 2
jne 0x43ac7b
cmp word [esi + 0x5c], 0
jne 0x43acc3
test al, 1
je 0x43aca3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_sendto]
push eax
call fcn.0053b370
add esp, 4
pop esi
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x783
push str.vsock_sendto
push 0x360202
call fcn.00424570
add esp, 0x14
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x43ace2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call fcn.0043ab10
add esp, 0x10
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0xc], 2
jne 0x43ad4b
cmp dword [esi + 0x14], 0x11
jne 0x43ad1c
push esi
call fcn.0043b100
add esp, 4
test eax, eax
je 0x43ad02
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a780
add esp, 0x18
pop edi
pop esi
pop ebp
ret
cmp dword [esi + 0x10], 3
jne 0x43ad4b
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a6d0
add esp, 0x18
pop edi
pop esi
pop ebp
ret
push str.sendto_to_non_packet_socket
push 0x360000
call fcn.00424760
push str.invalid_socket_address
push 0x360000
call fcn.00424760
int3
Function at 0x43ad60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x601860
call fcn.004291c0
mov ecx, dword [ebp + 8]
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + ecx*4]
call fcn.004291d0
mov ebx, dword [ebp + 0xc]
add esp, 8
mov edi, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
cmp ebx, 0xffff
jne 0x43adc5
cmp edx, 0x20
jne 0x43ade4
cmp edi, 4
jne 0x43ae71
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x58]
mov ecx, dword [ecx]
neg ecx
sbb ecx, ecx
and eax, 0xffdfffff
and ecx, 0x200000
or ecx, eax
mov dword [esi + 0x58], ecx
jmp 0x43ae0f
test ebx, ebx
jne 0x43ade4
cmp edx, 0xc
jne 0x43ade4
cmp edi, 8
jne 0x43ae80
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [esi + 0x8c], eax
jmp 0x43ae12
cmp edx, 0x19
jne 0x43ae0f
mov ecx, dword [esi + 0x58]
mov eax, ecx
and eax, reloc.WS2_32.dll_listen
cmp eax, 1
jne 0x43ae0f
test cl, 0x40
je 0x43ae0f
cmp dword [esi + 0xc], 2
jne 0x43ae0f
cmp dword [esi + 0x14], 0x11
je 0x43ae47
cmp dword [esi + 0x10], 3
je 0x43ae47
mov ecx, dword [ebp + 0x14]
cmp dword [esi + 0x3c], 0
je 0x43ae56
cmp dword [esi + 0xc], 2
jne 0x43ae56
cmp word [esi + 0x5c], 0
je 0x43ae56
cmp edx, 4
je 0x43ae4f
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43ae41
call fcn.005414b2
mov dword [eax], 0x16
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
push ecx
push edx
push ebx
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.0053b370
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push str.incorrect_SO_BROADCAST_parameters
push 0x360000
call fcn.00424760
push str.incorrect_IP_ADD_MEMBERSHIP_parameters
push 0x360000
call fcn.00424760
int3

Function at 0x443900
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420ea0
add esp, 8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push eax
call fcn.0053b3a0
xor ecx, ecx
add esp, 4
cmp eax, 0xffffffff
cmove eax, ecx
pop ebp
ret
Function at 0x443b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4c
push 0
push esi
call fcn.0053f280
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
push esi
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.00443e30
push esi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
call fcn.00443ce0
add esp, 0x1c
test eax, eax
jne 0x443bfb
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443bfb
test edi, edi
je 0x443bfb
push dword [ebp + 0x10]
push dword [esi + 8]
push dword [esi + 0x18]
push edi
push esi
call fcn.00443f80
movq xmm0, qword [edi]
lea edx, [ebp + 0x10]
mov ecx, dword [ebp + 8]
add esp, 0x14
movq qword [esi + 0x24], xmm0
movzx eax, word [edi + 8]
mov word [esi + 0x2c], ax
mov eax, dword [esi + 4]
push edx
push ecx
push 0x32
movq xmm0, qword [eax]
movq qword [esi + 0x42], xmm0
movzx eax, word [eax + 8]
push edi
mov word [esi + 0x4a], ax
mov dword [ebp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x443c17
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x443c20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x443cd5
push edi
mov edi, dword [esi + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 0x32
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443cb2
test edi, edi
je 0x443cb2
push dword [esi + 0x18]
push dword [esi + 0x10]
push edi
call fcn.0053f3e0
lea eax, [ebp - 4]
push eax
push 0xf
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x20]
push 0x32
push dword [esi + 0xc]
push 0
push dword [esi + 8]
call fcn.00407290
add esp, 0x2c
cmp eax, 3
je 0x443c9e
lea eax, [ebp - 0xc34]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
push dword [esi + 8]
call fcn.00443eb0
add esp, 0x14
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push eax
push 0x32
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0xc], 0
pop edi
je 0x443cd5
mov eax, dword [esi + 0x10]
test eax, eax
je 0x443cd5
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x443ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push edi
push eax
push 0xf
lea eax, [ebp - 0xc34]
xor edi, edi
push eax
push dword [ebx + 0x20]
push 0x32
push dword [ebx + 0xc]
push edi
push dword [ebx + 8]
call fcn.00407290
add esp, 0x20
cmp eax, 3
je 0x443e27
push 0x40
push 0x1000
push 0x1e
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 8], eax
test eax, eax
je 0x443e27
cmp dword [ebx + 0x14], edi
jne 0x443d3d
mov dword [ebx + 0x14], eax
mov ecx, dword [ebx + 8]
mov eax, ecx
push esi
mov esi, dword [ebx + 4]
sub eax, esi
mov edx, esi
sub edx, ecx
cmp ecx, esi
mov esi, dword [ebp - 4]
cmovbe eax, edx
cmp eax, 0x80000000
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffb
add edx, 0xa
test esi, esi
je 0x443d80
lea eax, [ebp - 0xb74]
nop dword [eax]
cmp edi, edx
jge 0x443d80
add edi, dword [eax]
inc ecx
add eax, 0xd0
cmp ecx, esi
jb 0x443d70
push edi
push dword [ebx + 0xc]
push dword [ebp + 8]
call fcn.0053f3e0
mov esi, dword [ebx + 8]
mov ecx, esi
mov edx, dword [ebx + 0x14]
sub ecx, edx
lea eax, [esi + edi]
push eax
lea eax, [edx + edi]
push eax
mov eax, edx
sub eax, esi
cmp edx, esi
mov esi, dword [ebp + 8]
cmovbe eax, ecx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
push eax
lea eax, [esi + edi]
push eax
push ebx
call fcn.00443f80
lea eax, [ebp - 0xc34]
push eax
push dword [ebx + 8]
push edi
push esi
push esi
call fcn.00443eb0
add esp, 0x34
test eax, eax
jne 0x443e0f
mov ecx, dword [ebx + 0x14]
mov eax, ecx
mov dword [ebx + 0x10], esi
mov esi, dword [ebx + 8]
mov edx, esi
sub eax, esi
mov dword [ebx + 0x18], edi
sub edx, ecx
cmp ecx, esi
pop esi
cmovbe eax, edx
cmp eax, 0x80000000
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
add eax, edi
mov dword [ebx + 0x1c], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4445d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x444719
cmp dword [eax], 0
je 0x444719
cmp dword [eax + 4], 0x40
jb 0x444719
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4445ff
mov dword [ecx], 0
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x44460c
mov dword [ecx], 0
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x444619
mov dword [ecx], 0
mov edx, dword [eax]
push esi
mov esi, dword [eax + 4]
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x444711
mov eax, dword [edx + 0x3c]
lea ecx, [eax + 0x14]
cmp ecx, esi
ja 0x444711
add eax, edx
add ecx, 0x18
mov dword [ebp + 8], eax
cmp ecx, esi
ja 0x444711
cmp dword [eax], 0x4550
jne 0x444711
push edi
lea edx, [eax + 4]
mov edi, 0xe0
mov dword [ebp - 4], edx
cmp word [edx + 0x10], di
jne 0x44466f
add ecx, edi
cmp ecx, esi
jbe 0x444678
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
lea edi, [eax + 0x18]
movzx eax, word [edi]
push ebx
mov ebx, 0x10b
cmp ax, bx
je 0x444693
mov ebx, 0x20b
cmp ax, bx
jne 0x444707
movzx ebx, word [edx + 2]
lea eax, [ebx + ebx*4]
lea eax, [ecx + eax*8]
cmp eax, esi
ja 0x444707
cmp dword [edi + 0x3c], esi
ja 0x444707
xor edx, edx
test ebx, ebx
je 0x4446ce
lea ecx, [edi + 0xf0]
mov eax, dword [ecx + 4]
add eax, dword [ecx]
cmp eax, esi
ja 0x444707
mov eax, dword [ecx - 8]
add eax, dword [ecx - 4]
cmp eax, dword [edi + 0x38]
ja 0x444707
inc edx
add ecx, 0x28
cmp edx, ebx
jb 0x4446b2
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4446da
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4446e6
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4446ef
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4446fe
lea ecx, [edi + 0xe0]
mov dword [eax], ecx
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x444720
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 0x1000
push 1
push esi
call fcn.005414c5
mov ebx, dword [ebp + 0xc]
mov edi, eax
add esp, 8
mov eax, dword [ebx]
test eax, eax
je 0x444751
push eax
call fcn.005414d0
add esp, 4
mov dword [ebx], 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
mov eax, dword [ebp - 4]
je 0x44476d
cmp eax, esi
jbe 0x44477e
lea esi, [eax + esi*2]
push esi
push edi
call fcn.00547937
add esp, 8
mov edi, eax
jmp 0x444751
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x444787
mov dword [ecx], eax
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448490
Capabilities:
List tcp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5feb00]
push esi
mov esi, dword [ebp + 8]
push eax
mov dword [ebp - 4], eax
push dword [esi]
call fcn.00547937
add esp, 8
mov dword [esi], eax
lea ecx, [ebp - 4]
push 0
push 5
push 2
push 0
push ecx
push eax
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
test eax, eax
je 0x44851b
cmp eax, 0x7a
jne 0x44851b
push edi
push dword [ebp - 4]
push dword [esi]
call fcn.00547937
mov edx, dword [0x5feb00]
lea ecx, [ebp - 4]
add esp, 8
mov dword [esi], eax
cmp edx, dword [ebp - 4]
cmovb edx, dword [ebp - 4]
push 0
push 5
push 2
push 0
push ecx
push eax
mov dword [0x5feb00], edx
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov edi, eax
test edi, edi
je 0x448518
mov ecx, dword [esi]
test ecx, ecx
je 0x448518
push ecx
call fcn.005414d0
add esp, 4
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44c390
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x60
push 0
push esi
call fcn.0053f280
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
pop ebp
ret

Function at 0x44c4f0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x70
push 0
push esi
call fcn.0053f280
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov eax, 1
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
pop esi
pop ebp
ret

Function at 0x44c840
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x70
push 0
push esi
call fcn.0053f280
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
pop ebp
ret

Function at 0x44d4a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push 0
push esi
call fcn.0053f280
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret
Function at 0x458f80
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
xor edi, edi
call fcn.0044d1e0
mov ebx, eax
push ebx
push esi
call fcn.0044d0c0
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
je 0x459004
push 0xf0000040
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x458fdd
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0044d130
push esi
call fcn.0044d260
mov edi, eax
add esp, 0x10
test edi, edi
je 0x459004
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push esi
call fcn.0044d1e0
mov ebx, eax
push ebx
push esi
call fcn.0044d0c0
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
je 0x459073
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x459059
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0044d130
push esi
call fcn.0044d260
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x458ffb
push esi
call fcn.0044d260
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x459460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor dl, dl
test esi, esi
je 0x459487
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x459476
pop edi
movzx eax, dl
pop esi
pop ebp
ret
Function at 0x4595c0
Capabilities:
Access the windows event log
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x45963a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x45963a
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00418b10
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00546341
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [ebp - 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0xff
push eax
call fcn.00418b10
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00546341
add esp, 0x1c
mov byte [ebp - 5], 0
call fcn.004594d0
test eax, eax
jle 0x4596c0
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4596d6
push 0
lea eax, [ebp - 0x104]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x4596b4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x462380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
test esi, esi
je 0x4623d0
mov al, byte [esi]
test al, al
je 0x4623d0
push edi
mov edi, 0x100
nop dword [eax]
movsx eax, al
lea esi, [esi + 1]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x4623a0
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x462470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x4624ca
mov al, byte [edi]
test al, al
je 0x4624ca
push ebx
mov ebx, 0x100
nop word [eax + eax]
movsx eax, al
push eax
call fcn.004a07b0
or eax, ebx
lea edi, [edi + 1]
mov ecx, eax
add esp, 4
shr ecx, 2
add ebx, 0x100
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol esi, cl
xor esi, eax
mov al, byte [edi]
test al, al
jne 0x462490
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret