joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x78], eax
lea ebx, [esp + 0x10]
push 0x11
push str.au_global_storage
push ebx
call fcn.0053fe20
lea edi, [esi + 8]
mov ecx, edi
push ebx
call fcn.005e1a10
mov ecx, ebx
call fcn.005e1990
push edi
call fcn.0054d520
add esp, 4
test al, al
je 0x4ed0cb
cmp byte [esi + 0x14], 0
jne 0x4ed0cb
cmp byte [esi + 0x15], 0
je 0x4ed0e0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0064d372
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov byte [esi + 0x16], 1
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x10]
movdqu xmmword [ebx + 0x3c], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
mov ecx, ebx
mov edx, edi
call fcn.004ec960
lea eax, [esp + 0x74]
mov dword [eax], 0xffffffff
mov edi, dword [ebx + 0x48]
lea ebx, [esp + 0x68]
mov ecx, ebx
push 0x74d511
call fcn.0067fde0
mov ecx, edi
mov edi, ebx
lea eax, [esp + 0x74]
push eax
push ebx
call fcn.00556930
mov ebx, eax
cmp byte [edi + 0xb], 0
jns 0x4ed14d
push dword [esp + 0x68]
call fcn.0064cd6e
add esp, 4
test bl, bl
je 0x4ed22b
mov dword [esp + 0x68], 0xffffffff
mov ecx, dword [esp + 0x74]
push edi
call fcn.006a69e0
test al, al
je 0x4ed22b
push 8
call fcn.0064cd3e
add esp, 4
mov edi, eax
mov ecx, eax
push dword [esp + 0x68]
call fcn.0054c200
lea eax, [edi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov ecx, dword [edi]
lea ebx, [esp + 0x74]
push ebx
call fcn.0054bf30
mov ecx, ebx
lea edi, [esp + 0x68]
push edi
call fcn.0054a560
push edi
push dword [esp + 0xc]
call fcn.0054a4d0
add esp, 8
mov ebx, eax
mov ecx, edi
call fcn.005d1080
mov eax, dword [esp + 0x74]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x7b1224]
bt edx, ecx
jae 0x4ed1e2
push eax
call fcn.005e5140
add esp, 4
test bl, bl
jne 0x4ed264
mov ecx, dword [esp + 8]
lea edi, [esp + 0x68]
push edi
call fcn.0054a4b0
mov ecx, dword [esp + 0x6c]
call fcn.0054aab0
test eax, eax
je 0x4ed219
mov ebx, eax
mov ecx, dword [esp + 8]
push edi
call fcn.0054a4b0
mov ecx, esi
push ebx
push dword [esp + 0x6c]
call fcn.004ec440
mov ecx, dword [esp + 8]
call fcn.005efd60
mov edi, dword [esp + 0xc]
jmp 0x4ed191
mov byte [esi + 0x16], 0
mov esi, dword [esp + 0x58]
test esi, esi
je 0x4ed256
dec dword [esi + 4]
jne 0x4ed256
add esi, 4
mov eax, dword [esi - 4]
add esi, 0xfffffffc
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
lea ecx, [esp + 0x10]
call fcn.00548720
jmp 0x4ed0cb
mov byte [esi + 0x16], 0
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4ed22f
mov ecx, esi
call fcn.00542560
push esi
call fcn.0064cd6e
add esp, 4
jmp 0x4ed22f
Function at 0x4f4f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x48], eax
mov esi, dword [edi + 0x8d0]
xor eax, eax
dec eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x44], eax
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x20]
movdqa xmmword [eax], xmm0
push eax
call fcn.0051daf0
add esp, 4
cmp dword [edi + 0x78], 0
je 0x4f4f7b
push 2
push 5
push edi
call fcn.00519930
add esp, 0xc
lea ebx, [esp + 0x3c]
push ebx
push esi
call fcn.004ff370
add esp, 8
push ebx
call fcn.004ff390
add esp, 4
test eax, eax
je 0x4f505e
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
xor ecx, ecx
dec ecx
mov dword [esp + 0x14], ecx
mov esi, dword [eax + 0xc]
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x4f501f
mov edi, dword [ebx]
cmp dword [edi + 0x300], 0
jne 0x4f501a
cmp byte [edi + 0x25d], 0
jne 0x4f501a
cmp byte [edi + 0x271], 0
jne 0x4f501a
sub esp, 0x20
movups xmm0, xmmword [edi + 0x138]
movups xmmword [esp + 0x10], xmm0
movdqa xmm0, xmmword [esp + 0x40]
movdqu xmmword [esp], xmm0
call fcn.0051dbd0
add esp, 0x20
cmp dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
sbb ecx, edx
jge 0x4f501a
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov ebx, dword [ebx + 8]
jmp 0x4f4fbb
lea eax, [esp + 0x3c]
push eax
call fcn.004ff390
add esp, 4
test eax, eax
jne 0x4f4fb5
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4f5062
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 8]
test eax, eax
mov edi, dword [ebp + 8]
mov ebx, dword [esp + 0x1c]
je 0x4f508b
mov ecx, dword [esp + 0xc]
add ecx, 8
cmp dword [eax], esi
je 0x4f5069
mov eax, dword [eax + 8]
test eax, eax
jne 0x4f5051
jmp 0x4f508b
xor esi, esi
jmp 0x4f508e
xor esi, esi
mov edi, dword [ebp + 8]
jmp 0x4f508e
xor esi, esi
push esi
push eax
push ecx
call fcn.00509fb0
add esp, 0xc
mov eax, dword [esp + 0xc]
dec dword [eax + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 0x4e4], esi
mov esi, dword [esp + 0x10]
dec dword [ebx + 0x18]
cmp dword [edi + 0x78], 0
je 0x4f509f
push 5
push edi
call fcn.00519980
add esp, 8
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f56b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov esi, dword [ebp + 0xc]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x198], eax
lea ebx, [esp + 0x98]
push 0x100
push 0xff
push ebx
call fcn.00650600
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [eax], 0x80
xorps xmm0, xmm0
lea edi, [esp + 0x10]
movaps xmmword [edi], xmm0
movaps xmmword [edi + 0x10], xmm0
movaps xmmword [edi + 0x20], xmm0
movaps xmmword [edi + 0x30], xmm0
movaps xmmword [edi + 0x40], xmm0
movaps xmmword [edi + 0x50], xmm0
movaps xmmword [edi + 0x60], xmm0
movaps xmmword [edi + 0x70], xmm0
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4f5747
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push 0x100
push ebx
push eax
call fcn.0051cc80
add esp, 0xc
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x4f5782
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esp + 0x14]
push edi
call fcn.004f5510
add esp, 0x10
test al, al
jne 0x4f578d
call fcn.0065f7ad
push 0x100
push ebx
push dword [eax]
call fcn.0051cc80
add esp, 0xc
mov esi, eax
call fcn.0065f7ad
push esi
push dword [eax]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push dword [ebp + 8]
call fcn.00515170
add esp, 0x10
mov ecx, dword [esp + 0x198]
xor ecx, ebp
call fcn.0064d372
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4f6690
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x4020
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 4
mov eax, dword [0x7ba8b0]
cmp eax, 2
je 0x4f673c
test eax, eax
jne 0x4f66fc
sub esp, 0x14
movaps xmm0, xmmword [0x74dcb0]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 3
call fcn.00529cf0
add esp, 0x14
test al, al
je 0x4f66f2
mov dword [0x7ba8b0], 2
jmp 0x4f673c
mov dword [0x7ba8b0], 1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4f6725
cmp dword [ebp - 0x10], 0x4020
jg 0x4f673c
lea eax, [ebp - 0xc]
push 4
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0064d372
add esp, 0x10
pop esi
pop ebp
ret
Function at 0x4f94a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor edi, edi
test ecx, ecx
je 0x4f9528
mov esi, ecx
push ecx
call fcn.004fff20
add esp, 4
test al, al
jne 0x4f9528
push esi
call fcn.0066b230
add esp, 4
mov edi, eax
push eax
push 0x2e
push esi
call fcn.004fb010
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x4f94f1
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004fb010
add esp, 0xc
test eax, eax
je 0x4f94f1
inc eax
add edi, esi
sub edi, eax
mov ebx, eax
test ebx, ebx
cmovne esi, ebx
test edi, edi
jle 0x4f9523
add edi, esi
mov eax, 0x1505
mov ebx, eax
shl ebx, 5
add ebx, eax
movsx eax, byte [esi]
inc esi
push eax
call fcn.0051c5f0
add esp, 4
movzx eax, al
xor eax, ebx
cmp esi, edi
jb 0x4f9501
movzx edi, al
jmp 0x4f9528
mov edi, 5
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4fa8e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x7aa024]
xor esi, ebp
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov dword [edi], 0
push esi
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test eax, eax
jne 0x4faa49
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4faa32
xor edi, edi
mov dword [ebp - 0x18], 0
mov eax, dword [ebx + 0x14]
mov esi, 0
test eax, eax
je 0x4fa94f
push eax
call fcn.0066b230
add esp, 4
mov esi, eax
inc esi
mov eax, dword [ebx + 4]
cmp eax, 2
je 0x4fa967
cmp eax, 0x17
jne 0x4faa10
mov eax, 0x1c
jmp 0x4fa96c
mov eax, 0x10
cmp dword [ebx + 0x18], 0
je 0x4faa10
cmp dword [ebx + 0x10], eax
jb 0x4faa10
mov dword [ebp - 0x24], edi
mov ecx, dword [fcn.005f2b30]
lea edi, [esi + eax]
add edi, 0x20
mov dword [ebp - 0x1c], eax
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test eax, eax
je 0x4faa5d
mov edi, eax
mov eax, dword [ebx]
mov dword [edi], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x10], ecx
xor eax, eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x20]
mov dword [edi + 0x18], eax
push ecx
push dword [ebx + 0x18]
mov dword [ebp - 0x20], eax
push eax
call fcn.00650080
add esp, 0xc
test esi, esi
je 0x4fa9fb
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
mov dword [edi + 0x14], eax
push esi
push dword [ebx + 0x14]
push eax
call fcn.00650080
add esp, 0xc
mov eax, dword [ebp - 0x18]
test eax, eax
cmove eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4faa10
mov dword [eax + 0x1c], edi
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x4fa937
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4faa29
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
xor esi, esi
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x4faa44
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, 0x2af9
xor ecx, ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4faa6b
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, 8
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4faa42
mov edi, dword [ebx + 0x1c]
mov ecx, dword [fcn.005f2b80]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov ebx, edi
test edi, edi
jne 0x4faa77
jmp 0x4faa42

Function at 0x4fb870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push esi
call fcn.0065c64a
add esp, 0x18
cmp eax, 0xffffffff
cmovne esi, eax
test eax, eax
cmovne eax, esi
pop esi
pop ebp
ret
Function at 0x4fe5c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor edi, edi
inc edi
xor ebx, ebx
mov ecx, dword [fcn.005f2bb0]
call dword [section..00cfg]
push edi
push ebx
call ecx
add esp, 8
test eax, eax
je 0x4fe617
mov esi, eax
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4fe608
cmp eax, edi
je 0x4fe608
cmp eax, 0x8001
jae 0x4fe608
mov ebx, esi
cmp eax, edi
mov edi, eax
jae 0x4fe5cb
jmp 0x4fe62b
mov ecx, dword [fcn.005f2b80]
call dword [section..00cfg]
push esi
jmp 0x4fe624
mov ecx, dword [fcn.005f2b80]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ff400
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], 0xff
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x14]
lea esi, [ecx + eax*2]
add esi, 0xc
mov ecx, dword [fcn.005f2b30]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4ff5a0
mov edi, eax
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], ebx
add edi, 0xc
mov dword [ecx + 4], edi
mov eax, dword [ebx + 0xc]
add eax, edi
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [ebx + 0x10], edx
mov esi, ebx
jae 0x4ff4be
mov ecx, dword [esi]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [esi + 4]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebx + 4]
call dword [section..00cfg]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call ecx
add esp, 0xc
mov eax, dword [ebx + 4]
mov dword [ebp - 0x18], eax
mov edi, dword [ebx + 8]
add edi, dword [esi + 0xc]
mov ecx, dword [esi + 8]
call dword [section..00cfg]
push dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
push edi
call ecx
add esp, 8
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov edi, ebx
mov ebx, eax
jmp 0x4ff4c9
mov dword [ebp - 0x20], eax
mov ebx, edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov ecx, dword [esi]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov ecx, dword [esi]
mov ebx, dword [edi + 8]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
mov ecx, dword [ebp - 0x20]
je 0x4ff554
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
mov al, byte [ecx + ebx]
xor al, 0x36
mov byte [ebp - 0x11], al
mov ecx, dword [esi + 4]
mov edi, dword [ebp - 0x1c]
mov eax, dword [edi + 4]
mov dword [ebp - 0x24], eax
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x11]
push eax
push dword [ebp - 0x24]
call ecx
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov al, byte [eax + ebx]
xor al, 0x5c
mov byte [ebp - 0x11], al
mov ecx, dword [esi + 4]
mov edi, dword [edi + 8]
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x11]
push eax
push edi
call ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add esp, 0xc
inc ebx
cmp eax, ebx
jne 0x4ff4fa
cmp eax, dword [esi + 0x10]
jae 0x4ff5a0
mov ebx, esi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebx + 4]
mov esi, dword [edi + 4]
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
push str.6xn__
push esi
call ecx
add esp, 0xc
mov ecx, dword [ebx + 4]
mov esi, dword [edi + 8]
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
push 0x74ea75
push esi
call ecx
mov eax, dword [ebp - 0x18]
add esp, 0xc
inc eax
cmp eax, dword [ebx + 0x10]
jb 0x4ff55e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, dword [ebp - 0x1c]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5003e0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
cmp byte [ecx + 0x272], 0
je 0x5003f8
pop ebp
jmp fcn.004fc0e0
push dword [ebp + 0xc]
push eax
call fcn.004f3ce0
add esp, 8
pop ebp
ret

Function at 0x500b70
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x100], 2
jne 0x500b85
pop ebp
jmp fcn.004ffee0
mov al, 1
pop ebp
ret
Function at 0x5127d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [0x7aa024]
xor ecx, ebp
xor edx, edx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 8], ecx
setne dl
lea ecx, [ebp - 0xc]
mov dword [ecx], edx
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 8
pop esi
pop ebp
ret

Function at 0x5148d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x28], eax
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x10]
movdqa xmmword [eax], xmm0
push eax
call fcn.0051daf0
add esp, 4
push edi
call fcn.004fb040
add esp, 4
mov edi, eax
push esi
call fcn.004fb040
add esp, 4
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x514964
mov eax, esp
push eax
call fcn.0051daf0
sub esp, 0x1c
movaps xmm0, xmmword [esp + 0x30]
movups xmmword [esp + 0x10], xmm0
movdqu xmm0, xmmword [esp + 0x20]
movdqu xmmword [esp], xmm0
call fcn.0051dbd0
add esp, 0x20
cmp eax, 0x3e9
sbb edx, 0
jae 0x514975
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x51491e
test edi, edi
je 0x514971
push edi
call fcn.005f2b80
add esp, 4
xor edi, edi
jmp 0x514985
test edi, edi
je 0x514982
push edi
call fcn.005f2b80
add esp, 4
xor edi, edi
inc edi
test esi, esi
je 0x514992
push esi
call fcn.005f2b80
add esp, 4
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.0064d372
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x515340
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x110
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx + 0xc]
mov eax, dword [ebx + 0x2a0]
test byte [eax + 0x44], 3
mov esi, dword [ebx + edi*4 + 0x148]
je 0x515472
cmp dword [ebx + edi*4 + 0x160], 0x515580
jne 0x515472
shl edi, 4
mov eax, dword [ebx + edi + 0x174]
sub eax, dword [ebx + edi + 0x178]
cmp dword [ebx + edi + 0x170], 0
je 0x5153aa
test eax, eax
je 0x515472
sub esp, 0x14
movaps xmm0, xmmword [0x74dcc0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [ebp - 0x114], eax
call fcn.00514a00
add esp, 0x14
cmp eax, 0xffffffff
je 0x515472
and eax, 1
je 0x515472
lea edx, [ebx + edi]
add edx, 0x178
mov eax, dword [edx - 8]
test eax, eax
mov dword [ebp - 0x118], edx
je 0x5153fc
mov ecx, dword [edx]
mov edx, dword [ebp - 0x114]
jmp 0x515459
lea ecx, [ebx + edi]
add ecx, 0x174
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e8]
add eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x11c], ecx
mov dword [ecx], eax
mov ecx, dword [fcn.005f2b30]
call dword [section..00cfg]
push dword [ebp - 0x114]
call ecx
mov edx, dword [ebp - 0x118]
add esp, 4
mov dword [edx - 8], eax
test eax, eax
je 0x515509
xor ecx, ecx
mov dword [edx], ecx
mov dword [ebx + edi + 0x17c], ecx
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
add ecx, eax
push 0
push edx
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x515472
mov ecx, dword [ebp - 0x118]
add dword [ecx], eax
xor edi, edi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp esi, 0xffffffff
jne 0x5154f2
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x5154a7
mov dword [edi], 0x51
xor esi, esi
jmp 0x5154f2
mov esi, eax
mov edi, 0x100
lea ebx, [ebp - 0x110]
push edi
push 0xff
push ebx
call fcn.00650600
add esp, 0xc
push edi
push ebx
push esi
call fcn.0051cc80
add esp, 0xc
push eax
push str.Send_failure:__s
mov edi, dword [ebp + 8]
push edi
call fcn.00515170
add esp, 0xc
mov dword [edi + 0x964], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x110
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x1b
jmp 0x5154ef
Function at 0x519450
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
dec eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], eax
sub esp, 0x14
movaps xmm0, xmmword [0x7519c0]
movups xmmword [esp + 4], xmm0
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5194a5
lea eax, [ebp - 0x14]
xor ecx, ecx
push eax
push ecx
push ecx
push 0x800c
push dword [eax - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push edi
call fcn.00530510
add esp, 4
xor edi, edi
push edi
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea esi, [ebp - 0x10]
mov dword [esi], edi
push edi
push esi
push edi
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esi], 0x20
jne 0x5194e5
push 0
push esi
push dword [ebp + 8]
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x5194f3
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x519503
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0064d372
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret