joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e7dc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, eax
mov edx, esi
shr edx, 2
xor eax, eax
test edx, edx
je 0x42e818
push ebx
push edi
movzx edi, byte [ecx + 3]
movzx ebx, byte [ecx + 2]
shl edi, 8
or edi, ebx
movzx ebx, byte [ecx + 1]
shl edi, 8
or edi, ebx
movzx ebx, byte [ecx]
shl edi, 8
or edi, ebx
xor dword [esp + 0x10], edi
dec edx
add ecx, 4
test edx, edx
jne 0x42e7ec
pop edi
pop ebx
and esi, 3
dec esi
je 0x42e834
dec esi
je 0x42e82b
dec esi
jne 0x42e839
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, dword [esp + 8]
pop esi
ret

Function at 0x42e89e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x42e8e0
cmp dword [ebp + 0xc], 0
je 0x42e8e0
push dword [ebp + 8]
call fcn.0064df00
mov esi, eax
cmp esi, 0xff
pop ecx
jg 0x42e8e0
push dword [ebp + 0xc]
inc esi
push 1
push esi
push dword [ebp + 8]
call fcn.0064a21c
add esp, 0x10
test eax, eax
jne 0x42e8dc
push 0xfffffffffffffff6
pop eax
jmp 0x42e8e3
mov eax, esi
jmp 0x42e8e3
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x42e8e6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x42e919
cmp dword [ebp + 8], 0
je 0x42e919
push dword [ebp + 8]
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.0064ead3
add esp, 0x10
test eax, eax
jne 0x42e910
push 0xfffffffffffffffe
pop eax
leave
ret
mov eax, dword [ebp - 4]
mov dword [esi], eax
push 4
jmp 0x42e90d
or eax, 0xffffffff
leave
ret

Function at 0x42e91e
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 8], 0
jne 0x42e929
or eax, 0xffffffff
ret
push dword [esp + 8]
lea eax, [esp + 8]
push 1
push 4
push eax
call fcn.0064a21c
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0xe
add eax, 0xfffffff6
ret

Function at 0x42e949
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x42e97e
cmp dword [ebp + 8], 0
je 0x42e97e
push dword [ebp + 8]
lea eax, [ebp - 4]
push 1
push 2
push eax
call fcn.0064ead3
add esp, 0x10
test eax, eax
jne 0x42e973
push 0xfffffffffffffffe
pop eax
leave
ret
mov ax, word [ebp - 4]
mov word [esi], ax
push 2
jmp 0x42e970
or eax, 0xffffffff
leave
ret

Function at 0x42e983
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 8], 0
jne 0x42e98e
or eax, 0xffffffff
ret
push dword [esp + 8]
lea eax, [esp + 8]
push 1
push 2
push eax
call fcn.0064a21c
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0xc
add eax, 0xfffffff6
ret
Function at 0x42e9ae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], eax
je 0x42ea3b
cmp ebx, eax
je 0x42ea3b
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
je 0x42e9d5
push 0xfffffffffffffffc
pop eax
jmp 0x42ea3e
push ebx
lea esi, [ebp - 8]
call fcn.0042e8e6
pop ecx
test eax, eax
jl 0x42ea3e
push ebx
lea esi, [ebp - 4]
call fcn.0042e8e6
pop ecx
test eax, eax
jl 0x42ea3e
movzx esi, word [ebp - 4]
cmp esi, edi
jbe 0x42e9fd
push 0xfffffffffffffffb
jmp 0x42e9d2
push ebx
push 1
push esi
push dword [ebp + 8]
call fcn.0064ead3
add esp, 0x10
test eax, eax
jne 0x42ea14
push 0xfffffffffffffffe
jmp 0x42e9d2
mov ecx, dword [ebp + 8]
push 0
mov eax, esi
call fcn.0042e7dc
push eax
push 4
pop eax
lea ecx, [ebp - 4]
call fcn.0042e7dc
pop ecx
pop ecx
cmp eax, dword [ebp - 8]
je 0x42ea37
push 0xfffffffffffffffa
jmp 0x42e9d2
mov eax, esi
jmp 0x42ea3e
or eax, 0xffffffff
pop edi
pop esi
leave
ret

Function at 0x42ea42
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
test ecx, ecx
je 0x42eab6
test ebx, ebx
je 0x42eab6
cmp edi, 0x8000
jbe 0x42ea5f
push 0xfffffffffffffffc
pop eax
jmp 0x42eab9
push 0
mov eax, edi
call fcn.0042e7dc
pop ecx
push ebx
push eax
mov esi, edi
shl esi, 0x10
push 4
or esi, edi
pop eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.0042e7dc
pop ecx
push eax
call fcn.0042e91e
pop ecx
pop ecx
test eax, eax
jl 0x42eab9
push ebx
push esi
call fcn.0042e91e
pop ecx
pop ecx
test eax, eax
jl 0x42eab9
push ebx
push 1
push edi
push dword [ebp + 8]
call fcn.0064a21c
add esp, 0x10
test eax, eax
jne 0x42eab1
push 0xfffffffffffffff6
jmp 0x42ea5c
lea eax, [edi + 8]
jmp 0x42eab9
or eax, 0xffffffff
pop esi
leave
ret

Function at 0x42f843
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x18], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor eax, eax
inc eax
ret
Function at 0x430c1b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x71d770]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp edi, eax
je 0x430cde
cmp dword [ebp + 0xc], eax
jl 0x430cde
jg 0x430c49
cmp dword [ebp + 8], eax
jbe 0x430cde
cmp ebx, eax
je 0x430cde
cmp dword [ebp + 0xc], eax
jg 0x430c65
jl 0x430c5e
cmp dword [ebp + 8], 0x3c
jae 0x430c65
mov eax, 0x22000009
jmp 0x430ce3
push 0x3c
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.006480e0
push edi
push 1
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.0064ead3
add esp, 0x1c
cmp eax, 1
je 0x430c8e
mov eax, 0x22000005
jmp 0x430ce3
push 4
lea eax, [ebp - 0x40]
push str.MSCF
push eax
call fcn.0064c6a1
add esp, 0xc
test eax, eax
jne 0x430c5e
test byte [ebp - 0x22], 4
jne 0x430cb2
mov eax, 0x2200000e
jmp 0x430ce3
movzx ax, byte [ebp - 0x1b]
movzx cx, byte [ebp - 0x1c]
shl ax, 8
or ax, cx
push 0x14
pop ecx
cmp cx, ax
jne 0x430cab
push 0x3c
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.006493a0
add esp, 0xc
xor eax, eax
jmp 0x430ce3
mov eax, 0x22000001
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0064815a
leave
ret

Function at 0x439c10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.006499b0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047f7b0
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
push 0x62
mov edx, dword [ebp + 0xc]
push edx
call fcn.0064e0f0
add esp, 8
test eax, eax
jne 0x439c52
mov eax, dword [ebp - 4]
or eax, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x439d01
call fcn.00460b90
push str.BIO_new_file
push 0x43
push str.....Srcopenssl_3.0.12crypto_bio_bss_file.c
call fcn.00460de0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.00460f10
add esp, 0x14
call fcn.00650d8f
cmp dword [eax], 2
je 0x439ca7
call fcn.00650d8f
cmp dword [eax], 6
jne 0x439cd3
call fcn.00460b90
push str.BIO_new_file
push 0x4b
push str.....Srcopenssl_3.0.12crypto_bio_bss_file.c
call fcn.00460de0
add esp, 0xc
push 0
push 0x80
push 0x20
call fcn.00460f10
add esp, 0xc
jmp 0x439cfd
call fcn.00460b90
push str.BIO_new_file
push 0x4d
push str.....Srcopenssl_3.0.12crypto_bio_bss_file.c
call fcn.00460de0
add esp, 0xc
push 0
push 0x80002
push 0x20
call fcn.00460f10
add esp, 0xc
xor eax, eax
jmp 0x439d4f
call fcn.00439dc0
push eax
call fcn.00438200
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x439d28
mov eax, dword [ebp - 8]
push eax
call fcn.0064a03e
add esp, 4
xor eax, eax
jmp 0x439d4f
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00438530
add esp, 8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x6a
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004390a0
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x439fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006499b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x43a024
cmp dword [ebp + 0xc], 0
je 0x43a024
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
and edx, 0
je 0x439ffc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0064a21c
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x43a018
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0064a21c
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43a024
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46e280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006499b0
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
jmp 0x46e2af
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x46e2d6
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor edx, ecx
movzx eax, byte [ebp - 1]
or eax, edx
mov byte [ebp - 1], al
jmp 0x46e2a6
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x47d350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x240
call fcn.006499b0
mov eax, dword [0x71d770]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x47d600
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x47dec0
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.0047d590
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
cmp dword [0x71f2dc], 0
je 0x47d3bf
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x71b690]
jmp 0x47d579
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x47d3da
jmp 0x47d4cf
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.0065267c
add esp, 0xc
push str.ws2_32
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.00652608
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x47d44d
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x47d44d
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
je 0x47d455
jmp 0x47d4cf
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.0065267c
add esp, 0xc
push str.wship6
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.00652608
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x47d4c8
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x47d4c8
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x47d4cf
cmp dword [ebp - 0x20], 0
je 0x47d564
mov dword [ebp - 4], 0
jmp 0x47d4eb
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x6a664c]
jge 0x47d52e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x47d52c
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x47d52e
jmp 0x47d4e2
cmp dword [ebp - 0x20], 0
je 0x47d564
mov dword [ebp - 4], 0
jmp 0x47d546
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [0x6a664c]
jge 0x47d564
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x18]
mov dword [eax*8 + 0x71b690], edx
jmp 0x47d53d
mov dword [0x71f2dc], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x71b690]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0064815a
mov esp, ebp
pop ebp
ret 4
Function at 0x47dd00
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006499b0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47ddcf
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x47ddaf
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x47ddaf
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x47dd6c
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x47ddaf
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0047da90
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x47dda2
mov eax, 8
jmp 0x47de15
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x47dd63
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.006526e4
add esp, 0x10
xor eax, eax
jmp 0x47de15
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x47dded
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x47de1c]
mov eax, 0x2af9
jmp 0x47de15
mov eax, 0x2afa
jmp 0x47de15
mov eax, 0x2afb
jmp 0x47de15
mov eax, 0x2af9
jmp 0x47de15
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4ad260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006499b0
mov dword [ebp - 4], 0
jmp 0x4ad27f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x4ad29f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp eax, edx
jne 0x4ad29f
jmp 0x4ad276
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4ad2b3
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jl 0x4ad2d9
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
test eax, eax
jne 0x4ad2d9
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xff
jne 0x4ad2d9
jmp 0x4ad2aa
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jge 0x4ad2e9
or eax, 0xffffffff
jmp 0x4ad3b6
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jle 0x4ad2fc
mov eax, dword [ebp - 4]
shl eax, 3
jmp 0x4ad3b6
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x7e
ja case.0x4ad333.1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x4ad3dc]
jmp dword [eax*4 + 0x4ad3bc]
mov dword [ebp - 0xc], 7
jmp 0x4ad37e
mov dword [ebp - 0xc], 6
jmp 0x4ad37e
mov dword [ebp - 0xc], 5
jmp 0x4ad37e
mov dword [ebp - 0xc], 4
jmp 0x4ad37e
mov dword [ebp - 0xc], 3
jmp 0x4ad37e
mov dword [ebp - 0xc], 2
jmp 0x4ad37e
mov dword [ebp - 0xc], 1
jmp 0x4ad37e
or eax, 0xffffffff
jmp 0x4ad3b6
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
jne 0x4ad3a6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
movzx ecx, byte [ebp - 5]
cmp edx, ecx
je 0x4ad3ad
or eax, 0xffffffff
jmp 0x4ad3b6
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea eax, [eax + edx*8]
mov esp, ebp
pop ebp
ret
Function at 0x4cf640
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18
call fcn.006499b0
mov dword [ebp - 8], 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004cfc10
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004d0030
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4cf6ec
mov dword [ebp - 0x14], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4cf6c6
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4cf6ba
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
shl eax, 3
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004d00e0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.004cfbb0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4cf6fa
mov eax, dword [ebp - 8]
jmp 0x4cf7ac
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004cfc10
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004d0030
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4cf795
mov dword [ebp - 0x18], 0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4cf76f
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4cf763
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x18]
shl ecx, 3
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004d00e0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004cfbb0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4cf7a0
mov eax, dword [ebp - 8]
jmp 0x4cf7ac
mov edx, dword [ebp + 8]
push edx
call fcn.004cfbb0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4edc60
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006499b0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0xffffffff
jne 0x4edcab
call fcn.00460b90
push str.BIO_connect
push 0x54
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.00460de0
add esp, 0xc
push 0
push 0x87
push 0x20
call fcn.00460f10
add esp, 0xc
xor eax, eax
jmp 0x4ede68
mov eax, dword [ebp + 0x10]
and eax, 8
neg eax
sbb eax, eax
neg eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047f4d0
add esp, 8
test eax, eax
jne 0x4edccf
xor eax, eax
jmp 0x4ede68
mov edx, dword [ebp + 0x10]
and edx, 4
je 0x4edd52
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x4edd52
call fcn.00460b90
push str.BIO_connect
push 0x5e
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.00460de0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00460f10
add esp, 0xc
call fcn.00460b90
push str.BIO_connect
push 0x60
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.00460de0
add esp, 0xc
push 0
push 0x89
push 0x20
call fcn.00460f10
add esp, 0xc
xor eax, eax
jmp 0x4ede68
mov edx, dword [ebp + 0x10]
and edx, 0x10
je 0x4eddd2
push 4
lea eax, [ebp - 4]
push eax
push 1
push 6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x4eddd2
call fcn.00460b90
push str.BIO_connect
push 0x68
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.00460de0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00460f10
add esp, 0xc
call fcn.00460b90
push str.BIO_connect
push 0x6a
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.00460de0
add esp, 0xc
push 0
push 0x8a
push 0x20
call fcn.00460f10
add esp, 0xc
xor eax, eax
jmp 0x4ede68
mov edx, dword [ebp + 0xc]
push edx
call fcn.0047e1e0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0047e1c0
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4ede63
push 0xffffffffffffffff
call fcn.004ee780
add esp, 4
test eax, eax
jne 0x4ede5f
call fcn.00460b90
push str.BIO_connect
push 0x72
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.00460de0
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00460f10
add esp, 0xc
call fcn.00460b90
push str.BIO_connect
push 0x74
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.00460de0
add esp, 0xc
push 0
push 0x67
push 0x20
call fcn.00460f10
add esp, 0xc
xor eax, eax
jmp 0x4ede68
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4ee560
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006499b0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
push 0xf
mov ecx, dword [ebp + 8]
push ecx
call fcn.00438530
add esp, 8
cmp dword [ebp - 4], 0
jg 0x4ee5c8
mov edx, dword [ebp - 4]
push edx
call fcn.004ee780
add esp, 4
test eax, eax
je 0x4ee5c8
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00438560
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret