joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9bd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
mov eax, dword [edi + 0xc0]
mov eax, dword [eax + 0x28]
push eax
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
call fcn.004aa580
mov ebx, eax
add esp, 8
lea esi, [ebx + 0x20]
mov dword [esi], 0x2000
mov ecx, dword [ebx + 0x28]
push 0
mov dword [ebx + 0x24], ecx
mov edx, dword [edi + 0xc0]
push ebx
lea ecx, [edx + 0x134]
push ecx
lea eax, [edx + 0x30]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push esi
push dword [edx]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x4a9c6e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2714
je 0x4a9c6e
cmp eax, 0x2733
je 0x4a9c6e
cmp eax, 0x3e5
je 0x4a9c6e
cmp eax, 0x40
je 0x4a9c6e
push ebx
mov dword [ebx + 0x14], eax
push dword [edi + 0xc0]
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x4a9c75
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 4]
push str.Error_initiating_event_type__d_
call fcn.00402190
int3

Function at 0x4a9c90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov eax, dword [edi + 0xc0]
mov eax, dword [eax + 0x28]
push eax
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
call fcn.004aa580
mov edx, dword [edi + 0xb4]
mov ebx, eax
mov ecx, dword [edi + 0x18]
lea eax, [ebx + 0x20]
mov esi, dword [edi + 0xc]
add esp, 8
add ecx, edx
sub esi, edx
mov dword [ebx + 0x24], ecx
lea ecx, [edi + 0x30]
mov dword [eax], esi
cmp word [ecx], 0
push 0
push ebx
jne 0x4a9cef
push 0
push 0
push 1
push eax
mov eax, dword [edi + 0xc0]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSASend]
jmp 0x4a9d0b
push dword [edi + 0xb0]
push ecx
push 0
push 0
push 1
push eax
mov eax, dword [edi + 0xc0]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x4a9d49
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2714
je 0x4a9d49
cmp eax, 0x2733
je 0x4a9d49
cmp eax, 0x3e5
je 0x4a9d49
cmp eax, 0x40
je 0x4a9d49
push ebx
mov dword [ebx + 0x14], eax
push dword [edi + 0xc0]
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x4a9d4e
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [edi + 4]
push str.Error_initiating_event_type__d_
call fcn.00402190
int3
Function at 0x4a9de0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x8c], 0
push esi
mov dword [ebp - 0x90], edx
mov esi, dword [eax + 4]
mov dword [ebp - 0x88], ecx
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x4a9ec0
cmp eax, 0x4cf
jg 0x4a9e9a
je 0x4a9e7b
cmp eax, 0x79
je 0x4a9e5c
cmp eax, 0x4c9
jne 0x4a9ea6
mov eax, 0x274d
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov eax, 0x274c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov eax, 0x2743
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
cmp eax, 0x4d0
jne 0x4a9ea6
mov eax, 0x2751
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x8c]
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4a9f1e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2714
je 0x4a9f1e
cmp eax, 0x2733
je 0x4a9f1e
cmp eax, 0x3e5
je 0x4a9f1e
cmp eax, 0x40
je 0x4a9f1e
push eax
mov dword [esi + 0x34], 1
call fcn.004aa540
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x34], 1
cmp dword [ebx + 4], 2
push edi
mov edi, dword [ebp - 0x8c]
jne 0x4a9fc2
test eax, eax
je 0x4a9f53
push edi
push dword [esi + 0x24]
push eax
call sub.MSVCR120.dll_memcpy
mov eax, dword [ebp - 0x88]
add esp, 0xc
cmp dword [ebx + 4], 2
jne 0x4a9fc2
cmp edi, dword [esi + 0x20]
jne 0x4a9f9a
cmp dword [0x68fa84], esi
jne 0x4a9f9a
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push ecx
lea ecx, [ebp - 0x84]
push ecx
push 0
push 0x2000
push eax
push dword [ebp - 0x90]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [ebp - 0x8c], edi
cmp dword [ebx + 4], 2
jne 0x4a9fc2
mov eax, dword [esi + 0x20]
cmp edi, eax
jb 0x4a9fc2
jne 0x4a9fcc
mov eax, edi
mov dword [0x68fa84], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
mov dword [0x68fa84], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
Function at 0x4aa320
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov ebx, dword [edi + 8]
mov dword [ebp - 8], ebx
cmp dword [ebx + 0x10], 0
jbe 0x4aa51b
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push esi
jmp 0x4aa350
mov eax, dword [ebx + 8]
mov ecx, dword [ecx + eax + 4]
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x4aa501
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x4aa501
mov eax, dword [esi]
cmp eax, dword [ecx + 0x18]
jne 0x4aa4f0
test byte [esi + 0xe0], 1
jne 0x4aa4f0
cmp dword [ecx], 0x103
je 0x4aa501
mov eax, dword [esi + 0xc0]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
cmp eax, 3
ja case.default.0x4aa3b0
jmp dword [eax*4 + 0x4aa52c]
mov dword [ebp - 4], 1
lea ecx, [edi + 0xc]
jmp 0x4aa3d9
mov dword [ebp - 4], 1
lea ecx, [edi + 0x18]
jmp 0x4aa3d9
mov dword [ebp - 4], 2
lea ecx, [edi + 0x24]
mov dword [ebp + 8], ecx
test eax, eax
je 0x4aa3e5
cmp eax, 1
jne 0x4aa44f
mov eax, dword [esi + 0xc0]
push 0
push 0
push 0x7010
push 0xffff
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [esi + 0xc0]
push dword [ebx + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4aa44f
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.004aa540
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4aa44f
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 0xc0]
push 0x1007
push 0xffff
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp - 4]
push esi
push dword [ebp + 8]
push edi
call fcn.004a3d30
add esp, 0x10
test byte [esi + 0xe0], 1
push esi
je 0x4aa4e5
call fcn.004a5cb0
lea ebx, [esi + 0xcc]
push ebx
push dword [ebp + 8]
call fcn.004aa070
mov eax, dword [edi + 0x6c]
add esp, 0xc
test eax, eax
je 0x4aa489
mov dword [eax], ebx
mov dword [ebx + 4], eax
mov dword [ebx], 0
inc dword [edi + 0x64]
cmp dword [edi + 0x64], 1
mov dword [edi + 0x6c], ebx
jne 0x4aa4a1
mov dword [edi + 0x68], ebx
cmp dword [esi + 0x1c], 0
je 0x4aa4ba
add esi, 0xc8
lea eax, [edi + 0x3c]
push esi
push eax
call fcn.004a8940
add esp, 8
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x2c], 0
jne 0x4aa4fa
lea esi, [eax + 0x13c]
lea eax, [edi + 0x4c]
push esi
push eax
call fcn.004aa070
lea eax, [edi + 0x58]
push esi
push eax
call fcn.004aa040
add esp, 0x10
jmp 0x4aa4fa
push edi
call fcn.004aa160
add esp, 8
jmp 0x4aa4bd
push ecx
push edi
call fcn.004a9d60
add esp, 8
mov dword [ebx + 4], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc eax
add ecx, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, dword [ebx + 0x10]
jb 0x4aa350
pop esi
push edi
call fcn.004a4010
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aa3b7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov ebx, dword [edi + 8]
mov dword [ebp - 8], ebx
cmp dword [ebx + 0x10], 0
jbe 0x4aa51b
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push esi
jmp 0x4aa350
mov eax, dword [ebx + 8]
mov ecx, dword [ecx + eax + 4]
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x4aa501
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x4aa501
mov eax, dword [esi]
cmp eax, dword [ecx + 0x18]
jne 0x4aa4f0
test byte [esi + 0xe0], 1
jne 0x4aa4f0
cmp dword [ecx], 0x103
je 0x4aa501
mov eax, dword [esi + 0xc0]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
cmp eax, 3
ja case.default.0x4aa3b0
jmp dword [eax*4 + 0x4aa52c]
mov dword [ebp - 4], 1
lea ecx, [edi + 0xc]
jmp 0x4aa3d9
mov dword [ebp - 4], 1
lea ecx, [edi + 0x18]
jmp 0x4aa3d9
mov dword [ebp - 4], 2
lea ecx, [edi + 0x24]
mov dword [ebp + 8], ecx
test eax, eax
je 0x4aa3e5
cmp eax, 1
jne 0x4aa44f
mov eax, dword [esi + 0xc0]
push 0
push 0
push 0x7010
push 0xffff
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [esi + 0xc0]
push dword [ebx + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4aa44f
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.004aa540
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4aa44f
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 0xc0]
push 0x1007
push 0xffff
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp - 4]
push esi
push dword [ebp + 8]
push edi
call fcn.004a3d30
add esp, 0x10
test byte [esi + 0xe0], 1
push esi
je 0x4aa4e5
call fcn.004a5cb0
lea ebx, [esi + 0xcc]
push ebx
push dword [ebp + 8]
call fcn.004aa070
mov eax, dword [edi + 0x6c]
add esp, 0xc
test eax, eax
je 0x4aa489
mov dword [eax], ebx
mov dword [ebx + 4], eax
mov dword [ebx], 0
inc dword [edi + 0x64]
cmp dword [edi + 0x64], 1
mov dword [edi + 0x6c], ebx
jne 0x4aa4a1
mov dword [edi + 0x68], ebx
cmp dword [esi + 0x1c], 0
je 0x4aa4ba
add esi, 0xc8
lea eax, [edi + 0x3c]
push esi
push eax
call fcn.004a8940
add esp, 8
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x2c], 0
jne 0x4aa4fa
lea esi, [eax + 0x13c]
lea eax, [edi + 0x4c]
push esi
push eax
call fcn.004aa070
lea eax, [edi + 0x58]
push esi
push eax
call fcn.004aa040
add esp, 0x10
jmp 0x4aa4fa
push edi
call fcn.004aa160
add esp, 8
jmp 0x4aa4bd
push ecx
push edi
call fcn.004a9d60
add esp, 8
mov dword [ebx + 4], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc eax
add ecx, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, dword [ebx + 0x10]
jb 0x4aa350
pop esi
push edi
call fcn.004a4010
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
or esi, 0xffffffff
nop
movzx edx, byte [ebx + 3]
lea eax, [ebx + 3]
lea ecx, [edx - 4]
cmp ecx, 0x61
ja case.0x4af2e7.6
nop
movzx ecx, byte [ecx + 0x4af3cc]
jmp dword [ecx*4 + 0x4af3bc]
movzx edx, byte [eax + 1]
mov ecx, dword [edi]
xor ecx, edx
test cl, 1
je 0x4af2fd
mov dword [edi], edx
add eax, 2
jmp 0x4af32b
movzx edx, byte [eax + 1]
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
add eax, edx
cmp byte [eax], 0x53
je case.0x4af2e7.88
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x4e0910]
jmp 0x4af329
movzx ecx, byte [edx + 0x4e0910]
add eax, ecx
movzx edx, byte [eax]
lea ecx, [edx - 4]
cmp ecx, 0x61
jbe 0x4af2e0
movzx edx, byte [eax]
lea ecx, [edx - 0x1b]
cmp ecx, 0x44
ja case.0x4af348.29
movzx ecx, byte [ecx + 0x4af440]
jmp dword [ecx*4 + 0x4af430]
xor ecx, ecx
cmp edx, 0x57
sete cl
push ecx
push edi
push eax
call fcn.004af2c0
add esp, 0xc
test eax, eax
js case.0x4af348.29
test esi, esi
jns 0x4af390
mov esi, eax
jmp 0x4af394
add eax, 2
cmp dword [ebp + 0x10], 0
je case.0x4af348.29
test esi, esi
jns 0x4af38c
test byte [edi], 1
movzx esi, byte [eax + 1]
je 0x4af394
or esi, 0x100
jmp 0x4af394
movzx eax, byte [eax + 1]
cmp esi, eax
jne case.0x4af348.29
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
shl ecx, 8
or ecx, eax
add ebx, ecx
cmp byte [ebx], 0x53
je 0x4af2d0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x4b53a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.MSVCR120.dll___iob_func]
call esi
add eax, 0x20
push eax
call dword [sym.imp.MSVCR120.dll_fflush]
add esp, 4
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR120.dll_vfprintf]
add esp, 0xc
push 0x4cc2d0
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR120.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x4b6110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor edx, edx
test esi, esi
jle 0x4b613f
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x66af68]
cmp edx, esi
jl 0x4b6124
pop edi
not ecx
mov eax, ecx
mov edx, ecx
shr eax, 8
movzx esi, al
movzx eax, cl
shl eax, 8
or eax, esi
shr edx, 0x10
shl eax, 8
movzx edx, dl
or eax, edx
shr ecx, 0x18
shl eax, 8
or eax, ecx
pop esi
pop ebp
ret

Function at 0x4b62d0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi + 8]
push eax
push dword [ebp + 8]
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x4b62fb
mov eax, 0x17
mov word [esi], ax
mov eax, 1
pop esi
pop ebp
ret
lea eax, [esi + 4]
push eax
push dword [ebp + 8]
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x4b631f
mov eax, 2
mov word [esi], ax
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4b6630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x68fa94], 0
mov edx, dword [ebp + 8]
not edx
jne 0x4b6646
call fcn.004b6030
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
jle 0x4b666f
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x68fb60]
cmp ecx, esi
jl 0x4b6654
pop edi
not edx
mov eax, edx
pop esi
pop ebp
ret

Function at 0x4b6940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
dec byte [ecx]
xor edi, edi
lea ecx, [ecx]
mov eax, edi
inc byte [ecx]
cdq
inc edi
idiv dword [ebp + 0x10]
movzx esi, byte [ecx]
mov eax, dword [ebp + 0xc]
mov bl, byte [esi + ecx + 2]
movzx eax, byte [edx + eax]
add al, bl
add byte [ecx + 1], al
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + ecx + 2]
mov byte [esi + ecx + 2], al
movzx eax, byte [ecx + 1]
mov byte [eax + ecx + 2], bl
cmp edi, 0x100
jl 0x4b6950
mov al, byte [ecx]
pop edi
pop esi
mov byte [ecx + 1], al
pop ebx
pop ebp
ret
Function at 0x4b6a00
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x66bf78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [ebp - 0x108], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [ebp - 0x104]
push eax
push 0x100
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov byte [esi + eax + 2], al
inc eax
cmp eax, 0x100
jl 0x4b6a63
push 0x80
lea eax, [ebp - 0x104]
mov word [esi], 0
push eax
push esi
call fcn.004b6940
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004b6940
add esp, 0x18
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
xor edi, edi
inc byte [esi]
movzx edx, byte [esi]
mov bl, byte [edx + esi + 2]
add byte [esi + 1], bl
movzx eax, byte [esi + 1]
mov cl, byte [eax + esi + 2]
mov byte [edx + esi + 2], cl
movzx eax, byte [esi + 1]
movzx ecx, cl
mov byte [eax + esi + 2], bl
movzx eax, bl
add ecx, eax
and ecx, 0xff
movzx eax, byte [ecx + esi + 2]
mov byte [ebp + edi - 0x104], al
inc edi
cmp edi, 0x100
jb 0x4b6ab1
xor edi, edi
inc byte [esi]
movzx edx, byte [esi]
mov bl, byte [edx + esi + 2]
add byte [esi + 1], bl
movzx eax, byte [esi + 1]
mov cl, byte [eax + esi + 2]
mov byte [edx + esi + 2], cl
movzx eax, byte [esi + 1]
movzx ecx, cl
mov byte [eax + esi + 2], bl
movzx eax, bl
add ecx, eax
and ecx, 0xff
movzx eax, byte [ecx + esi + 2]
mov byte [ebp + edi - 0x104], al
inc edi
cmp edi, 0x100
jb 0x4b6af6
xor edi, edi
jmp 0x4b6b40
inc byte [esi]
movzx edx, byte [esi]
mov bl, byte [edx + esi + 2]
add byte [esi + 1], bl
movzx eax, byte [esi + 1]
mov cl, byte [eax + esi + 2]
mov byte [edx + esi + 2], cl
movzx eax, byte [esi + 1]
movzx ecx, cl
mov byte [eax + esi + 2], bl
movzx eax, bl
add ecx, eax
and ecx, 0xff
movzx eax, byte [ecx + esi + 2]
mov byte [ebp + edi - 0x104], al
inc edi
cmp edi, 0x100
jb 0x4b6b40
xor edi, edi
inc byte [esi]
movzx edx, byte [esi]
mov bl, byte [edx + esi + 2]
add byte [esi + 1], bl
movzx eax, byte [esi + 1]
mov cl, byte [eax + esi + 2]
mov byte [edx + esi + 2], cl
movzx eax, byte [esi + 1]
movzx ecx, cl
mov byte [eax + esi + 2], bl
movzx eax, bl
add ecx, eax
and ecx, 0xff
movzx eax, byte [ecx + esi + 2]
mov byte [ebp + edi - 0x104], al
inc edi
cmp edi, 0x100
jb 0x4b6b85
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bb11e
mov esp, ebp
pop ebp
ret
Function at 0x4b8930
Capabilities:
Create pipe
Create thread

Disassembly:
cmp dword [0x6901a4], 0
push esi
mov esi, dword [sym.imp.MSVCR120.dll__wassert]
je 0x4b8954
push 0xd9
push str.nbase_winunix.c
push str.stdin_thread__NULL
call esi
add esp, 0xc
cmp dword [0x6901ac], 0
je 0x4b8971
push 0xda
push str.nbase_winunix.c
push str.stdin_pipe_r__NULL
call esi
add esp, 0xc
cmp dword [0x6901b0], 0
je 0x4b898e
push 0xdb
push str.nbase_winunix.c
push str.stdin_pipe_w__NULL
call esi
add esp, 0xc
cmp dword [0x6901a8], 0
je 0x4b89ab
push 0xdc
push str.nbase_winunix.c
push str.thread_stdin_handle__NULL
call esi
add esp, 0xc
push 0
push 0
push 0x6901b0
push 0x6901ac
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4b8a03
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push 0x6901a8
call esi
push eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [0x6901ac]
test eax, eax
jne 0x4b8a07
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x6901b0]
call esi
xor eax, eax
pop esi
ret
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x4b8a35
push dword [0x6901ac]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x6901b0]
call esi
push dword [0x6901a8]
call esi
xor eax, eax
pop esi
ret
push 0x8000
push 0
call dword [sym.imp.MSVCR120.dll__setmode]
mov esi, eax
push esi
push 0
call dword [sym.imp.MSVCR120.dll__setmode]
add esp, 0x10
push esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.MSVCR120.dll__open_osfhandle]
add esp, 8
cmp eax, 0xffffffff
je 0x4b8a13
push 0
push eax
call dword [sym.imp.MSVCR120.dll__dup2]
add esp, 8
push 0
push 0
push 0
push 0x4b8aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6901a4], eax
test eax, eax
je 0x4b8a13
mov eax, 1
pop esi
ret
Function at 0x4b8f10
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_malloc]
push esi
push edi
mov edi, dword [sym.imp.MSVCR120.dll_free]
xor esi, esi
mov dword [ebp - 4], 0x4000
lea esp, [esp]
push esi
call edi
push dword [ebp - 4]
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x4b8f60
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0x16
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
je 0x4b8f30
push esi
test eax, eax
je 0x4b8f6a
call edi
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004b8ff0
mov edi, dword [ebp + 8]
mov esi, eax
add esp, 4
mov dword [edi + 0xb70], esi
test esi, esi
je 0x4b8fe7
mov ecx, dword [esi + 0x40]
mov edx, 0x4e0e90
cmp ecx, 9
jne 0x4b8f95
mov eax, 0x4e0e94
jmp 0x4b8fbb
cmp ecx, 0x17
jne 0x4b8fa1
mov eax, 0x4e0e98
jmp 0x4b8fbb
cmp ecx, 0x18
jne 0x4b8fad
mov eax, 0x4e0e9c
jmp 0x4b8fbb
cmp ecx, 0x83
mov eax, 0x4e0ea0
cmovne eax, edx
push eax
call fcn.004b8e70
add esp, 4
cmp eax, 0xf4
jge 0x4b8f60
push dword [esi + 0x48]
lea eax, [eax + eax*2]
push dword [esi + 4]
lea eax, [edi + eax*4]
push eax
call fcn.004b8e10
mov esi, dword [esi + 8]
add esp, 0xc
test esi, esi
jne 0x4b8f81
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b9200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
push 0
push esi
mov dword [ebp - 4], eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWARENpcap
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4b9283
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push str.LoopbackAdapter
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b9271
cmp dword [ebp - 8], 1
jne 0x4b9271
push dword [ebp + 0xc]
lea esi, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret