joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fda0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 3
ja case.default.0x45fdbf
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x45ff44]
mov dword [ebp - 4], 0
jmp 0x45fdd8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x45fdf4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x621c98]
mov dword [edx + ecx*4 + 4], eax
jmp 0x45fdcf
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
jmp case.default.0x45fdbf
mov dword [ebp - 8], 0
jmp 0x45fe1f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x45fe3b
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x621db0]
mov dword [edx + ecx*4 + 4], eax
jmp 0x45fe16
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
jmp case.default.0x45fdbf
mov dword [ebp - 0xc], 0
jmp 0x45fe66
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jge 0x45fe93
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx*8 + 0x621dd0]
mov eax, dword [ecx*8 + 0x621dd4]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
mov dword [esi + ecx*8 + 0xac], edx
mov dword [esi + ecx*8 + 0xb0], eax
jmp 0x45fe5d
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xec], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf8], 0
jmp case.default.0x45fdbf
mov dword [ebp - 0x10], 0
jmp 0x45fedb
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jge 0x45ff08
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx*8 + 0x622090]
mov eax, dword [ecx*8 + 0x622094]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov dword [esi + ecx*8 + 0xac], edx
mov dword [esi + ecx*8 + 0xb0], eax
jmp 0x45fed2
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xec], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf8], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46b970
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0x10325476
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], 0xc3d2e1f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov esp, ebp
pop ebp
ret
Function at 0x4b32b0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2711
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x6b4774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [eax], vtable.AesCrypt.0
mov ecx, dword [ebp - 0x24]
add ecx, 8
call fcn.00421800
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00424c80
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x50
call fcn.00424c80
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x70], 0x80
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x74], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x78], 0
push 0x10
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.0058de90
add esp, 0xc
push 0x10
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x50
call fcn.00426ac0
push 0x10
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00426ac0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058bad0
mov esp, ebp
pop ebp
ret

Function at 0x4b8ba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4b8bae
or eax, 0xffffffff
jmp 0x4b8bec
cmp dword [ebp + 0x10], 0
jne 0x4b8bb9
or eax, 0xffffffff
jmp 0x4b8bec
mov eax, dword [ebp + 0x10]
push eax
call fcn.0058dc20
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4b8be9
xor eax, eax
jmp 0x4b8bec
or eax, 0xffffffff
pop ebp
ret
Function at 0x4b8fb0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [0x6b8da0]
test eax, eax
jne 0x4b909e
push 0x400
call fcn.0058c545
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [0x6b8da4], ecx
mov dword [ebp - 4], 0x4c11db7
mov dword [ebp - 8], 0
jmp 0x4b8ff7
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xff
ja 0x4b9097
push 8
mov eax, dword [ebp - 8]
push eax
call fcn.004b90d0
add esp, 8
shl eax, 0x18
mov ecx, dword [ebp - 8]
mov edx, dword [0x6b8da4]
mov dword [edx + ecx*4], eax
mov dword [ebp - 0xc], 0
jmp 0x4b9033
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jae 0x4b9070
mov ecx, dword [ebp - 8]
mov edx, dword [0x6b8da4]
mov eax, dword [edx + ecx*4]
shl eax, 1
mov ecx, dword [ebp - 8]
mov edx, dword [0x6b8da4]
mov ecx, dword [edx + ecx*4]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 4]
xor eax, ecx
mov edx, dword [ebp - 8]
mov ecx, dword [0x6b8da4]
mov dword [ecx + edx*4], eax
jmp 0x4b902a
push 0x20
mov edx, dword [ebp - 8]
mov eax, dword [0x6b8da4]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004b90d0
add esp, 8
mov edx, dword [ebp - 8]
mov ecx, dword [0x6b8da4]
mov dword [ecx + edx*4], eax
jmp 0x4b8fee
mov byte [0x6b8da0], 1
mov esp, ebp
pop ebp
ret

Function at 0x4c55c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa4], 0xffffffff
jne 0x4c55d8
jmp 0x4c5660
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x4c561c
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0x3e8
jb 0x4c561c
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0x1e8480
jae 0x4c561c
push 4
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xa4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x4c5660
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0x3e8
jb 0x4c5660
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0x1e8480
jae 0x4c5660
push 4
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
push 0x1002
push 0xffff
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xa4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret

Function at 0x4c5670
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xa4], 0xffffffff
jne 0x4c5687
jmp 0x4c56a7
mov dword [ebp - 4], 1
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa4]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esp, ebp
pop ebp
ret

Function at 0x4c56b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xa4], 0xffffffff
jne 0x4c56c7
jmp 0x4c56e7
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa4]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esp, ebp
pop ebp
ret
Function at 0x4c6b00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b4774]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
call fcn.0041ff70
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0xa4], 0xffffffff
je 0x4c6bac
mov dword [ebp - 8], 0x10
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0xa4]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4c6b7a
push str.Failed_to_getsockname
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp + 0x10]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004c6420
add esp, 4
xor al, al
jmp 0x4c6bc0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, dword [ebp + 8]
call fcn.004239b0
movzx ecx, word [ebp - 0x1a]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov al, 1
jmp 0x4c6bc0
push 0x6364a4
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [edx + 0x10]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0058bad0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4c6bd0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6b4774]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + 8]
call fcn.0041ff70
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 0xa4], 0xffffffff
je 0x4c6c7d
mov dword [ebp - 8], 0x1c
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0xa4]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4c6c4a
push str.Failed_to_getsockname_ipv6
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp + 0x10]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004c6420
add esp, 4
xor al, al
jmp 0x4c6c91
mov ecx, dword [ebp + 8]
call fcn.0041ff70
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
push 0x17
call fcn.004c4cc0
add esp, 0xc
movzx ecx, word [ebp - 0x26]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov al, 1
jmp 0x4c6c91
push str.Cannot_get_socket_name:_INVALID_SOCKET.
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [edx + 0x10]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0058bad0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ca5f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ecx
mov eax, dword [ebp - 0x120]
cmp dword [eax + 0xa4], 0xffffffff
jne 0x4ca627
push 0x637050
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x10]
call eax
xor al, al
jmp 0x4ca74d
cmp dword [ebp + 8], 0
jne 0x4ca63d
mov dword [ebp + 8], 0x5460
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x64
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x11c], 0
jmp 0x4ca675
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [ebp - 0x110]
jae 0x4ca6a2
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp + edx*4 - 0x10c]
cmp ecx, dword [eax + 0xa4]
jne 0x4ca6a0
jmp 0x4ca6a2
jmp 0x4ca666
mov edx, dword [ebp - 0x11c]
cmp edx, dword [ebp - 0x110]
jne 0x4ca6e1
cmp dword [ebp - 0x110], 0x40
jae 0x4ca6e1
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx + 0xa4]
mov dword [ebp + eax*4 - 0x10c], edx
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
xor ecx, ecx
jne 0x4ca65a
mov dword [ebp - 8], 0
lea edx, [ebp - 0x118]
push edx
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4ca72d
push 0x637078
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x10]
call edx
xor al, al
jmp 0x4ca74d
cmp dword [ebp - 4], 1
jne 0x4ca739
mov al, 1
jmp 0x4ca74d
push str.socket_is_not_ready_for_writing.
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x10]
call eax
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x4cb290
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x128], ecx
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
cmp dword [ebp + 0x10], 0
je 0x4cb2df
push 0x78
push 0
mov ecx, dword [ebp + 0x10]
call fcn.0045e8a0
mov ecx, dword [ebp + 0x10]
call fcn.0045e4f0
movzx ecx, al
test ecx, ecx
je 0x4cb2df
push str.Wait_for_data_aborted_by_app
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x18]
mov edx, dword [eax + 0x10]
call edx
xor al, al
jmp 0x4cb4c1
mov eax, dword [ebp - 0x128]
cmp dword [eax + 0xa4], 0xffffffff
jne 0x4cb30d
push str.Wait_for_data_passed_invalid_socket.
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
xor al, al
jmp 0x4cb4c1
movzx edx, byte [ebp + 0xc]
test edx, edx
jne 0x4cb322
cmp dword [ebp + 8], 0
jne 0x4cb322
mov dword [ebp + 8], 0x14
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x3e8
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0x7a120
jbe 0x4cb352
mov dword [ebp + 8], 0x7a120
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x3e8
mov dword [ebp - 0xc], ecx
movzx edx, byte [ebp + 0xc]
test edx, edx
jne 0x4cb379
cmp dword [ebp - 0x10], 0
jne 0x4cb379
cmp dword [ebp - 0xc], 0
jne 0x4cb379
mov dword [ebp - 0xc], 0x3e8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x124], 0
jmp 0x4cb3b0
mov edx, dword [ebp - 0x124]
add edx, 1
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x118]
jae 0x4cb3dd
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp + ecx*4 - 0x114]
cmp eax, dword [edx + 0xa4]
jne 0x4cb3db
jmp 0x4cb3dd
jmp 0x4cb3a1
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x118]
jne 0x4cb41c
cmp dword [ebp - 0x118], 0x40
jae 0x4cb41c
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 0xa4]
mov dword [ebp + edx*4 - 0x114], ecx
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
xor eax, eax
jne 0x4cb395
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4cb4b3
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
push 0x637564
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x18]
mov edx, dword [eax + 0x10]
call edx
push 2
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 0xa4]
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [ebp - 0x128]
mov eax, dword [edx + 0xa4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + 0xa4], 0xffffffff
mov edx, dword [ebp - 0x128]
mov byte [edx + 0xa0], 0
xor al, al
jmp 0x4cb4c1
cmp dword [ebp - 4], 0
jne 0x4cb4bf
xor al, al
jmp 0x4cb4c1
mov al, 1
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4e34c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
movsx eax, byte [ebp + 8]
cmp eax, 0x41
jne 0x4e34e3
mov ecx, dword [ebp + 0xc]
and ecx, 1
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x42
jne 0x4e34ff
mov eax, dword [ebp + 0xc]
and eax, 2
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x43
jne 0x4e351b
mov edx, dword [ebp + 0xc]
and edx, 4
setne al
jmp 0x4e3773
movsx eax, byte [ebp + 8]
cmp eax, 0x44
jne 0x4e3537
mov ecx, dword [ebp + 0xc]
and ecx, 0x10
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x45
jne 0x4e3553
mov eax, dword [ebp + 0xc]
and eax, 0x20
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x46
jne 0x4e356f
mov edx, dword [ebp + 0xc]
and edx, 0x40
setne al
jmp 0x4e3773
movsx eax, byte [ebp + 8]
cmp eax, 0x47
jne 0x4e358e
mov ecx, dword [ebp + 0xc]
and ecx, 0x80
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x48
jne 0x4e35ac
mov eax, dword [ebp + 0xc]
and eax, 0x200
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x49
jne 0x4e35cb
mov edx, dword [ebp + 0xc]
and edx, 0x400
setne al
jmp 0x4e3773
movsx eax, byte [ebp + 8]
cmp eax, 0x4a
jne 0x4e35ea
mov ecx, dword [ebp + 0xc]
and ecx, 0x800
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x4b
jne 0x4e3608
mov eax, dword [ebp + 0xc]
and eax, 0x1000
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x4c
jne 0x4e3627
mov edx, dword [ebp + 0xc]
and edx, 0x2000
setne al
jmp 0x4e3773
movsx eax, byte [ebp + 8]
cmp eax, 0x4d
jne 0x4e3646
mov ecx, dword [ebp + 0xc]
and ecx, 0x8000
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x4e
jne 0x4e3664
mov eax, dword [ebp + 0xc]
and eax, 0x10000
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x4f
jne 0x4e3683
mov edx, dword [ebp + 0xc]
and edx, 0x20000
setne al
jmp 0x4e3773
movsx eax, byte [ebp + 8]
cmp eax, 0x50
jne 0x4e36a2
mov ecx, dword [ebp + 0xc]
and ecx, 0x40000
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x51
jne 0x4e36c0
mov eax, dword [ebp + 0xc]
and eax, 0x80000
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x52
jne 0x4e36df
mov edx, dword [ebp + 0xc]
and edx, 0x100000
setne al
jmp 0x4e3773
movsx eax, byte [ebp + 8]
cmp eax, 0x53
jne 0x4e36f8
mov ecx, dword [ebp + 0xc]
and ecx, 0x400000
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x54
jne 0x4e3710
mov eax, dword [ebp + 0xc]
and eax, 0x800000
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x55
jne 0x4e3729
mov edx, dword [ebp + 0xc]
and edx, 0x2000000
setne al
jmp 0x4e3773
movsx eax, byte [ebp + 8]
cmp eax, 0x56
jne 0x4e3742
mov ecx, dword [ebp + 0xc]
and ecx, 0x20000000
setne al
jmp 0x4e3773
movsx edx, byte [ebp + 8]
cmp edx, 0x57
jne 0x4e375a
mov eax, dword [ebp + 0xc]
and eax, 0x40000000
setne al
jmp 0x4e3773
movsx ecx, byte [ebp + 8]
cmp ecx, 0x58
jne 0x4e3771
mov edx, dword [ebp + 0xc]
and edx, 0x80000000
setne al
jmp 0x4e3773
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x509b80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x509b96
xor al, al
jmp 0x509cca
mov eax, dword [ebp - 0x14]
cmp dword [eax + 4], 0
je 0x509bb4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call fcn.0058c13d
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
push ecx
push 1
push 4
mov edx, dword [ebp - 0x14]
add edx, 8
push edx
call fcn.00591a72
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x509bf9
xor al, al
jmp 0x509cca
mov eax, dword [ebp + 8]
push eax
push 1
push 4
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
push ecx
call fcn.00591a72
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x509c2a
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], 0
xor al, al
jmp 0x509cca
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc], 0
jne 0x509c3a
mov al, 1
jmp 0x509cca
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0xc]
shl eax, 1
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0058c545
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
push 8
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
call fcn.00591a72
add esp, 0x10
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0xc]
je 0x509cc8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0058c13d
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xc], 0
xor al, al
jmp 0x509cca
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x521f00
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x6b4774]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xdc], ecx
mov ecx, dword [ebp - 0xdc]
add ecx, 8
call fcn.0055afa0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x521fc3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x521f5b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xdc]
mov eax, dword [ecx]
mov dword [edx + 0x64], eax
jmp 0x521f68
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + 0x64], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 3]
push ecx
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + 2]
push eax
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 1]
push edx
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
push ecx
push 0x650188
lea edx, [ebp - 0xd8]
push edx
call fcn.0058c1d4
add esp, 0x18
lea eax, [ebp - 0xd8]
push eax
mov ecx, dword [ebp - 0xdc]
add ecx, 0x38
call fcn.004239b0
jmp 0x521fd1
mov ecx, dword [ebp - 0xdc]
add ecx, 0x38
call fcn.0041ff70
mov ecx, dword [ebp - 0xdc]
mov byte [ecx + 0x60], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058bad0
mov esp, ebp
pop ebp
ret
Function at 0x54ec50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x404]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x408]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
jmp 0x54ec83
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0x10]
jge 0x54ecfa
mov eax, dword [ebp - 8]
add eax, 1
movzx ecx, al
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
movzx eax, dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [edx + ecx*4 + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
movzx ecx, al
mov eax, dword [ebp - 0x18]
xor edx, dword [eax + ecx*4 + 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov byte [ecx], dl
jmp 0x54ec7a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov dword [edx + 0x404], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x408], edx
mov esp, ebp
pop ebp
ret 0xc