joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4691d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x150
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp + 0x78], 2
and dword [esp + 0x88], 0
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x50], 3
cmp ecx, 3
je 0x469336
lea eax, [esp + 0x3c]
add esi, 0x54
mov dword [eax - 4], ecx
push 0xd
pop ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x1c]
mov edi, dword [eax + 0x20]
mov eax, dword [ebx + 0x10]
and dword [ebx + 0x10], 0
cmp eax, 1
je 0x46923f
cmp eax, 2
jne 0x469354
lea ecx, [esp + 0x38]
jmp 0x469331
mov al, byte [esp + 0x60]
movsd xmm1, qword [esp + 0x40]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 8], edx
movsd xmm0, qword [esp + 0x38]
mov esi, dword [esp + 0x68]
movzx edx, word [esp + 0x6c]
mov byte [esp + 3], al
mov al, byte [esp + 0x6e]
movsd qword [ecx + 8], xmm1
movsd xmm1, qword [esp + 0x48]
movsd qword [ecx], xmm0
movsd qword [ecx + 0x10], xmm1
mov dword [ecx + 0x18], esi
mov byte [ecx + 0x1e], al
mov byte [esp + 2], al
mov word [ecx + 0x1c], dx
call fcn.00458535
test eax, eax
je 0x46932d
mov ecx, dword [esp + 4]
cmp byte [esp + 3], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
je 0x4692bf
mov al, byte [esp + 2]
or al, 1
mov byte [esp + 0x36], al
movsd xmm1, qword [esp + 0x28]
lea edi, [esp + 0x90]
movsd xmm0, qword [esp + 0x30]
movsd xmm2, qword [esp + 0x18]
lea esi, [esp + 0xc]
mov ecx, esi
movsd qword [edi + 0x18], xmm1
movsd xmm1, qword [esp + 0x20]
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 8], xmm2
movsd qword [edi + 0x10], xmm1
mov byte [edi], 0
call fcn.00422692
mov edx, dword [esp + 8]
lea ecx, [eax + 0x78]
push edi
call fcn.00469ba5
pop eax
mov ecx, esi
call fcn.004226aa
cmp dword [eax + 0x24], 0
jle 0x469329
add ebx, 0x1c
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.0042371d
mov bl, 1
jmp 0x469338
lea ecx, [esp + 0x18]
call fcn.004552f8
xor ebx, ebx
lea esi, [esp + 0x70]
mov ecx, esi
call fcn.00456464
mov ecx, esi
call fcn.00456475
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x23
pop edx
mov ecx, str.wasnt_expecting_a_frame_to_reclaim
push 0x53ad98
call fcn.0050f4b1
pop eax
ud2
Function at 0x471b94
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x34]
mov edx, dword [edx + 0x38]
push 0x53d788
push dword [edi + 0x28]
call fcn.00470b73
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
push 0
push 0
push eax
push edi
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x471cc5
test eax, eax
je 0x471c5d
cmp eax, 0x90317
je 0x471cbe
cmp eax, 0x90321
jne 0x471cd2
mov dword [edi + 0x58], 0x10000
mov byte [edi + 0x5c], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x28]
jne 0x471c48
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.00471b49
and dword [edi + 0x9c], 0
jmp 0x471ce3
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x34]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x38]
and dword [edi + 0x20], 0
lea ebx, [edi + 0x18]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.00471cf0
pop ecx
pop ecx
add edx, eax
mov ecx, ebx
push eax
call fcn.00419104
pop eax
and dword [edi + 0x14], 0
and dword [edi + 0x10], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x28]
jne 0x471ca2
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.00471b49
mov eax, dword [edi + 0x28]
xor ecx, ecx
or eax, dword [edi + 0x2c]
sete cl
mov dword [edi + 0x9c], ecx
jmp 0x471ce3
mov word [esi], 0x104
jmp 0x471ce8
cmp dword [esp + 0x10], 4
jne 0x471cda
mov eax, dword [esp + 0xc]
jmp 0x471cdd
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x471ce8
xor eax, eax
inc eax
mov dword [edi + 0x9c], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x471f3d
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0xf4]
mov edx, dword [edx + 0xf8]
push 0x53d788
push dword [edi + 0xe8]
call fcn.00470b73
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0xc0]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x4720a1
test eax, eax
je 0x47201e
cmp eax, 0x90317
je 0x47209a
cmp eax, 0x90321
jne 0x4720ae
mov dword [edi + 0x118], 0x10000
mov byte [edi + 0x11c], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xe8]
jne 0x472009
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.00471ee6
and dword [edi + 0x144], 0
jmp 0x4720bf
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0xf4]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0xf8]
and dword [edi + 0xe0], 0
lea ebx, [edi + 0xd8]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.00471cf0
pop ecx
pop ecx
add edx, eax
mov ecx, ebx
push eax
call fcn.00419104
pop eax
and dword [edi + 0xd4], 0
and dword [edi + 0xd0], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xe8]
jne 0x472078
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.00471ee6
mov eax, dword [edi + 0xe8]
xor ecx, ecx
or eax, dword [edi + 0xec]
sete cl
mov dword [edi + 0x144], ecx
jmp 0x4720bf
mov word [esi], 0x104
jmp 0x4720c4
cmp dword [esp + 0x10], 4
jne 0x4720b6
mov eax, dword [esp + 0xc]
jmp 0x4720b9
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4720c4
xor eax, eax
inc eax
mov dword [edi + 0x144], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4720ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov esi, edx
mov dword [edx + 0x78], eax
call fcn.004722b4
mov ebp, edx
lea edi, [esp + 8]
mov dword [esp], eax
mov dword [esp + 0x24], edx
mov ecx, esi
call fcn.00472354
test edx, edx
jne 0x4721b8
mov ecx, edi
mov edx, esi
call fcn.00470e5f
mov eax, dword [esp + 8]
cmp eax, 2
je 0x472229
test eax, eax
je 0x4721b8
cmp dword [esi + 0x9c], 0
je 0x47218d
mov ecx, edi
mov edx, esi
call fcn.004719fa
cmp byte [esp + 8], 4
jne 0x472171
mov eax, dword [esp + 0xc]
jmp 0x472182
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0xc]
cmp bl, 4
jne 0x472239
test eax, eax
je 0x4721b8
and dword [esi + 0x9c], 0
mov ecx, edi
mov edx, esi
call fcn.00471b94
cmp byte [esp + 8], 4
jne 0x4721a3
mov bh, byte [esp + 9]
jmp 0x4721b0
mov ebx, dword [esp + 8]
cmp bl, 4
jne 0x472233
test bh, bh
je 0x472129
mov ecx, esi
call fcn.00472354
cmp ebp, edx
mov edi, edx
mov dword [esp + 0x20], eax
cmovae ebp, edx
mov edx, dword [esp]
mov ecx, ebp
push 0x53d204
push dword [esp + 0x28]
call fcn.004586a3
pop ecx
pop ecx
mov ebx, edx
mov edx, dword [esp + 0x20]
mov ecx, ebp
mov dword [esp], eax
push 0x53d214
push edi
call fcn.004586a3
pop ecx
pop ecx
mov ecx, dword [esp]
mov edi, edx
mov edx, ebx
push 0x53d224
push edi
push eax
call fcn.004a1e74
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
add eax, ebp
adc ecx, 0
xor edx, edx
cmp dword [esi + 0x20], eax
sbb edx, ecx
jb 0x47229f
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
jmp 0x472248
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
jmp 0x47223b
mov ebp, dword [esp + 0xc]
jmp 0x47223b
mov ebp, eax
cmp bl, 4
je 0x472248
movzx eax, bl
cmp eax, 4
jne 0x47226c
mov ecx, dword [esp + 0x40]
mov edx, ebp
push 0x53d6b8
call fcn.00472304
pop eax
mov eax, dword [esp + 4]
mov byte [eax], 4
and dword [esi + 0x78], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esp + 8]
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 4], ebp
call fcn.00425b14
cmp al, 0xd
jne 0x472294
mov eax, dword [esp + 4]
and dword [esi + 0x78], 0
mov byte [eax], 5
push edi
call fcn.00442ab5
pop eax
jmp 0x472264
mov eax, dword [esp + 4]
mov dword [eax], ebx
mov dword [eax + 4], ebp
jmp 0x472260
push 0x3b
pop edx
mov ecx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
push 0x53d314
call fcn.0050d590
pop eax
ud2
Function at 0x48d4ad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, edx
mov edx, dword [esp + 0x38]
lea esi, [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, esi
push 0xb
call fcn.0048d59d
pop eax
mov eax, esp
mov ecx, 0x800
mov dword [eax], 0x800
lea eax, [esp + 8]
and dword [eax], 0
call fcn.00441781
lea ebp, [esp + 0xc]
mov esi, dword [esi + 4]
mov edi, edx
mov dword [ebp], eax
mov dword [ebp + 4], edx
and dword [ebp + 8], 0
mov eax, esp
push eax
push edi
lea eax, [esp + 0x10]
push eax
push 0
push esi
push ebx
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x48d522
mov edx, dword [esp]
mov ecx, ebp
call fcn.004215d9
mov edi, dword [esp + 0x10]
jmp 0x48d4f8
test eax, eax
jne 0x48d541
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
cmp eax, 0xb
jbe 0x48d55d
mov eax, 0xde
jmp 0x48d545
mov edx, dword [esp + 4]
xor ecx, ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov dword [edx + 4], eax
mov byte [edx + 0xc], 0xc
mov edx, edi
call fcn.0043e31d
jmp 0x48d571
mov ecx, dword [esp + 0x14]
movsd xmm0, qword [esp + 0xc]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
lea ecx, [esp + 0x18]
call fcn.0046ea5f
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49620c
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1e0
cmp dword [ebp + 8], 0x20
mov esi, ecx
jne 0x4963ec
mov eax, edx
push 0x20
pop ebx
lea edi, [esp + 0xf0]
mov edx, 0x5500f8
mov ecx, edi
push ebx
push eax
call fcn.00496008
pop eax
pop ecx
mov eax, dword [edi + 0x40]
mov ecx, edi
mov edx, dword [eax + 0x40]
push 0x552584
call fcn.00493b75
pop ecx
lea ebx, [esp + 0x30]
mov edi, edx
mov edx, eax
mov ecx, ebx
push 0x5501c0
push 0x20
pop eax
push eax
push edi
call fcn.00490cd1
add esp, 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 8], eax
push 0x20
pop eax
cmp dword [ebx + 4], eax
mov al, 1
jne 0x4962bb
mov eax, dword [esp + 0x30]
movsd xmm0, qword [eax + 0x18]
movsd qword [esp + 0x49], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x41], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
xor eax, eax
movsd qword [esp + 0x39], xmm1
movsd qword [esp + 0x31], xmm0
lea ecx, [esi + 1]
lea edx, [esp + 0x30]
lea edi, [esp + 0x13c]
mov dword [esp + 0xc], ecx
mov byte [edx], al
mov ecx, edi
push 0x5501d0
call fcn.0049609f
pop eax
push edi
call fcn.004f4533
pop eax
movsd xmm1, qword [edi + 0x10]
lea ebx, [esp + 0xd0]
movsd xmm0, qword [edi + 0x18]
movsd xmm2, qword [edi]
movsd qword [ebx + 0x10], xmm1
movsd xmm1, qword [edi + 8]
movsd qword [ebx + 0x18], xmm0
movsd qword [ebx], xmm2
movsd qword [ebx + 8], xmm1
call fcn.004945f8
lea edi, [esp + 0x13c]
mov edx, ebx
mov ecx, edi
call fcn.004960ec
movsd xmm1, qword [ebx + 0x10]
movsd xmm0, qword [ebx + 0x18]
movsd xmm2, qword [ebx]
cmp dword [esp + 8], 0x20
mov al, 1
movsd qword [esp + 0x20], xmm1
movsd xmm1, qword [ebx + 8]
movsd qword [esp + 0x28], xmm0
movsd qword [esp + 0x10], xmm2
movsd qword [esp + 0x18], xmm1
jne 0x49638a
mov eax, dword [esp + 4]
movsd xmm0, qword [eax + 0x18]
movsd qword [esp + 0x49], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x41], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
xor eax, eax
movsd qword [esp + 0x39], xmm1
movsd qword [esp + 0x31], xmm0
lea ebx, [esp + 0x30]
lea ecx, [esi + 0x21]
mov byte [ebx], al
mov edx, ebx
push 0x5501e0
call fcn.0049609f
pop eax
push 0xa0
push edi
push ebx
call fcn.005010b0
add esp, 0xc
lea ecx, [esi + 0x41]
mov edx, ebx
call fcn.00496111
mov eax, dword [esp + 0xc]
movsd xmm1, qword [esp + 0x20]
movsd xmm0, qword [esp + 0x28]
movsd xmm2, qword [esp + 0x10]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0x18]
movsd qword [eax + 0x18], xmm0
movsd qword [eax], xmm2
movsd qword [eax + 8], xmm1
xor eax, eax
jmp 0x4963fc
mov al, 1
mov dword [esi + 4], 0x55102e
mov dword [esi + 8], 0xf
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49667e
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1d0
mov ebx, edx
mov dword [esp + 0xc], ecx
call fcn.004945f8
xorps xmm0, xmm0
lea eax, [esp + 0x90]
movaps xmmword [eax - 0x10], xmm0
movaps xmmword [eax - 0x20], xmm0
movaps xmmword [eax - 0x30], xmm0
movaps xmmword [eax - 0x40], xmm0
movaps xmmword [eax - 0x50], xmm0
movaps xmmword [eax - 0x60], xmm0
movaps xmmword [eax - 0x70], xmm0
movaps xmmword [eax - 0x80], xmm0
push 0x10
pop ecx
mov edi, eax
mov esi, 0x5500f8
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x44], 0
and dword [eax + 0x40], 0
mov dword [eax + 0x48], 0x5500f8
and dword [eax + 0x50], 0
push 0x20
pop edi
lea esi, [esp + 0x10]
mov edx, ebx
mov ecx, esi
push edi
call fcn.00494169
pop eax
mov edx, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.00494169
pop eax
mov edx, dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 0x10]
call fcn.00494169
pop eax
lea edi, [esp + 0xf0]
push 0xd8
push esi
push edi
call fcn.005010b0
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.00494313
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bad4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [esp + 0x78]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x7c]
lea edi, [esp + 0xa]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 2
mov esi, eax
rol si, 8
mov word [edi], si
xor edi, edi
lea esi, [esp + 2]
inc edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x55388b
mov dword [esp + 0x20], 6
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x28], ecx
add cl, 6
mov byte [esi], cl
mov ecx, dword [esp + 0x88]
lea esi, [esp + 3]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
mov byte [esi], cl
mov esi, dword [esp + 0x84]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ecx
mov ecx, dword [edx + 0x48]
imul esi, dword [ecx + 0x40], 0xff
xor ecx, ecx
cmp esi, eax
jb 0x4badf7
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 6
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x3c]
lea esi, [esp + 0x50]
mov dword [edx], ecx
mov ecx, esi
call fcn.004a2306
mov edi, dword [esi + 8]
xor edx, edx
inc edx
mov ecx, edi
call fcn.00494904
mov ebx, eax
mov ebp, edx
mov ecx, esi
push edi
call fcn.004b185c
pop ecx
movzx ecx, al
mov edx, 0x5538a4
call fcn.004aeb64
mov eax, dword [esp + 4]
mov dword [eax], ebx
mov dword [eax + 4], ebp
mov dword [eax + 8], edi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c0a00
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [edx + 4]
and dword [esp + 8], 0
and dword [esp + 0xc], 0
and dword [esp + 0x20], 0
and dword [esp + 0x1c], 0
and dword [esp + 0x28], 0
and dword [esp + 0x24], 0
and dword [esp + 0x30], 0
and dword [esp + 0x2c], 0
and dword [esp + 0x38], 0
and dword [esp + 0x34], 0
and dword [esp + 0x3c], 0
and dword [esp + 0x44], 0
mov dword [esp + 0x10], 4
mov dword [esp + 4], ecx
mov dword [esp + 0x40], 0x400010
test eax, eax
je 0x4c0a69
mov ecx, dword [edx + 8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0x10]
test eax, eax
je 0x4c0a8b
mov esi, dword [edx + 0x14]
xor ecx, ecx
test esi, esi
je 0x4c0a87
movzx edi, byte [eax]
inc eax
dec esi
or ecx, dword [edi*4 + 0x581320]
jmp 0x4c0a75
mov dword [esp + 0x30], ecx
mov ebp, dword [edx + 0x20]
mov esi, dword [edx + 0x1c]
lea edi, [ebp*4]
test ebp, ebp
je 0x4c0acc
xor edx, edx
cmp ebp, 0x20000000
setb al
jae 0x4c0b67
mov dl, al
mov ecx, edi
shl edx, 2
mov dword [esp], edx
call fcn.00420dff
mov ebx, eax
test eax, eax
jne 0x4c0acf
mov edx, dword [esp]
mov ecx, edi
jmp 0x4c0b74
push 4
pop ebx
xor eax, eax
mov ecx, edi
test ecx, ecx
je 0x4c0ae3
mov edx, dword [esi + eax*4]
add ecx, 0xfffffffc
mov dword [ebx + eax*4], edx
inc eax
jmp 0x4c0ad3
lea ecx, [esp + 0x10]
mov dword [ecx + 4], eax
lea eax, [esp + 8]
mov dword [ecx + 8], ebx
push 0
push eax
push 0
push 0
push ecx
push 0
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push 0
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x4c0b1a
mov ecx, dword [esp + 4]
and dword [ecx], 0
mov dword [ecx + 4], eax
jmp 0x4c0b4f
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov dword [esp], eax
push 0x10
pop ecx
push 4
pop edx
call fcn.00420dff
test eax, eax
je 0x4c0b6e
xor ecx, ecx
mov edx, dword [esp + 4]
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov esi, dword [esp]
mov dword [eax + 0xc], esi
mov dword [edx + 4], eax
mov byte [edx], 4
test ebp, ebp
je 0x4c0b5f
mov ecx, ebx
mov edx, edi
push 4
call fcn.00403a30
pop eax
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00416990
ud2
push 0x10
pop ecx
push 4
pop edx
call fcn.0050d210
ud2

Function at 0x4c1092
Capabilities:
Get remote cert context via schannel

Disassembly:
push esi
push eax
mov eax, esp
mov esi, ecx
and dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x4c10b1
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4c10ba
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 4
pop esi
ret
Function at 0x4c2ca2
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov esi, ecx
cmp dl, 4
jne 0x4c2d0e
mov eax, dword [0x58baac]
cmp eax, 3
jne 0x4c2e00
cmp word [ebp], 0
push 2
pop eax
push 0x17
pop ebx
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push 2
push ebx
call sub.ws2_32.dll_WSASocketW
mov edi, eax
cmp eax, 0xffffffff
je 0x4c2d29
cmp word [ebp], 0
je 0x4c2d7d
mov ecx, dword [ebp + 0x18]
movups xmm0, xmmword [ebp + 4]
lea eax, [ebp + 0x14]
add ebp, 0x1c
mov dword [esp], ecx
push 0x1c
pop ecx
mov bx, 0x17
jmp 0x4c2d8d
mov eax, edx
shr eax, 8
mov word [esi + 1], ax
mov eax, edx
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi], dl
mov dword [esi + 4], ebp
jmp 0x4c2df8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x4c2d41
cmp eax, 0x2726
jne 0x4c2de9
push 1
push 0
push 0
push 0
push 2
push ebx
call sub.ws2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x4c2de3
mov edi, eax
push 0
push 1
push eax
call sub.kernel32.dll_SetHandleInformation
test eax, eax
jne 0x4c2cea
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, ebx
jmp 0x4c2de9
lea eax, [ebp + 2]
add ebp, 6
xorps xmm0, xmm0
push 0x10
pop ecx
mov bx, 2
movzx ebp, word [ebp]
mov eax, dword [eax]
lea edx, [esp + 4]
mov word [edx], bx
rol bp, 8
mov word [edx + 2], bp
mov dword [edx + 4], eax
mov eax, dword [esp]
movups xmmword [edx + 8], xmm0
mov dword [edx + 0x18], eax
push ecx
push edx
push edi
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4c2dc5
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x4c2df8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi], cl
and word [esi + 1], 0
mov byte [esi + 3], cl
mov dword [esi + 4], eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4c2df8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], cl
mov byte [esi], cl
mov dword [esi + 4], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050ff20
jmp 0x4c2cc2

Function at 0x4c2e21
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
cmp word [edx], 0
mov esi, ecx
je 0x4c2e65
movsd xmm0, qword [edx + 4]
movsd xmm1, qword [edx + 0xc]
mov ebx, dword [edx + 0x14]
mov ebp, dword [edx + 0x18]
movzx edx, word [edx + 0x1c]
lea edi, [esi + 0x1c]
rol dx, 8
movsd qword [esi + 0x10], xmm1
movsd qword [esi + 8], xmm0
push 0x19
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esi + 0x18], ebp
push 0x1c
pop eax
mov cx, 0x17
jmp 0x4c2e89
mov ebx, dword [edx + 2]
movzx edx, word [edx + 6]
lea edi, [esi + 0x10]
rol dx, 8
push 0x1c
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
and dword [esi + 0xc], 0
and dword [esi + 8], 0
push 0x10
pop eax
mov cx, 2
mov word [esi], cx
mov word [esi + 2], dx
mov dword [esi + 4], ebx
mov dword [esi + 0x80], eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c32f1
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
sub esp, 8
mov esi, ecx
lea eax, [esp + 0x18]
push 4
push eax
push dword [esp + 0x1c]
push 0xffff
push edx
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x4c3322
mov edi, esp
mov ecx, edi
call fcn.004c089f
mov eax, dword [edi]
cmp al, 4
jne 0x4c3327
mov byte [esi], 4
jmp 0x4c3330
mov ecx, dword [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 8
pop esi
pop edi
ret