joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a951
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0x10]
push 0x101f941c
push eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], edi
call fcn.101d5541
mov esi, eax
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 0x4c], esi
cmp esi, ebx
jne 0x1001a9b3
cmp dword [ebp - 0x34], ebx
je 0x1001a9ac
call fcn.101d5432
push dword [eax]
call fcn.101d5323
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
call fcn.1001a762
xor al, al
jmp 0x1001aa9c
cmp edi, ebx
je 0x1001a9be
mov eax, dword [edi]
mov dword [ebp - 0x44], eax
jmp 0x1001a9c1
mov dword [ebp - 0x44], ebx
xor eax, eax
push 9
mov word [ebp - 0x2c], ax
pop ecx
lea edi, [ebp - 0x2a]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x38]
stosw word es:[edi], ax
call fcn.1001a243
push 2
push ebx
push esi
call fcn.101d5276
push esi
call fcn.101d517e
push ebx
push ebx
push esi
mov dword [ebp - 0x30], eax
call fcn.101d5276
add esp, 0x1c
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], ebx
jle 0x1001aa68
push dword [ebp - 0x30]
call fcn.101d49c3
mov edi, eax
pop ecx
mov dword [ebp - 0x40], edi
cmp edi, ebx
je 0x1001aa68
push esi
push 1
push dword [ebp - 0x30]
push edi
call fcn.101d4fc4
add esp, 0x10
cmp eax, 1
jne 0x1001aa5f
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push dword [ebp - 0x30]
push edi
push ebx
mov edi, 0xfde9
push edi
call esi
mov ecx, dword [ebp - 0x38]
push eax
push eax
mov dword [ebp - 0x3c], eax
call fcn.1001a41a
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x40]
push ebx
push edi
call esi
push dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
call fcn.1001a278
mov esi, dword [ebp - 0x4c]
push dword [ebp - 0x40]
call fcn.101d3f54
pop ecx
cmp dword [ebp - 0x34], ebx
je 0x1001aa87
push dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
push str._s_d_bytes_to__d_wide_chars
push dword [ebp - 0x34]
call fcn.1001a8ff
add esp, 0x14
push esi
call fcn.101d4ca8
mov eax, dword [ebp - 0x48]
pop ecx
cmp eax, ebx
je 0x1001aa9a
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d14d7
leave
ret

Function at 0x1001c218
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.101d19d0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x7c], 6
ja 0x1001c269
jne 0x1001c267
cmp dword [ebp - 0x78], eax
jae 0x1001c269
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.101d14d7
add ebp, 0x98
leave
ret
Function at 0x1001d197
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.101d19d0
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.101d19d0
add esp, 0x18
test edi, edi
je 0x1001d237
push edi
call fcn.101d3aeb
pop ecx
test eax, eax
jbe 0x1001d237
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1001d237
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x101f9824
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.1001d140
add esp, 0x14
test eax, eax
jl 0x1001d237
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1001d239
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.101d14d7
leave
ret

Function at 0x1001d246
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x18], 0
test ebx, ebx
jne 0x1001d259
push 0x57
pop eax
leave
ret
push edi
mov edi, str.wintrust.dll
call fcn.1001d197
mov edi, eax
test edi, edi
jne 0x1001d280
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001d337
push 0x7e
pop eax
jmp 0x1001d337
push esi
call fcn.1001c218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinVerifyTrust
push edi
mov dword [ebp - 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebp - 4], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebp - 8], eax
call esi
push str.WTHelperGetProvCertFromChain
push edi
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 4], eax
je 0x1001d2e4
cmp dword [ebp - 8], eax
je 0x1001d2e4
cmp dword [ebp - 0xc], eax
je 0x1001d2e4
cmp dword [ebp - 0x10], eax
je 0x1001d2e4
cmp dword [ebp - 0x14], eax
jne 0x1001d2fe
push str.WintrustLoadFunctionPointers
push edi
call esi
mov esi, eax
test esi, esi
jne 0x1001d303
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1001d2f3
push 0x7f
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x1001d336
mov esi, dword [ebp - 0x18]
jmp 0x1001d305
xor eax, eax
push 0x18
push eax
push ebx
call fcn.101d19d0
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
cmp dword [ebp - 0x14], 0
mov dword [ebx], edi
mov dword [ebx + 0x10], eax
jne 0x1001d334
mov dword [ebx + 0x14], esi
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x1001dced
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xf8
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x7c]
xor ecx, ecx
push ebx
push esi
mov dword [ebp - 0x8c], eax
cmp edi, ecx
je 0x1001dea1
cmp dword [ebp + 0x78], ecx
jl 0x1001dea1
jg 0x1001dd2b
cmp dword [ebp + 0x74], ecx
jbe 0x1001dea1
cmp eax, ecx
je 0x1001dea1
cmp dword [ebp + 0x78], ecx
mov ebx, 0xf0
jg 0x1001dd4e
jl 0x1001dd44
cmp dword [ebp + 0x74], ebx
ja 0x1001dd4e
mov eax, 0x22000009
jmp 0x1001dea6
push ebx
push ecx
lea eax, [ebp - 0x88]
push eax
call fcn.101d19d0
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x88]
push 0x40
push eax
call fcn.101d4fc4
add esp, 0x1c
cmp eax, esi
je 0x1001dd80
mov eax, 0x22000005
jmp 0x1001dea6
push 2
lea eax, [ebp - 0x88]
push 0x101f9a70
push eax
call fcn.101d2211
add esp, 0xc
test eax, eax
jne 0x1001dd44
movzx eax, byte [ebp - 0x49]
movzx ecx, byte [ebp - 0x4a]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x4b]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x4c]
shl eax, 8
or eax, ecx
xor ecx, ecx
cmp dword [ebp + 0x78], ecx
jg 0x1001ddcb
jl 0x1001dd44
cmp dword [ebp + 0x74], eax
jbe 0x1001dd44
push 0
push eax
push edi
call fcn.101d5276
add esp, 0xc
test eax, eax
jl 0x1001dd76
push edi
push esi
lea eax, [ebp - 0x48]
push 4
push eax
call fcn.101d4fc4
add esp, 0x10
cmp eax, esi
jne 0x1001dd76
push 4
lea eax, [ebp - 0x48]
push 0x101f9a68
push eax
call fcn.101d2211
add esp, 0xc
test eax, eax
jne 0x1001dd44
push edi
push esi
lea eax, [ebp - 0x44]
push 0x14
push eax
call fcn.101d4fc4
add esp, 0x10
cmp eax, esi
jne 0x1001dd76
push edi
push esi
lea eax, [ebp - 0x30]
push 2
push eax
call fcn.101d4fc4
add esp, 0x10
cmp eax, esi
jne 0x1001dd76
movzx ax, byte [ebp - 0x2f]
movzx cx, byte [ebp - 0x30]
shl ax, 8
or ax, cx
mov ecx, 0x20b
cmp ax, cx
jne 0x1001de8a
push edi
push esi
push 0x96
lea eax, [ebp - 0x2e]
push eax
call fcn.101d4fc4
add esp, 0x10
cmp eax, esi
jne 0x1001dd76
push ebx
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x8c]
call fcn.101d1c90
add esp, 0xc
xor eax, eax
jmp 0x1001dea6
mov ecx, 0x10b
cmp ax, cx
jne 0x1001dd44
push edi
push esi
push 0x86
jmp 0x1001de5c
mov eax, 0x22000001
mov ecx, dword [ebp + 0x68]
pop esi
xor ecx, ebp
pop ebx
call fcn.101d14d7
add ebp, 0x6c
leave
ret
Function at 0x1003a9b9
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x18], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor eax, eax
inc eax
ret

Function at 0x1003bd91
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp edi, eax
je 0x1003be54
cmp dword [ebp + 0xc], eax
jl 0x1003be54
jg 0x1003bdbf
cmp dword [ebp + 8], eax
jbe 0x1003be54
cmp ebx, eax
je 0x1003be54
cmp dword [ebp + 0xc], eax
jg 0x1003bddb
jl 0x1003bdd4
cmp dword [ebp + 8], 0x3c
jae 0x1003bddb
mov eax, 0x22000009
jmp 0x1003be59
push 0x3c
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.101d19d0
push edi
push 1
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.101d4fc4
add esp, 0x1c
cmp eax, 1
je 0x1003be04
mov eax, 0x22000005
jmp 0x1003be59
push 4
lea eax, [ebp - 0x40]
push str.MSCF
push eax
call fcn.101d2211
add esp, 0xc
test eax, eax
jne 0x1003bdd4
test byte [ebp - 0x22], 4
jne 0x1003be28
mov eax, 0x2200000e
jmp 0x1003be59
movzx ax, byte [ebp - 0x1b]
movzx cx, byte [ebp - 0x1c]
shl ax, 8
or ax, cx
push 0x14
pop ecx
cmp cx, ax
jne 0x1003be21
push 0x3c
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.101d1c90
add esp, 0xc
xor eax, eax
jmp 0x1003be59
mov eax, 0x22000001
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d14d7
leave
ret
Function at 0x10042670
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.101d14f0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10074310
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
push 0x62
mov edx, dword [ebp + 0xc]
push edx
call fcn.101d5c00
add esp, 8
test eax, eax
jne 0x100426b2
mov eax, dword [ebp - 4]
or eax, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x10042761
call fcn.1005ca30
push str.BIO_new_file
push 0x43
push str.....Srcopenssl_3.0.12crypto_bio_bss_file.c
call fcn.1005cae0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.1005cc10
add esp, 0x14
call fcn.101d5432
cmp dword [eax], 2
je 0x10042707
call fcn.101d5432
cmp dword [eax], 6
jne 0x10042733
call fcn.1005ca30
push str.BIO_new_file
push 0x4b
push str.....Srcopenssl_3.0.12crypto_bio_bss_file.c
call fcn.1005cae0
add esp, 0xc
push 0
push 0x80
push 0x20
call fcn.1005cc10
add esp, 0xc
jmp 0x1004275d
call fcn.1005ca30
push str.BIO_new_file
push 0x4d
push str.....Srcopenssl_3.0.12crypto_bio_bss_file.c
call fcn.1005cae0
add esp, 0xc
push 0
push 0x80002
push 0x20
call fcn.1005cc10
add esp, 0xc
xor eax, eax
jmp 0x100427af
call fcn.10042820
push eax
call fcn.10041600
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10042788
mov eax, dword [ebp - 8]
push eax
call fcn.101d4ca8
add esp, 4
xor eax, eax
jmp 0x100427af
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100418a0
add esp, 8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x6a
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100421d0
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100429d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.101d14f0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x10042a44
cmp dword [ebp + 0xc], 0
je 0x10042a44
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
and edx, 0
je 0x10042a1c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.101d56ba
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x10042a38
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.101d56ba
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10042a44
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10067170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.101d14f0
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
jmp 0x1006719f
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x100671c6
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor edx, ecx
movzx eax, byte [ebp - 1]
or eax, edx
mov byte [ebp - 1], al
jmp 0x10067196
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x10072fa0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.101d14f0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007306f
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x1007304f
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x1007304f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x1007300c
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x1007304f
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10072d30
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x10073042
mov eax, 8
jmp 0x100730b5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x10073003
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.101d8394
add esp, 0x10
xor eax, eax
jmp 0x100730b5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x1007308d
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x100730bc]
mov eax, 0x2af9
jmp 0x100730b5
mov eax, 0x2afa
jmp 0x100730b5
mov eax, 0x2afb
jmp 0x100730b5
mov eax, 0x2af9
jmp 0x100730b5
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10074040
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1027b480], 0
jne 0x100740e3
mov dword [0x1027b480], 1
push 0x190
push 0
push 0x1027b2f0
call fcn.101d19d0
add esp, 0xc
push 0x1027b2f0
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100740e3
call fcn.1005ca30
push str.BIO_sock_init
push 0x94
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock.c
call fcn.1005cae0
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.1005cc10
add esp, 0xc
call fcn.1005ca30
push str.BIO_sock_init
push 0x96
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock.c
call fcn.1005cae0
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.1005cc10
add esp, 0xc
or eax, 0xffffffff
jmp 0x100740e8
mov eax, 1
pop ebp
ret

Function at 0x10074110
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.101d14f0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x1007416a
call fcn.1005ca30
push str.BIO_socket_ioctl
push 0xd1
push str.....Srcopenssl_3.0.12crypto_bio_bio_sock.c
call fcn.1005cae0
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.1005cc10
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100741d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11c
call fcn.101d14f0
cmp dword [ebp + 8], 0
jl 0x100741e9
cmp dword [ebp + 8], 0x40
jl 0x100741f1
or eax, 0xffffffff
jmp 0x1007430c
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
jne 0x10074203
mov eax, 1
jmp 0x1007430c
push 0
call fcn.10050110
add esp, 4
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], edx
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x114]
jg 0x10074238
jl 0x10074231
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x118]
jae 0x10074238
xor eax, eax
jmp 0x1007430c
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x11c], 0
jmp 0x1007425d
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [ebp - 0x110]
jae 0x10074281
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp + edx*4 - 0x10c]
cmp eax, dword [ebp + 8]
jne 0x1007427f
jmp 0x10074281
jmp 0x1007424e
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [ebp - 0x110]
jne 0x100742b7
cmp dword [ebp - 0x110], 0x40
jae 0x100742b7
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x10c], eax
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
xor edx, edx
jne 0x10074242
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x118]
mov ecx, dword [ebp + 0x14]
sbb ecx, dword [ebp - 0x114]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x110]
and eax, ecx
push eax
mov edx, dword [ebp + 0xc]
neg edx
sbb edx, edx
lea eax, [ebp - 0x110]
and edx, eax
push edx
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov esp, ebp
pop ebp
ret
Function at 0x10097df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.101d14f0
mov dword [ebp - 4], 0
jmp 0x10097e0f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x10097e2f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp eax, edx
jne 0x10097e2f
jmp 0x10097e06
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x10097e43
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jl 0x10097e69
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
test eax, eax
jne 0x10097e69
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xff
jne 0x10097e69
jmp 0x10097e3a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jge 0x10097e79
or eax, 0xffffffff
jmp 0x10097f46
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jle 0x10097e8c
mov eax, dword [ebp - 4]
shl eax, 3
jmp 0x10097f46
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x7e
ja case.0x10097ec3.1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x10097f6c]
jmp dword [eax*4 + 0x10097f4c]
mov dword [ebp - 0xc], 7
jmp 0x10097f0e
mov dword [ebp - 0xc], 6
jmp 0x10097f0e
mov dword [ebp - 0xc], 5
jmp 0x10097f0e
mov dword [ebp - 0xc], 4
jmp 0x10097f0e
mov dword [ebp - 0xc], 3
jmp 0x10097f0e
mov dword [ebp - 0xc], 2
jmp 0x10097f0e
mov dword [ebp - 0xc], 1
jmp 0x10097f0e
or eax, 0xffffffff
jmp 0x10097f46
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
jne 0x10097f36
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
movzx ecx, byte [ebp - 5]
cmp edx, ecx
je 0x10097f3d
or eax, 0xffffffff
jmp 0x10097f46
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea eax, [eax + edx*8]
mov esp, ebp
pop ebp
ret
Function at 0x100b1eb0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18
call fcn.101d14f0
mov dword [ebp - 8], 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.100b22f0
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100b26f0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100b1f5c
mov dword [ebp - 0x14], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100b1f36
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x100b1f2a
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
shl eax, 3
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100b27a0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.100b2290
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100b1f6a
mov eax, dword [ebp - 8]
jmp 0x100b201c
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.100b22f0
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100b26f0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100b2005
mov dword [ebp - 0x18], 0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100b1fdf
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x100b1fd3
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x18]
shl ecx, 3
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100b27a0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.100b2290
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100b2010
mov eax, dword [ebp - 8]
jmp 0x100b201c
mov edx, dword [ebp + 8]
push edx
call fcn.100b2290
add esp, 4
mov esp, ebp
pop ebp
ret