joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e094
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x41e1f3
push edi
mov edi, dword [ebp - 0xc]
cmp edi, ebx
je 0x41e1d8
push esi
cmp dword [edi + 4], 2
jne 0x41e172
cmp dword [edi + 0x18], ebx
je 0x41e172
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x41e172
cmp eax, 0x10
jb 0x41e172
push 0x20
call dword [section..data]
mov esi, eax
pop ecx
cmp esi, ebx
je 0x41e17f
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
pop eax
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [section..data]
pop ecx
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x41e188
push 0x10
push dword [edi + 0x18]
push eax
call fcn.00452230
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp eax, ebx
je 0x41e15d
push eax
call dword [0x48d00c]
pop ecx
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x41e198
cmp dword [ebp - 4], ebx
jne 0x41e165
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x41e16f
mov dword [eax + 0x1c], esi
mov dword [ebp - 0x10], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x41e0d3
jmp 0x41e1b1
mov dword [ebp - 8], 8
jmp 0x41e1b1
push esi
mov dword [ebp - 8], 8
call dword [0x48d004]
jmp 0x41e1b0
push dword [esi + 0x18]
mov dword [ebp - 8], 8
call dword [0x48d004]
push esi
call dword [0x48d004]
pop ecx
pop ecx
pop esi
cmp dword [ebp - 0xc], ebx
je 0x41e1c0
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], ebx
je 0x41e1d3
push dword [ebp - 4]
call fcn.0041e062
pop ecx
mov dword [ebp - 4], ebx
jmp 0x41e1e7
cmp dword [ebp - 4], ebx
jne 0x41e1e7
mov eax, 0x2af9
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret

Function at 0x421979
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x42199f
push 2
pop eax
leave
ret
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4219c6
push 2
pop esi
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
leave
ret
xor esi, esi
jmp 0x4219b6
Function at 0x4291dd
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
push str.Connected_for_receive
push 0x46c9b8
push dword [eax]
call fcn.0041ac80
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.004285af
test eax, eax
jne 0x42920c
mov eax, esi
jmp fcn.00428927
ret
Function at 0x429574
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
mov ebx, dword [edi]
push esi
mov esi, dword [edi + 0x6b8]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x80
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4295eb
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.00452230
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [esi + 0x148], eax
mov ecx, dword [esi + 0x14c]
cmp ecx, 4
jge 0x42961d
push str.Received_too_short_packet
push ebx
call fcn.0041acea
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp + 0x74]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e6cf
add ebp, 0x78
leave
ret
mov eax, dword [esi + 0x15c]
movzx dx, byte [eax]
movzx eax, byte [eax + 1]
shl dx, 8
movzx edx, dx
or edx, eax
mov dword [esi + 0xc], edx
sub edx, 3
je 0x4296b0
dec edx
je 0x429730
dec edx
je 0x42967e
dec edx
je 0x42965e
push str.Internal_error:_Unexpected_packet
push 0x47ae54
push ebx
call fcn.0041acea
jmp 0x42972d
mov eax, dword [esi + 0x15c]
add ecx, 0xfffffffe
inc eax
push ecx
inc eax
push eax
push esi
call fcn.00428720
add esp, 0xc
test eax, eax
je 0x429730
jmp 0x42960c
mov eax, dword [esi + 0x15c]
movzx cx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl cx, 8
movzx ecx, cx
or ecx, eax
mov eax, dword [esi + 0x15c]
add eax, 4
push eax
push 0x46c9b8
push ebx
mov dword [esi + 8], ecx
call fcn.0041ac80
jmp 0x42972d
cmp ecx, 4
jle 0x429730
mov eax, dword [esi + 0x15c]
movzx dx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl dx, 8
movzx edx, dx
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
jne 0x429730
mov eax, dword [esi + 0x15c]
add ecx, 0xfffffffc
push ecx
add eax, 4
push eax
push 1
push edi
call fcn.0041b046
add esp, 0x10
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42970d
push 5
mov eax, esi
call fcn.00429506
mov eax, dword [ebp - 0x14]
pop ecx
jmp 0x42960c
mov eax, dword [esi + 0x14c]
sub eax, 4
lea ecx, [ebx + 0x90]
cdq
add dword [ecx], eax
adc dword [ecx + 4], edx
push dword [ecx + 4]
push dword [ecx]
push ebx
call fcn.0042229a
add esp, 0xc
push edi
call fcn.0042246a
pop ecx
test eax, eax
je 0x42960a
push 5
mov eax, esi
call fcn.00429506
pop ecx
push 0x2a
pop eax
jmp 0x42960c
Function at 0x42ae11
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42ae48
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.0041acea
add esp, 0xc
jmp 0x42ae70
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x42ae63
shr eax, 8
test al, al
jne 0x42ae63
xor eax, eax
jmp 0x42ae73
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.0041acea
pop ecx
pop ecx
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e6cf
leave
ret

Function at 0x42af49
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov al, byte [ebp + 8]
push 0
mov byte [ebp - 3], al
push 3
lea eax, [ebp - 4]
mov esi, ecx
mov edi, dword [esi]
push eax
push dword [esi + 0x1a8]
mov byte [ebp - 4], 0xff
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x42af90
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0041acea
add esp, 0xc
mov edx, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, ebx
mov ebx, str.SENT
call fcn.0042ae7f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b636
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x890]
sub esp, 0x910
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp + 0x88c], eax
push esi
push edi
push 0x7f
xor edi, edi
lea eax, [ebp + 0x78d]
push edi
push eax
mov byte [ebp + 0x78c], 0
call fcn.00451d90
push 0x7f
lea eax, [ebp + 0x80d]
push edi
push eax
mov byte [ebp + 0x80c], 0
call fcn.00451d90
mov ecx, dword [ebx]
mov esi, dword [ecx + 0x164]
mov eax, dword [esi + 0x1eb4]
sub eax, dword [esi + 0x1eb0]
mov dword [ebp - 0x78], ecx
inc eax
inc eax
push eax
push 0x3c
lea eax, [esi + 0x1cb0]
push ecx
call fcn.0042b0fe
mov eax, dword [esi + 0x1eb0]
movzx ecx, byte [eax]
add esp, 0x24
inc eax
mov dword [esi + 0x1eb0], eax
cmp ecx, 0x18
je 0x42b7c9
cmp ecx, 0x23
je 0x42b7a8
cmp ecx, 0x27
jne 0x42b84b
push edi
push ecx
push 0xfa
mov edi, 0xff
push edi
push str._c_c_c_c
lea eax, [ebp - 0x74]
push 0x800
push eax
call fcn.0041eae2
mov esi, dword [esi + 0x1cac]
add esp, 0x1c
mov dword [ebp - 0x80], 4
jmp 0x42b77a
push dword [esi]
call fcn.00451f40
pop ecx
mov ecx, dword [ebp - 0x80]
inc eax
add eax, ecx
mov dword [ebp - 0x7c], eax
cmp eax, 0x7fa
jae 0x42b777
lea eax, [ebp + 0x80c]
push eax
lea eax, [ebp + 0x78c]
push eax
push str._127_____127s
push dword [esi]
call fcn.00453dd0
add esp, 0x10
test eax, eax
je 0x42b777
lea eax, [ebp + 0x80c]
push eax
push 1
lea eax, [ebp + 0x78c]
push eax
mov eax, dword [ebp - 0x80]
push 0
mov ecx, 0x800
sub ecx, eax
push str._c_s_c_s
push ecx
lea eax, [ebp + eax - 0x74]
push eax
call fcn.0041eae2
mov eax, dword [ebp - 0x7c]
add esp, 0x1c
mov dword [ebp - 0x80], eax
mov esi, dword [esi + 4]
test esi, esi
jne 0x42b709
mov eax, dword [ebp - 0x80]
push 0xf0
push edi
mov ecx, 0x800
sub ecx, eax
push str._c_c
push ecx
lea eax, [ebp + eax - 0x74]
push eax
call fcn.0041eae2
mov esi, dword [ebp - 0x80]
add esp, 0x14
inc esi
inc esi
jmp 0x42b809
add esi, 0x1c28
push esi
mov dword [ebp - 0x7c], esi
call fcn.00451f40
push 0xf0
mov edi, 0xff
push edi
push esi
push 0
push 0x23
jmp 0x42b7e8
add esi, 0x1c08
push esi
mov dword [ebp - 0x7c], esi
call fcn.00451f40
push 0xf0
mov edi, 0xff
push edi
push esi
push 0
push 0x18
push 0xfa
push edi
push str._c_c_c_c_s_c_c
mov esi, eax
lea eax, [ebp - 0x74]
push 0x800
push eax
add esi, 6
call fcn.0041eae2
add esp, 0x2c
push 0
push esi
lea eax, [ebp - 0x74]
push eax
push dword [ebx + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x42b837
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push dword [ebp - 0x78]
call fcn.0041acea
add esp, 0xc
add esi, 0xfffffffe
push esi
push 0x3e
push dword [ebp - 0x78]
lea eax, [ebp - 0x72]
call fcn.0042b0fe
add esp, 0xc
mov ecx, dword [ebp + 0x88c]
pop edi
xor ecx, ebp
pop esi
call fcn.0044e6cf
add ebp, 0x890
leave
ret
Function at 0x42ba8a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
mov edi, dword [eax + 0x164]
mov dword [ebp - 4], eax
jne 0x42bbd8
push ebx
push esi
lea ebx, [edi + 0x1cb0]
lea esi, [edi + 0x1eb0]
mov dword [esi], ebx
cmp ebx, esi
jae 0x42bac0
mov byte [ebx], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42bacb
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42bad6
mov byte [eax], 0x1f
inc dword [esi]
movzx eax, word [edi + 0x1ca8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
mov dword [ebp + 0xc], eax
movzx eax, word [edi + 0x1caa]
push eax
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x42bb08
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42bb15
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42bb1f
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42bb29
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42bb34
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x42bb3f
mov byte [eax], 0xf0
inc dword [esi]
mov ecx, dword [esi]
lea eax, [edi + 0x1eb4]
mov dword [eax], ecx
mov eax, ecx
sub eax, ebx
dec eax
dec eax
push eax
push 0x3e
push dword [ebp - 4]
lea eax, [edi + 0x1cb2]
mov dword [esi], ebx
call fcn.0042b0fe
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 0xc
push 0
push 3
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx + 0x1a8]
call esi
test eax, eax
jge 0x42bb96
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push dword [ebp - 4]
call fcn.0041acea
add esp, 0xc
lea eax, [edi + 0x1cb3]
push eax
push ebx
push 4
pop eax
call fcn.0042b862
pop ecx
pop ecx
push 0
push 2
add edi, 0x1cb7
push edi
push dword [ebx + 0x1a8]
call esi
pop esi
pop ebx
test eax, eax
jge 0x42bbd8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push dword [ebp - 4]
call fcn.0041acea
add esp, 0xc
pop edi
leave
ret
Function at 0x42c51c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x1ac]
mov esi, dword [edi]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x1c], eax
or ebx, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x42c573
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
push dword [ebp - 0x1c]
push edi
call fcn.0041d4e1
pop ecx
pop ecx
cmp ebx, 0xffffffff
jne 0x42c595
push str.Error_accept__ing_server_connect
push esi
call fcn.0041acea
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x42c5e7
push str.Connection_accepted_from_server_n
push esi
call fcn.0041ac80
and dword [edi + 0x3f0], 0
push 1
push ebx
mov dword [edi + 0x1ac], ebx
call fcn.00438bf3
xor ecx, ecx
inc ecx
mov dword [edi + 0x1bc], ecx
mov eax, dword [esi + 0x1e8]
add esp, 0x10
test eax, eax
je 0x42c5e5
push ecx
push ebx
push dword [esi + 0x1ec]
call eax
add esp, 0xc
test eax, eax
je 0x42c5e5
call fcn.0042c474
push 0x2a
jmp 0x42c592
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e6cf
leave
ret
Function at 0x42f37d
Capabilities:
Check http status code

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [esp + 0xc]
push edi
push 0x64
cdq
pop edi
idiv edi
mov ecx, dword [ebx]
xor esi, esi
cmp eax, 2
je 0x42f3a7
push str.Couldnt_set_desired_mode
push ecx
call fcn.0041acea
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x42f3ff
cmp dword [esp + 0x10], 0xc8
je 0x42f3c3
push dword [esp + 0x10]
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ecx
call fcn.0041ac80
add esp, 0xc
mov eax, dword [esp + 0x14]
cmp eax, 0x13
jne 0x42f3d4
push ebx
call fcn.0042f337
jmp 0x42f3fa
cmp eax, 0x14
jne 0x42f3e0
call fcn.0042ce57
jmp 0x42f3fb
cmp eax, 0x15
jne 0x42f3e9
push 0xd
jmp 0x42f3f0
cmp eax, 0x16
jne 0x42f3fd
push 0xe
push 1
mov eax, ebx
call fcn.0042ea11
pop ecx
pop ecx
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x439daa
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
mov ebx, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x224]
push edi
test eax, eax
jne 0x439dcb
mov eax, dword [esi + 0x30]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041a826
add esi, 0x20
sub esp, 0xc
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a84b
mov ecx, eax
mov eax, dword [ebp + 8]
mov esi, edx
cdq
add esp, 0x20
sub eax, ecx
sbb edx, esi
cmp dword [ebx + 0x218], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
je 0x439e60
lea eax, [ebp - 0x24]
push eax
call fcn.0041a826
mov esi, dword [ebp - 4]
add esi, 0x188
sub esp, 0xc
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a84b
mov ecx, eax
mov eax, dword [ebx + 0x218]
mov esi, edx
cdq
add esp, 0x20
sub eax, ecx
sbb edx, esi
cmp dword [ebp - 8], edx
jl 0x439e60
jg 0x439e5a
cmp dword [ebp - 0xc], eax
jb 0x439e60
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43af33
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x48dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 8
pop ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
push 0xf0000000
push 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
xor edi, edi
push edi
mov dword [ebp - 0x2c], eax
push edi
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x43af84
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044e6cf
leave
ret
push esi
push 0x14
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00451d90
mov eax, dword [ebp - 0x2c]
lea esi, [ebp - 0xc]
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 2
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], ebx
call fcn.0043aec2
mov eax, esi
push ebx
push eax
call fcn.0043f000
add esp, 0x14
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x43afe3
xor esi, esi
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
jmp 0x43af76
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x28]
call fcn.00452230
add esp, 0xc
push dword [ebp - 0x24]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push edi
push edi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor esi, esi
inc esi
jmp 0x43afd4
Function at 0x43b0de
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.00451f40
mov edi, eax
lea eax, [edi + edi]
push eax
mov dword [ebp - 0xc], eax
call dword [section..data]
mov esi, eax
xor ebx, ebx
pop ecx
pop ecx
cmp esi, ebx
jne 0x43b110
push 0x1b
pop eax
jmp 0x43b1ab
xor eax, eax
cmp edi, ebx
jbe 0x43b128
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
mov byte [esi + eax*2], cl
mov byte [esi + eax*2 + 1], bl
inc eax
cmp eax, edi
jb 0x43b116
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x43b193
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x43b189
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x10
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 5
push ebx
add edi, 0x10
push edi
call fcn.00451d90
push esi
call dword [0x48d004]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43d21a
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi]
cmp dword [eax + 4], 3
push edi
jne 0x43d23f
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x43d22e
xor eax, eax
pop edi
ret
push dword [eax + 8]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call ecx
jmp 0x43d272
cmp dword [esi + 8], 0
jne 0x43d260
push 0x47c3b4
push dword [eax + 8]
call fcn.0044f2c9
pop ecx
pop ecx
mov dword [esi + 8], eax
test eax, eax
jne 0x43d260
or eax, 0xffffffff
pop edi
ret
push dword [esi + 8]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.004518c7
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x43d292
mov eax, dword [esi + 8]
test eax, eax
je 0x43d28c
push eax
call fcn.0044f58e
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
ret
Function at 0x43f9b7
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
pop ecx
test edi, edi
je 0x43fa95
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov ecx, dword [esi + 0xc]
add ecx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], ecx
cmp ebx, dword [esi + 0x10]
jbe 0x43fa19
push eax
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov ebx, dword [edi + 8]
add ebx, dword [esi + 0xc]
push dword [edi + 4]
push ebx
call dword [esi + 8]
mov dword [ebp + 0xc], ebx
mov ebx, dword [esi + 0x14]
add esp, 0x18
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
and dword [ebp - 4], 0
pop ecx
pop ecx
test ebx, ebx
jbe 0x43fa68
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov al, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
push 1
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
push 1
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
inc ebx
mov dword [ebp + 0xc], ebx
call dword [esi + 4]
add esp, 0x18
dec dword [ebp - 8]
jne 0x43fa33
pop ebx
jmp 0x43fa8b
push 1
push 0x475e01
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x475e02
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x10]
jb 0x43fa6b
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x442909
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x44292d
cmp dword [edi + 0x54], 0
jne 0x44292d
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0044a153
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004428ca
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8