joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a2d0
Capabilities:
Terminate process

Disassembly:
push 0x439320
push 0x5dc240
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.004d1d80
add esp, 0x10
test eax, eax
je 0x43a2f6
push eax
call fcn.0059b255
mov al, byte [0x6312f8]
test al, al
jne 0x43a310
mov byte [0x630eb3], 1
mov dword [0x627770], 2
mov al, byte [0x627785]
test al, al
je 0x43a331
mov edx, dword [0x6277bc]
and edx, 0xfffffeff
or edx, 0x600
mov dword [0x6277bc], edx
push 2
push 0
call fcn.00446b60
mov eax, dword [0x6264c4]
add esp, 8
test eax, eax
je 0x43a34f
push eax
call fcn.00466bd0
add esp, 4
call fcn.0043a4c0
mov cl, byte [0x626c0c]
mov edx, dword [0x62673c]
test cl, cl
mov ecx, dword [0x626738]
sete al
mov byte [0x6289d6], al
mov byte [0x630eb0], al
mov eax, dword [0x626788]
mov dword [0x5f2bd4], edx
mov edx, dword [0x626e6c]
mov dword [0x5f4dc8], eax
mov eax, dword [0x626730]
mov dword [0x5f2bd0], ecx
mov ecx, dword [0x626734]
push edx
mov dword [0x5f2bc8], eax
mov dword [0x5f2bcc], ecx
call fcn.004cade0
mov edx, 1
mov ecx, eax
shl edx, cl
add esp, 4
mov dword [0x5f2bbc], edx
ret

Function at 0x43a4c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x200
push 0
push 0x627548
push 0x627548
call fcn.004ce6a0
push 0
push 0x627548
push 0x627548
call fcn.004d2e80
push 0x627548
call fcn.004d590e
mov cl, byte [eax - 1]
add esp, 0x1c
cmp cl, 0x5c
je 0x43a504
mov byte [eax], 0x5c
mov byte [eax + 1], 0
push esi
push 0
push 0x626168
push 0x626168
call fcn.004ce6a0
push 0
push 0x627440
push 0x627440
call fcn.004ce6a0
push 0x6244e8
push 0x627548
push 0x627548
call fcn.004d2d60
push 0x627548
push 0x626168
push 0x626168
call fcn.004d2d60
push 0x626168
push 0x627144
push 0x627144
call fcn.004d2d60
push str.share
call fcn.0043a3c0
mov esi, eax
add esp, 0x40
push esi
call fcn.004d1900
add esp, 4
test eax, eax
je 0x43a594
push 0x1ff
lea eax, [esp + 8]
push esi
push eax
call fcn.004d59fe
add esp, 0xc
jmp 0x43a5ae
push 0
push esi
push 0x627548
lea ecx, [esp + 0x10]
push 0x1ff
push ecx
call fcn.004d6430
add esp, 0x14
push 0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.004ce6a0
lea ecx, [esp + 0x10]
push ecx
push 0x627440
push 0x627440
call fcn.004d2d60
mov eax, dword [0x63131c]
mov esi, 0x626a0c
add esp, 0x18
cmp eax, esi
je 0x43a604
push 0
push str.charsets_
lea edx, [esp + 0xc]
push edx
push 0x1ff
push esi
call fcn.004d6430
add esp, 0x14
mov dword [0x63131c], esi
mov eax, dword [0x627864]
push 0
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004ce6a0
lea edx, [esp + 0x10]
sub eax, edx
inc eax
push 8
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004c6600
add esp, 0x18
test eax, eax
mov dword [0x627868], eax
pop esi
jne 0x43a63e
push 1
call fcn.0059b255
mov ecx, dword [0x628588]
test ecx, ecx
jne 0x43a663
push 8
push eax
call fcn.004c6640
add esp, 8
test eax, eax
mov dword [0x628588], eax
jne 0x43a663
push 1
call fcn.0059b255
mov al, byte [0x6273fc]
test al, al
jne 0x43a690
push 0x626168
call fcn.0043a7d0
add esp, 4
cmp eax, 1
jne 0x43a690
push 0x626168
push str.Warning:_Setting_lower_case_table_names1_becasue_file_system__s_is_case_insensitve
call fcn.00430ba0
add esp, 8
add esp, 0x200
ret
Function at 0x43bdc0
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x110]
push ebp
push esi
push 1
mov esi, ecx
push ebx
xor ebp, ebp
call fcn.0043c2b0
test eax, eax
jne 0x43bdec
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 0x18
push edi
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x43be2d
push str.Failed_to_install_the_service__Couldnt_open_the_SCM__n
call fcn.0059a00d
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 0x18
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
mov eax, dword [esi + 0x1c]
push ecx
mov ecx, dword [esi + 0x18]
push edx
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push eax
mov eax, dword [esp + 0x130]
xor edx, edx
cmp eax, 1
mov eax, dword [esi + 8]
setne dl
push ecx
mov ecx, dword [esi + 4]
add edx, 2
push edx
mov edx, dword [esp + 0x140]
push eax
push ecx
push edx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x43beab
push str.Failed_to_install_the_service__Couldnt_create_service__n
call fcn.0059a00d
add esp, 4
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 0x18
push str.Service_successfully_installed._n
call fcn.0059a00d
add esp, 4
push esi
call ebx
push edi
mov ebp, 1
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 0x18

Function at 0x43bee0
Capabilities:
Delete service

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push ebp
mov esi, ecx
push ebx
call fcn.0043c2b0
test eax, eax
jne 0x43befc
pop esi
pop ebp
pop ebx
ret 4
push edi
push 2
push ebp
push ebp
mov dword [esi + 0xd0], ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
jne 0x43bf29
push str.Failed_to_remove_the_service__Couldnt_open_the_SCM__n
call fcn.0059a00d
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
push 0x10000
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebp
je 0x43bf8a
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x43bf69
push str.Failed_to_remove_the_service_n
call fcn.0059a00d
add esp, 4
push esi
call ebx
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
push str.Service_successfully_removed._n
call fcn.0059a00d
add esp, 4
push esi
mov ebp, 1
call ebx
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
push str.Failed_to_remove_the_service__Couldnt_open_the_service__n
call fcn.0059a00d
add esp, 4
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
Function at 0x43c130
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xf0]
push esi
push 0
push eax
call fcn.0059b411
add esp, 0xc
test eax, eax
mov dword [esi + 0xec], eax
jne 0x43c151
pop esi
ret
mov eax, 1
mov dword [esi + 0xe8], eax
pop esi
ret

Function at 0x43c2b0
Capabilities:
Query service configuration
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push 2
xor ebp, ebp
push ebp
push ebp
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x43c31d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x43c305
push str.Install_Remove_of_the_Service_Denied__n
call fcn.0059a00d
add esp, 4
mov ecx, esi
call fcn.0043c500
test eax, eax
jne 0x43c2fa
push str.That_operation_should_be_made_by_an_user_with_Administrator_privileges__n
call fcn.0059a00d
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
push str.There_is_a_problem_for_to_open_the_Service_Control_Manager__n
call fcn.0059a00d
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x30]
push edi
cmp eax, 1
mov eax, dword [esp + 0x30]
push 0xf01ff
push eax
push ebx
jne 0x43c3a5
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x43c38d
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.The_service_already_exists__n
mov edi, eax
call fcn.0059a00d
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push 0x1000
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x43c381
mov edx, dword [edi + 0xc]
push edx
push str.The_current_server_installed:__s_n
call fcn.0059a00d
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x43c41f
push ebx
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x43c3d1
push str.The_service_doesnt_exist__n
call fcn.0059a00d
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
xor eax, eax
mov ecx, 7
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x43c41f
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x43c406
push str.Failed_to_remove_the_service_because_the_service_is_running_nStop_the_service_and_try_again_n
call fcn.0059a00d
add esp, 4
jmp 0x43c41f
cmp eax, 3
jne 0x43c41a
push str.Failed_to_remove_the_service_because_the_service_is_in_stop_pending_state__nWait_30_seconds_and_try_again._nIf_this_condition_persist__reboot_the_machine_and_try_again_n
call fcn.0059a00d
add esp, 4
jmp 0x43c41f
mov ebp, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x43c500
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x414
push ebx
push esi
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
push 1
push 8
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x43c576
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x43c555
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
lea ecx, [esp + 0x10]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43c576
pop esi
pop ebx
add esp, 0x414
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x400
lea eax, [esp + 0x24]
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x43c5ae
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x43c5da
pop esi
pop ebx
add esp, 0x414
ret
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
xor esi, esi
cmp eax, ebx
push edi
jbe 0x43c613
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esp + 0x28]
mov edx, dword [edi]
mov eax, dword [esp + 0x1c]
push edx
push eax
call ebx
test eax, eax
jne 0x43c60e
mov eax, dword [esp + 0x24]
inc esi
add edi, 8
cmp esi, eax
jb 0x43c5f2
jmp 0x43c613
mov ebp, 1
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x414
ret
Function at 0x441c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
test eax, eax
push ebx
push esi
push edi
je 0x441d18
cmp byte [eax], 0
je 0x441d18
mov edi, dword [ebp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
mov esi, edi
call fcn.00441af0
mov ebx, dword [ebp + 0xc]
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.00441af0
mov al, byte [ebp + 0x14]
add esp, 0x10
test al, al
je 0x441c80
mov edx, dword [esp + 0x10]
xor edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00441d30
add esp, 8
jmp 0x441ca1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor ecx, eax
push ecx
xor edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00441a60
add esp, 0xc
mov cl, byte [ebx]
inc ebx
test cl, cl
je 0x441cd9
lea edx, [esp + 0x20]
push edx
call fcn.00441aa0
fmul qword [0x5b0168]
push ecx
fstp qword [esp]
call fcn.005997cd
fadd qword [0x5b0160]
add esp, 8
call fcn.0059989c
mov byte [edi], al
mov al, byte [ebx]
inc edi
inc ebx
test al, al
jne 0x441ca8
mov al, byte [ebp + 0x14]
test al, al
jne 0x441d1b
lea ecx, [esp + 0x20]
push ecx
call fcn.00441aa0
fmul qword [0x5b0168]
push ecx
fstp qword [esp]
call fcn.005997cd
add esp, 8
call fcn.0059989c
cmp esi, edi
je 0x441d1b
xor byte [esi], al
inc esi
cmp esi, edi
jne 0x441d05
mov byte [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dec0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x45df13
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.00441aa0
fmul qword [0x5aa3c8]
add esp, 4
call fcn.0059989c
xor dword [esi + 0x230], eax
mov dl, byte [esi + 0x230]
xor eax, eax
mov al, byte [edi]
mov cl, byte [esi + eax + 0x130]
xor cl, dl
mov byte [edi], cl
mov ecx, dword [esi + 0x230]
xor ecx, eax
inc edi
dec ebx
mov dword [esi + 0x230], ecx
jne 0x45ded1
pop edi
pop esi
pop ebx
ret 8

Function at 0x45df20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x45df7b
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.00441aa0
fmul qword [0x5aa3c8]
add esp, 4
call fcn.0059989c
mov ecx, dword [esi + 0x230]
xor ecx, eax
mov dword [esi + 0x230], ecx
mov eax, ecx
xor ecx, ecx
mov cl, byte [edi]
xor ecx, eax
xor eax, eax
mov al, byte [ecx + esi + 0x30]
mov byte [edi], al
mov edx, dword [esi + 0x230]
and eax, 0xff
xor edx, eax
inc edi
dec ebx
mov dword [esi + 0x230], edx
jne 0x45df31
pop edi
pop esi
pop ebx
ret 8
Function at 0x4644e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xe0]
mov cl, byte [esi]
xor edx, edx
xor eax, eax
push edi
mov edi, dword [esp + 0x18]
mov dl, byte [ecx + 0x5ec178]
mov ax, word [ecx*2 + 0x5ebf78]
mov ecx, edx
add eax, 0x2ca1e0
cmp ecx, edi
lea edx, [esi + 1]
jle 0x464518
mov ecx, edi
dec ecx
test ecx, ecx
jle 0x46453a
mov ebp, ecx
xor ecx, ecx
mov cl, byte [edx]
xor ebx, ebx
mov bx, word [ecx*2 + 0x5ebf78]
lea ecx, [ebx + eax*2]
xor eax, ecx
inc edx
dec ebp
jne 0x46451f
mov ebp, dword [esp + 0x14]
and eax, 0x7fffff
xor edx, edx
mov ecx, 0x134f
div ecx
xor eax, eax
mov ax, word [edx*2 + 0x5ec278]
cmp eax, 0x159
jb 0x46457b
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x46466d
cmp eax, 0x7fff
jae 0x4645ea
add eax, 0xfffffea7
shl eax, 4
add eax, 0x5eb6a8
jmp 0x464583
shl eax, 4
add eax, 0x5ea118
cmp edi, dword [eax + 8]
jne 0x4645ea
test edi, edi
mov ecx, dword [eax]
lea edx, [edi - 1]
mov dword [esp + 0x18], edx
je 0x4645c4
mov ebp, esi
sub ebp, ecx
xor ebx, ebx
mov bl, byte [ecx]
xor edx, edx
mov dl, byte [ecx + ebp]
inc ecx
mov bl, byte [ebx + 0x5ea018]
cmp byte [edx + 0x5ea018], bl
jne 0x4645c0
mov edx, dword [esp + 0x18]
mov ebx, edx
dec edx
test ebx, ebx
mov dword [esp + 0x18], edx
jne 0x464599
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc ecx
test ecx, ecx
jne 0x4645ea
test eax, eax
je 0x4645ea
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], esi
mov edx, dword [ebp + 8]
mov dword [edx + 8], edi
mov eax, dword [eax + 4]
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46466d
mov eax, dword [0x6273f4]
test eax, eax
je 0x46466d
push 0
push edi
push esi
call fcn.004855e0
add esp, 0xc
test eax, eax
je 0x46466d
mov ecx, dword [ebp + 0x1f8]
mov dword [ecx + 0x830], 0
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [eax + 8]
sub ecx, 0
je 0x464658
dec ecx
je 0x464643
dec ecx
jne 0x46466d
mov eax, dword [eax + 0xc]
dec eax
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0xfffffffd
pop ebp
add eax, 0x274
pop ebx
ret
mov eax, dword [eax + 0xc]
dec eax
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0xfffffffd
pop ebp
add eax, 0x273
pop ebx
ret
mov eax, dword [eax + 0xc]
dec eax
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0xfffffffd
pop ebp
add eax, 0x272
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x498960
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x30], 3
push 0
jne 0x498992
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49898d
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
ret

Function at 0x4989b0
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x30], 3
push 0
jne 0x4989e2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4989dd
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
ret

Function at 0x498a30
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx + 0x30]
xor eax, eax
cmp edx, 3
mov dword [esp], eax
je 0x498a67
cmp byte [esp + 0xc], al
je 0x498a51
mov dword [esp], 1
mov ecx, dword [ecx]
push 4
lea eax, [esp + 4]
push eax
push 8
push 0xffff
push ecx
call sub.WSOCK32.dll_setsockopt
pop ecx
ret

Function at 0x498be0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
push 4
lea eax, [eax + eax*4]
lea ecx, [esp + 0xc]
push ecx
shl eax, 3
push 0x1006
mov dword [esp + 0x14], eax
mov eax, dword [edx]
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
ret
Function at 0x4b7190
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov eax, dword [esp + 0xc]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0x148]
push ebp
mov ebp, dword [esp + 0x14]
shl edx, 4
push edi
mov edi, dword [eax + edx + 0x18]
xor eax, eax
mov al, byte [edi]
test al, al
mov dword [esp + 8], ebp
mov dword [esp + 0x18], edi
je 0x4b72a3
push ebx
push esi
mov cl, byte [edi + 2]
xor ebx, ebx
mov bx, word [edi + 8]
and eax, 0xff
test cl, cl
je 0x4b71f4
mov edx, dword [edi + 0x10]
mov esi, dword [esp + 0x24]
test byte [edx + esi], cl
je 0x4b71ef
mov byte [ebp], 0
inc ebp
jmp 0x4b728f
mov byte [ebp], 1
inc ebp
mov ecx, dword [esp + 0x24]
mov esi, dword [edi + 0xc]
add esi, ecx
mov cx, word [edi + 6]
test cl, 1
je 0x4b7232
add ebx, esi
cmp eax, 7
je 0x4b7220
cmp ebx, esi
jbe 0x4b722e
cmp byte [ebx - 1], 0x20
jne 0x4b722e
dec ebx
cmp ebx, esi
ja 0x4b7211
sub ebx, esi
jmp 0x4b726b
cmp esi, ebx
jae 0x4b722e
cmp byte [esi], 0x20
jne 0x4b722e
inc esi
cmp esi, ebx
jb 0x4b7224
sub ebx, esi
jmp 0x4b726b
test cl, 8
je 0x4b7245
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp ebx, eax
jbe 0x4b726b
jmp 0x4b7269
test cl, 0x20
je 0x4b72db
xor ecx, ecx
mov cl, byte [edi + 3]
push esi
push ecx
call fcn.004bbda0
xor edx, edx
mov dl, byte [edi + 3]
add esp, 8
cmp ebx, eax
mov esi, dword [edx + esi]
jbe 0x4b726b
mov ebx, eax
cmp ebx, 0xff
jae 0x4b72c7
mov byte [ebp], bl
inc ebp
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
add ebp, ebx
mov al, byte [edi + 0x18]
add edi, 0x18
test al, al
mov dword [esp + 0x20], edi
jne 0x4b71c7
pop esi
pop ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
push ecx
push ebp
push edx
call fcn.004be1b0
mov ecx, dword [esp + 0x18]
add esp, 0x10
mov eax, ebp
pop edi
sub eax, ecx
pop ebp
pop ecx
ret
mov byte [ebp], 0xff
mov eax, ebx
shr eax, 8
mov byte [ebp + 2], bl
mov byte [ebp + 1], al
add ebp, 3
jmp 0x4b7277
test cl, 0x40
je 0x4b7277
cmp eax, 5
jne 0x4b731a
mov ecx, dword [esi]
mov dword [esp + 0x1c], ecx
fld dword [esp + 0x1c]
sub esp, 8
fstp qword [esp]
call fcn.00599364
add esp, 8
test eax, eax
je 0x4b734b
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4b7289
cmp eax, 6
jne 0x4b734b
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push ecx
push eax
call fcn.00599364
add esp, 8
test eax, eax
je 0x4b734b
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4b7289
add esi, ebx
mov eax, ebx
dec ebx
test eax, eax
je 0x4b728f
inc ebx
mov cl, byte [esi - 1]
dec esi
mov byte [ebp], cl
inc ebp
dec ebx
jne 0x4b7359
jmp 0x4b728f
Function at 0x4c6560
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x4c6570
mov esi, 1
push esi
call fcn.0059a181
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4c65c2
call fcn.00599936
mov edi, eax
call fcn.004c7060
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x4c65a6
mov edx, dword [fcn.004cc2c0]
mov dword [fcn.004cc2c0], edx
test al, 0x18
je 0x4c65b7
push esi
push 0x24
push 5
call fcn.004c6390
add esp, 0xc
test edi, edi
je 0x4c65dd
push 1
call fcn.0059b255
test byte [esp + 0x14], 0x20
je 0x4c65dd
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4c68f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.00599936
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.005a38a0
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4c69ea
call fcn.00599936
cmp dword [eax], 0
je 0x4c6937
call fcn.00599936
mov ebp, dword [eax]
jmp 0x4c693a
or ebp, 0xffffffff
call fcn.004c7060
test esi, esi
mov dword [eax], ebp
jne 0x4c694f
call fcn.00599936
cmp dword [eax], 4
je 0x4c699f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x4c6982
cmp esi, 0xffffffff
je 0x4c69c4
test al, 6
je 0x4c6982
call fcn.004c7060
mov ecx, dword [eax]
push ecx
push ebx
call fcn.004d3fc0
add esp, 4
push eax
push 0x24
push 9
call fcn.004c6390
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x4c69e2
test al, 6
je 0x4c6990
test ah, 2
je 0x4c69e2
test esi, esi
jbe 0x4c69ee
test ah, 2
je 0x4c69ee
add dword [esp + 0x18], esi
sub edi, esi
call fcn.00599936
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.005a38a0
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4c69ea
jmp 0x4c6924
call fcn.004c7060
mov eax, dword [eax]
push eax
push ebx
call fcn.004d3fc0
add esp, 4
push eax
push 0x24
push 2
call fcn.004c6390
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x4c69fb
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x4c6a04
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret