joyce8/EMBER2024-capa huggingface dataset:
Function at 0x552ee0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x58736c], 0
jne 0x552f61
cmp dword [0x58738c], 0
jne 0x552f10
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x58738c], eax
test eax, eax
jne 0x552f10
push str.GetEnvironmentStrings_failed
call fcn.005526fc
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x58738c]
jmp 0x552f24
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0054bfac
pop ecx
mov edi, eax
test eax, eax
jne 0x552f1c
lea edi, [ebp + 1]
push edi
call fcn.0054b844
pop ecx
mov ebx, eax
mov dword [0x587370], ebx
test ebx, ebx
jne 0x552f4e
xor eax, eax
jmp 0x553024
push edi
mov edx, dword [0x58738c]
push edx
push ebx
call fcn.0054be10
add esp, 0xc
jmp 0x552f81
xor esi, esi
mov ebx, dword [0x58736c]
jmp 0x552f7b
push eax
call fcn.0054bfac
pop ecx
test eax, eax
jne 0x552f77
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x552f6b
lea ebx, [esi + 4]
push 4
mov dword [0x587374], ebx
inc ebx
push ebx
call fcn.0054b000
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x552fa4
xor eax, eax
jmp 0x553024
cmp dword [0x58736c], 0
jne 0x552fd5
xor esi, esi
mov ebx, dword [0x587370]
mov eax, dword [esp]
mov ebp, eax
jmp 0x552fc6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0054bfac
pop ecx
mov edi, eax
test eax, eax
jne 0x552fbc
jmp 0x553006
xor esi, esi
mov ebx, dword [0x58736c]
mov eax, dword [esp]
mov edi, eax
jmp 0x553000
push eax
call fcn.0054bfac
pop ecx
test eax, eax
je 0x552ff5
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x552ff9
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x552fe4
mov eax, dword [0x58736c]
test eax, eax
je 0x553016
push eax
call fcn.0054b854
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x58736c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5593b8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea edx, [ebp - 0x208]
push edx
call sub.USER32.DLL_wvsprintfA
cmp eax, 0x208
jl 0x5593fc
push 0x10e
push str.c:_bcbemuvclutilcls.h
push str.bufSize___sizeof_szBuffer_
call fcn.00558700
add esp, 0xc
cmp eax, 2
jne 0x5593fc
call sub.KERNEL32.DLL_DebugBreak
lea ecx, [ebp - 0x208]
push ecx
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret

Function at 0x55a318
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.0054ea20
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x11e3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011e31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x11e307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11e306a
add dl, dl
jne 0x11e3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11e30dc
xor eax, eax
add dl, dl
jne 0x11e3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11e317d
add dl, dl
jne 0x11e30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11e30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11e30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11e30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11e30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11e3075
mov eax, 1
add dl, dl
jne 0x11e30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11e30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11e30e1
sub eax, ebx
mov ebx, 1
jne 0x11e3128
mov ecx, 1
add dl, dl
jne 0x11e310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11e3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11e3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11e3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11e313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11e314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11e3136
cmp eax, 0x7d00
jae 0x11e316d
cmp eax, 0x500
jb 0x11e3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11e3075
cmp eax, 0x7f
ja 0x11e3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11e3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x11e319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11e3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405860
Capabilities:
Check for debugger via api
Check for process debug object
Check processdebugflags
Check processdebugport
Encode data using xor
Encrypt data using speck
Get common file path
Get local ipv4 addresses
Get socket information
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x21f0
call fcn.004ee650
call fcn.00405878
Function at 0x4196e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x80
jb 0x4198b4
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x501440]
add edx, 0x40
add eax, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movq xmm4, qword [0x501430]
nop word cs:[eax + eax]
nop dword [eax]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x419730
movq xmm4, qword [0x501450]
pmovzxdq xmm5, qword [0x501490]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x419847
nop word cs:[eax + eax]
nop
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add eax, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x419820
pmovzxdq xmm1, qword [0x501490]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x501460], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x501470], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x501480], 0
pxor xmm2, xmm0
pextrd ecx, xmm2, 1
not ecx
je 0x4198be
push eax
call fcn.00419340
add esp, 4
ret
mov eax, ecx
ret
Function at 0x41b4b0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x128
cmp dword [esp + 0x140], 0
call fcn.0041b4c7
Function at 0x43b0d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
cmp dword [esp + 0x30], 0x10
mov esi, ecx
jne 0x43b192
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 0xf8]
mov edi, dword [esp + 0x3c]
lea ebx, [esp + 0xc]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov ecx, dword [ecx + 4]
lea eax, [esp + 7]
movsd qword [esp + 0x14], xmm1
movsd qword [esp + 0xc], xmm0
push ebx
push edx
push eax
call ecx
add esp, 0xc
movzx eax, word [esp + 7]
movzx edx, byte [esp + 9]
movzx ecx, word [esp + 0xa]
cmp edi, 4
mov word [esp], ax
mov byte [esp + 2], dl
mov word [esp + 3], cx
jbe 0x43b1ed
movzx eax, byte [0x6019e5]
xor ecx, ecx
mov edx, 0x16
mov edi, 0x16
call fcn.00499510
test eax, eax
je 0x43b247
mov word [eax + 0x14], 0x676e
mov dword [eax + 0x10], 0x6f6c206f
mov dword [eax + 0xc], 0x6f742072
mov dword [eax + 8], 0x65626d75
mov dword [eax + 4], 0x6e207465
mov dword [eax], 0x6b636170
mov byte [esi], 0xd
mov dword [esi + 4], 0x16
jmp 0x43b1e5
movzx eax, byte [0x6019e5]
xor ecx, ecx
mov edx, 0x18
mov edi, 0x18
call fcn.00499510
test eax, eax
je 0x43b247
mov dword [eax + 0x14], 0x6874676e
mov dword [eax + 0x10], 0x656c2064
mov dword [eax + 0xc], 0x696c6176
mov dword [eax + 8], 0x6e692066
mov dword [eax + 4], 0x6f20656c
mov dword [eax], 0x706d6173
mov byte [esi], 0xd
mov dword [esi + 4], 0x18
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
jmp 0x43b240
mov eax, dword [esp + 0x34]
movzx ecx, byte [esp]
movzx edx, byte [eax]
mov ch, dl
not ch
shr ch, 3
or ch, 0xf
and ch, cl
xor ch, dl
test edi, edi
mov byte [eax], ch
je 0x43b23d
movzx ebx, cl
xor ecx, ecx
cmp byte [esp + 0x40], 0
mov eax, dword [esp + 0x38]
cmove ebx, ecx
dec edi
xor bl, dl
and bl, 3
movzx edx, bl
cmp edi, edx
cmovae edi, edx
inc edi
nop dword [eax]
movzx edx, byte [esp + ecx + 1]
xor byte [eax + ecx], dl
inc ecx
cmp edi, ecx
jne 0x43b230
mov byte [esi], 0x16
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
ud2
Function at 0x461250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5f0
mov eax, dword [ebp + 0x28]
mov edi, dword [ebp + 0x20]
mov dword [esp + 0x54], edx
call fcn.0046126e

Function at 0x464a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ecx]
mov dword [esp + 4], ecx
mov ebp, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
test ebp, ebp
mov dword [esp], eax
je 0x464a7a
mov eax, dword [esp]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
lea esi, [eax + 4]
jmp 0x464a66
add esi, 0xc
dec ebp
je 0x464a7a
cmp dword [esi - 4], 0
je 0x464a60
push dword [esi]
push 0
push dword [0x6019d8]
call ebx
jmp 0x464a60
cmp dword [edi + 0x10], 0
je 0x464a91
push dword [esp]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [edi + 0x78]
lock dec dword [eax]
je 0x464b54
mov eax, dword [edi + 0x84]
lock dec dword [eax]
je 0x464b6e
mov eax, dword [edi + 0x8c]
lock dec dword [eax]
je 0x464b8e
mov eax, dword [edi + 0x94]
lock dec dword [eax]
je 0x464bae
mov eax, dword [edi + 0x9c]
lock dec dword [eax]
je 0x464bce
mov eax, dword [edi + 0xa0]
lock dec dword [eax]
je 0x464be8
cmp dword [edi + 0x1c], 0
je 0x464aff
push dword [edi + 0x20]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [edi + 0x28], 0
je 0x464b16
push dword [edi + 0x2c]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [edi + 0xa8]
lock dec dword [eax]
jne 0x464b2c
lea ecx, [edi + 0xa8]
call fcn.00464f10
mov eax, dword [edi + 0x34]
cmp eax, 0x80000001
je 0x464c08
cmp eax, 0x80000002
je 0x464c1f
add edi, 0x34
mov ecx, edi
call fcn.004a6b30
jmp 0x464c1f
mov ecx, dword [edi + 0x78]
mov edx, dword [edi + 0x7c]
call fcn.004a9b80
mov eax, dword [edi + 0x84]
lock dec dword [eax]
jne 0x464aac
mov ecx, dword [edi + 0x84]
mov edx, dword [edi + 0x88]
call fcn.004a9b80
mov eax, dword [edi + 0x8c]
lock dec dword [eax]
jne 0x464abb
mov ecx, dword [edi + 0x8c]
mov edx, dword [edi + 0x90]
call fcn.004a9b80
mov eax, dword [edi + 0x94]
lock dec dword [eax]
jne 0x464aca
mov ecx, dword [edi + 0x94]
mov edx, dword [edi + 0x98]
call fcn.004a9b80
mov eax, dword [edi + 0x9c]
lock dec dword [eax]
jne 0x464ad9
mov ecx, dword [edi + 0x9c]
call fcn.0049d270
mov eax, dword [edi + 0xa0]
lock dec dword [eax]
jne 0x464ae8
mov ecx, dword [edi + 0xa0]
mov edx, dword [edi + 0xa4]
call fcn.004a9b80
cmp dword [edi + 0x1c], 0
jne 0x464aee
jmp 0x464aff
cmp dword [edi + 0x38], 0
je 0x464c1f
push dword [edi + 0x3c]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 4]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x464c3f
lock dec dword [eax + 4]
jne 0x464c3f
push eax
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x467a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2a0
mov esi, dword [ebp + 0x14]
call fcn.00467a87
Function at 0x489240
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x44]
mov esi, ecx
mov ecx, dword [esp + 0x48]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x489295
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x4892b6
test eax, eax
js 0x4892a1
mov eax, dword [esp + 8]
mov bl, 4
jmp 0x4892aa
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
ret
mov eax, esp
mov dword [esp + 0x1c], 0x5bbfd0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.00489650
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004896f0
mov ecx, 7
int 0x29
ud2
Function at 0x48bc70
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x48bcbd
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x48bccd
mov dword [esi + 4], 0
jmp 0x48bcdf
cmp eax, 0x103
je 0x48bcfb
test eax, eax
js 0x48bce8
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x5bbfd0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.00489650
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004896f0
mov ecx, 7
int 0x29
ud2
Function at 0x48f930
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push edi
push esi
test dl, 1
mov eax, 0x17
mov edi, 2
mov esi, ecx
cmovne edi, eax
push 0x81
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x48f966
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
pop edi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x48f97a
cmp eax, 0x2739
jne 0x48f9aa
push 1
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x48f9b3
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x48f9c5
mov dword [esi + 4], edi
mov byte [esi], 4
pop esi
pop edi
ret
mov byte [esi], 0
mov dword [esi + 4], eax
pop esi
pop edi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
pop esi
pop edi
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
pop esi
pop edi
ret

Function at 0x48fb40
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov edi, edx
cmp ecx, 0x3b9aca00
je 0x48fba6
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x20]
mov ebp, 0x3e8
mul ebp
mov ebx, eax
mov eax, edi
seto byte [esp + 3]
mul ebp
mov ebp, edx
mov edi, eax
add ebp, ebx
mov ebx, 0xffffffff
setb al
or al, byte [esp + 3]
jne 0x48fba2
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebp
adc eax, 0
jae 0x48fbe8
mov edi, dword [esp + 4]
mov dword [esp + 8], ebx
lea eax, [esp + 8]
push 4
push eax
push 0x1006
push 0xffff
push edi
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x48fbde
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebp, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [esp + 4]
mov eax, ebp
adc eax, 0
jb 0x48fba6
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebp, 0
xor ebx, ebx
neg ebp
sbb ebx, ebx
or ebx, edx
jne 0x48fba6
mov eax, dword [0x5bc008]
mov ecx, dword [0x5bc00c]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x48fbe0
Function at 0x48fc40
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov edi, edx
cmp ecx, 0x3b9aca00
je 0x48fca6
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x20]
mov ebp, 0x3e8
mul ebp
mov ebx, eax
mov eax, edi
seto byte [esp + 3]
mul ebp
mov ebp, edx
mov edi, eax
add ebp, ebx
mov ebx, 0xffffffff
setb al
or al, byte [esp + 3]
jne 0x48fca2
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebp
adc eax, 0
jae 0x48fce8
mov edi, dword [esp + 4]
mov dword [esp + 8], ebx
lea eax, [esp + 8]
push 4
push eax
push 0x1005
push 0xffff
push edi
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x48fcde
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebp, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [esp + 4]
mov eax, ebp
adc eax, 0
jb 0x48fca6
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebp, 0
xor ebx, ebx
neg ebp
sbb ebx, ebx
or ebx, edx
jne 0x48fca6
mov eax, dword [0x5bc008]
mov ecx, dword [0x5bc00c]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x48fce0
Function at 0x4957f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0048b210
add esp, 4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov edx, ecx
neg edx
jo 0x495844
mov dword [esp + 0x18], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
call fcn.004958d0
mov edi, dword [esp]
mov eax, edi
neg eax
jno 0x495895
movzx eax, byte [esp + 4]
mov edi, dword [esp + 8]
cmp al, 3
jne 0x495887
mov ebp, dword [edi + 4]
mov ebx, dword [edi]
mov eax, dword [ebp]
test eax, eax
je 0x49585a
push ebx
call eax
add esp, 4
cmp dword [ebp + 4], 0
je 0x495878
cmp dword [ebp + 8], 9
jb 0x495869
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4958b3
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x49588d
test edi, edi
mov dword [esi], 0x80000000
je 0x49588d
push ebx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x49588d
Function at 0x4977e0
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
movzx eax, byte [0x6019e5]
mov ebx, edx
mov esi, ecx
xor ecx, ecx
mov edx, 8
call fcn.00499510
test eax, eax
je 0x497884
mov edi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [edi + 4], eax
push 0
push 0x10000
push edi
push 0x4979e0
push ebx
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x497834
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x49787f
mov ebp, dword [edi + 4]
mov ebx, dword [edi]
mov eax, dword [ebp]
test eax, eax
je 0x497846
push ebx
call eax
add esp, 4
cmp dword [ebp + 4], 0
je 0x497864
cmp dword [ebp + 8], 9
jb 0x497855
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x499270
Capabilities:
Read file on windows

Disassembly:
cmp dword [edx], 0
jne 0x499348
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [edx + 0xc]
mov edi, edx
mov esi, ecx
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x499320
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [esp + 4], 0
lea ebx, [esp + 4]
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x4992cd
mov eax, dword [esp + 4]
mov ecx, 2
test eax, eax
jne 0x499303
mov word [esi], 4
jmp 0x49930d
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4992ec
cmp eax, 0x6d
jne 0x499315
lea eax, [esp + 8]
mov dword [esp], 1
jmp 0x4992ee
mov eax, esp
mov dword [eax], 0
mov ecx, 1
mov eax, dword [esp + 8]
test byte [esp], 1
jne 0x4992bd
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x49930d
mov eax, 0x10
test edx, edx
mov ebp, 1
mov ecx, ebx
cmove ebp, eax
push 1
push 1
push ebp
call fcn.00500270
add esp, 0xc
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x499294
ud2