joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466da0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539c70
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5857cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
cmp dword [ecx + 0x14], 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
jb 0x466df4
mov ecx, dword [ecx]
lea eax, [ebp - 0x34]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x466eb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x466ead
cmp esi, 3
je 0x466ead
push 0xf
push str.BasicFileSystem
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x50], bl
call fcn.00401bf0
lea ecx, [ebp - 0x6c]
push esi
push ecx
mov dword [ebp - 4], ebx
call fcn.004f3e20
add esp, 8
mov esi, 0x10
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], esi
jb 0x466e5e
mov eax, dword [eax]
push eax
push str.GetFileAttributesExW:__s
push 2
push 0x31
push str._anonymous_namespace::getAttributes
lea edx, [ebp - 0x50]
push str.........externalFusion_sourceiowin32BasicFileSystem_wincommon.cpp
push edx
call fcn.004f0a90
add esp, 0x1c
cmp dword [ebp - 0x58], esi
jb 0x466e8f
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0052142e
add esp, 4
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x6c], bl
cmp dword [ebp - 0x3c], esi
jb 0x466ead
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.0052142e
add esp, 4
or eax, 0xffffffff
jmp 0x466eb5
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521458
mov esp, ebp
pop ebp
ret
Function at 0x474f50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x59e000], ecx
inc edx
cmp edx, 0x100
jb 0x474f52
cmp edx, 0x800
jae 0x475029
lea esp, [esp]
mov eax, dword [edx*4 + 0x59dc00]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x59e000]
inc edx
mov dword [edx*4 + 0x59dffc], eax
cmp edx, 0x800
jb 0x475000
mov dword [0x586c48], 0x475fa0
call fcn.00476170
test eax, eax
jne 0x475046
mov dword [0x586c48], 0x476050
ret
Function at 0x477f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
sub esp, 8
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x477f1c
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], ebx
mov esi, dword [ebp + 8]
lea edi, [eax + esi]
cmp edi, ebx
jae 0x477f4d
mov edi, edi
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x477f4d
inc edi
cmp edi, ebx
jb 0x477f40
mov eax, edi
sub eax, esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp edi, ebx
jae 0x478072
cmp ecx, 3
jbe 0x477f6a
xor esi, esi
mov dword [ebp + 0xc], esi
jmp 0x477fad
dec ecx
shl edx, cl
and edx, 7
mov dword [ebp + 0xc], edx
je 0x477faa
mov ecx, edx
movzx edx, byte [ecx + 0x553a20]
mov esi, edi
sub esi, edx
cmp byte [ecx + 0x553a18], 0
mov dl, byte [esi + 4]
je 0x477f97
test dl, dl
je 0x477f97
cmp dl, 0xff
jne 0x477faa
and ecx, 3
add ecx, ecx
or ecx, 1
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
inc eax
mov edx, ecx
jmp 0x477f34
mov esi, dword [ebp + 0xc]
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x477fcf
cmp cl, 0xff
je 0x477fcf
and esi, 3
add esi, esi
or esi, 1
mov dword [ebp + 0xc], esi
inc eax
mov edx, esi
jmp 0x477f34
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea ecx, [ecx]
cmp dword [ebp + 0x18], 0
je 0x477ffe
lea ebx, [edx + eax]
add ebx, dword [ebp + 0x10]
jmp 0x478005
sub edx, eax
sub edx, dword [ebp + 0x10]
mov ebx, edx
test esi, esi
je 0x478042
movzx esi, byte [esi + 0x553a20]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
mov cl, dl
test cl, cl
je 0x47802c
cmp cl, 0xff
jne 0x478042
mov ecx, 0x20
sub ecx, esi
mov esi, dword [ebp + 0xc]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x477ff0
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
shr ecx, 8
mov byte [edi + 3], dl
mov edx, dword [ebp + 0xc]
mov byte [edi + 1], bl
mov ebx, dword [ebp - 8]
mov byte [edi + 2], cl
add eax, 5
jmp 0x477f34
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x478085
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret
dec ecx
shl edx, cl
mov ecx, dword [ebp + 0x14]
and edx, 7
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret
Function at 0x48b640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [ebp + 0x10], edi
mov edx, edi
cmp edi, ecx
jb 0x48b681
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x48b660
mov dword [ebp + 0x10], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x48b6e9
cmp dword [eax + 0xc], edi
jne 0x48b6e3
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x48b6bc
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x48b6e0
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x48b6a8
test ecx, ecx
je 0x48b700
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x48b6e0
cmp ecx, 1
jbe 0x48b700
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x48b6e0
cmp ecx, 2
jbe 0x48b700
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x48b700
mov ebx, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x48b696
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov eax, ebx
call fcn.0048b5a0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov cl, byte [eax + 5]
movzx edx, byte [edx + 0x14]
movzx ebx, cl
not edx
and ebx, 3
test bl, dl
je 0x48b6fb
pop edi
xor cl, 3
pop esi
mov byte [eax + 5], cl
pop ebx
pop ebp
ret
Function at 0x494b80
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5857cc]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x494bd5
mov eax, dword [esp]
cmp al, 2
jne 0x494bcf
shr eax, 8
cmp al, 2
jne 0x494bcf
call fcn.00496000
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00521458
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.00521458
add esp, 0x194
ret

Function at 0x49f540
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x49f572
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x49fbc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x130]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x49fc3d
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x49fc14
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.00495800
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.0049f8e0
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x859c], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a1890
Capabilities:
Set socket configuration

Disassembly:
push ecx
xor eax, eax
cmp dword [edi + 0x410], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4a18c8
push esi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push edi
call fcn.0049f850
add esp, 0xc
pop ecx
ret
Function at 0x4a1ee0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x5857cc]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
mov ebp, dword [esp + 0x118]
cmp dword [ebp + 0x224], 0
push esi
push edi
mov edi, dword [ebp]
mov dword [esp + 0x14], edi
jne 0x4a201e
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4a1f5c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.00495800
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.0049f8e0
add esp, 0x18
jmp 0x4a206c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4a1f9c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.00495800
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.0049f8e0
add esp, 0x18
jmp 0x4a206c
lea ebx, [ebp + 0xcc]
lea edi, [ebp + 0x9e]
lea esi, [esp + 0x18]
call fcn.004a1e60
test eax, eax
jne 0x4a1fdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.00495800
mov ecx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.0049f8e0
add esp, 0x18
jmp 0x4a206c
lea ebx, [ebp + 0x100]
lea edi, [ebp + 0xd0]
lea esi, [esp + 0x98]
call fcn.004a1e60
test eax, eax
jne 0x4a201e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.00495800
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.0049f8e0
add esp, 0x18
jmp 0x4a206c
mov edi, dword [ebp]
add edi, 0x8f2c
lea esi, [ebp + 0x9e]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp]
add edi, 0x8f60
lea esi, [ebp + 0xd0]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp]
mov ecx, dword [ebp + 0xcc]
mov dword [eax + 0x8f5c], ecx
mov edx, dword [ebp]
mov eax, dword [ebp + 0x100]
mov dword [edx + 0x8f90], eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00521458
add esp, 0x10c
ret

Function at 0x4a2090
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4a20d3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00495800
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0049f850
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0049f850
add esp, 8
pop esi
pop ecx
ret
Function at 0x4a20f0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x1c], 0x4020
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4a2139
mov edx, dword [esp + 4]
cmp edx, dword [esp + 8]
jg 0x4a2151
push 4
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
add esp, 0xc
ret

Function at 0x4a2180
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x55c]
test esi, esi
je 0x4a21cd
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4a21cd
push 0x4a2160
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
mov edx, dword [eax + 0x64]
push ecx
push edx
call fcn.004bb890
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x4a21d6
mov dword [edi + 0x55c], 0
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4a21e0
mov dword [eax], esi
cmp dword [esi + 0x150], 0
mov edi, dword [esi + 0x130]
je 0x4a2205
push esi
call fcn.0046cba0
add esp, 4
test eax, eax
jne 0x4a2219
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
push 2
push 1
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4a21cd
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x4a3eb0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ebp
xor ebp, ebp
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax], ebp
mov eax, dword [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 8], eax
cmp eax, ebp
jne 0x4a4061
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebp
je 0x4a403f
push ebx
push esi
lea esp, [esp]
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4a3f0d
lea ebx, [eax + 0xe]
jmp 0x4a3f19
cmp eax, 0x17
jne 0x4a3fb8
lea ebx, [eax + 5]
cmp dword [edi + 0x18], ebp
je 0x4a3fb8
mov eax, dword [edi + 0x10]
cmp eax, ebp
jbe 0x4a3fb8
cmp eax, ebx
jb 0x4a3fb8
push 0x20
call dword [0x583914]
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x4a3fc5
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [0x583914]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebp
je 0x4a3fcf
mov ecx, dword [edi + 0x18]
push ebx
push ecx
push eax
call fcn.00521434
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp eax, ebp
je 0x4a3f9f
push eax
call dword [0x583920]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebp
je 0x4a3fe3
cmp dword [esp + 0x10], ebp
jne 0x4a3fa9
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4a3fb4
mov dword [eax + 0x1c], esi
mov dword [esp + 0x18], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebp
jne 0x4a3f00
jmp 0x4a3fff
mov dword [esp + 0x14], 8
jmp 0x4a3fff
push esi
mov dword [esp + 0x18], 8
call dword [0x583918]
add esp, 4
jmp 0x4a3fff
mov edx, dword [esi + 0x18]
push edx
mov dword [esp + 0x18], 8
call dword [0x583918]
push esi
call dword [0x583918]
add esp, 8
mov eax, dword [esp + 0x1c]
pop esi
pop ebx
cmp eax, ebp
je 0x4a4010
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 0xc], ebp
je 0x4a4039
mov eax, dword [esp + 8]
push eax
call fcn.004a3e60
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
add esp, 4
mov ecx, ebp
pop edi
mov dword [esp + 4], ebp
mov dword [edx], ecx
pop ebp
add esp, 0x10
ret
cmp dword [esp + 8], ebp
jne 0x4a4052
push 0x2af9
mov dword [esp + 0x10], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov dword [edx], ecx
pop edi
pop ebp
add esp, 0x10
ret

Function at 0x4a45d0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x29c], 2
jne 0x4a45e2
jmp fcn.004a4570
mov eax, 1
ret
Function at 0x4a4900
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4a490f
jmp dword [ecx*4 + 0x4a4964]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x4a49d0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov cl, byte [edi]
test cl, cl
je 0x4a4aef
mov al, byte [esi]
test al, al
je 0x4a4aef
movsx edx, cl
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x4a49f9
jmp dword [edx*4 + 0x4a4b14]
mov cl, 0x41
jmp case.default.0x4a49f9
mov cl, 0x42
jmp case.default.0x4a49f9
mov cl, 0x43
jmp case.default.0x4a49f9
mov cl, 0x44
jmp case.default.0x4a49f9
mov cl, 0x45
jmp case.default.0x4a49f9
mov cl, 0x46
jmp case.default.0x4a49f9
mov cl, 0x47
jmp case.default.0x4a49f9
mov cl, 0x48
jmp case.default.0x4a49f9
mov cl, 0x49
jmp case.default.0x4a49f9
mov cl, 0x4a
jmp case.default.0x4a49f9
mov cl, 0x4b
jmp case.default.0x4a49f9
mov cl, 0x4c
jmp case.default.0x4a49f9
mov cl, 0x4d
jmp case.default.0x4a49f9
mov cl, 0x4e
jmp case.default.0x4a49f9
mov cl, 0x4f
jmp case.default.0x4a49f9
mov cl, 0x50
jmp case.default.0x4a49f9
mov cl, 0x51
jmp case.default.0x4a49f9
mov cl, 0x52
jmp case.default.0x4a49f9
mov cl, 0x53
jmp case.default.0x4a49f9
mov cl, 0x54
jmp case.default.0x4a49f9
mov cl, 0x55
jmp case.default.0x4a49f9
mov cl, 0x56
jmp case.default.0x4a49f9
mov cl, 0x57
jmp case.default.0x4a49f9
mov cl, 0x58
jmp case.default.0x4a49f9
mov cl, 0x59
jmp case.default.0x4a49f9
mov cl, 0x5a
movsx edx, al
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x4a4a71
jmp dword [edx*4 + 0x4a4b7c]
mov al, 0x41
jmp case.default.0x4a4a71
mov al, 0x42
jmp case.default.0x4a4a71
mov al, 0x43
jmp case.default.0x4a4a71
mov al, 0x44
jmp case.default.0x4a4a71
mov al, 0x45
jmp case.default.0x4a4a71
mov al, 0x46
jmp case.default.0x4a4a71
mov al, 0x47
jmp case.default.0x4a4a71
mov al, 0x48
jmp case.default.0x4a4a71
mov al, 0x49
jmp case.default.0x4a4a71
mov al, 0x4a
jmp case.default.0x4a4a71
mov al, 0x4b
jmp case.default.0x4a4a71
mov al, 0x4c
jmp case.default.0x4a4a71
mov al, 0x4d
jmp case.default.0x4a4a71
mov al, 0x4e
jmp case.default.0x4a4a71
mov al, 0x4f
jmp case.default.0x4a4a71
mov al, 0x50
jmp case.default.0x4a4a71
mov al, 0x51
jmp case.default.0x4a4a71
mov al, 0x52
jmp case.default.0x4a4a71
mov al, 0x53
jmp case.default.0x4a4a71
mov al, 0x54
jmp case.default.0x4a4a71
mov al, 0x55
jmp case.default.0x4a4a71
mov al, 0x56
jmp case.default.0x4a4a71
mov al, 0x57
jmp case.default.0x4a4a71
mov al, 0x58
jmp case.default.0x4a4a71
mov al, 0x59
jmp case.default.0x4a4a71
mov al, 0x5a
cmp cl, al
jne 0x4a4aef
mov cl, byte [edi + 1]
inc edi
inc esi
test cl, cl
jne 0x4a49e4
movzx eax, byte [edi]
push eax
call fcn.004a4900
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.004a4900
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
mov eax, ecx
ret
Function at 0x4a4bf0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov cl, byte [ebx]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test cl, cl
je 0x4a4d24
lea esp, [esp]
mov al, byte [esi]
test al, al
je 0x4a4d24
test edi, edi
je 0x4a4d28
movsx edx, cl
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x4a4c2d
jmp dword [edx*4 + 0x4a4d58]
mov cl, 0x41
jmp case.default.0x4a4c2d
mov cl, 0x42
jmp case.default.0x4a4c2d
mov cl, 0x43
jmp case.default.0x4a4c2d
mov cl, 0x44
jmp case.default.0x4a4c2d
mov cl, 0x45
jmp case.default.0x4a4c2d
mov cl, 0x46
jmp case.default.0x4a4c2d
mov cl, 0x47
jmp case.default.0x4a4c2d
mov cl, 0x48
jmp case.default.0x4a4c2d
mov cl, 0x49
jmp case.default.0x4a4c2d
mov cl, 0x4a
jmp case.default.0x4a4c2d
mov cl, 0x4b
jmp case.default.0x4a4c2d
mov cl, 0x4c
jmp case.default.0x4a4c2d
mov cl, 0x4d
jmp case.default.0x4a4c2d
mov cl, 0x4e
jmp case.default.0x4a4c2d
mov cl, 0x4f
jmp case.default.0x4a4c2d
mov cl, 0x50
jmp case.default.0x4a4c2d
mov cl, 0x51
jmp case.default.0x4a4c2d
mov cl, 0x52
jmp case.default.0x4a4c2d
mov cl, 0x53
jmp case.default.0x4a4c2d
mov cl, 0x54
jmp case.default.0x4a4c2d
mov cl, 0x55
jmp case.default.0x4a4c2d
mov cl, 0x56
jmp case.default.0x4a4c2d
mov cl, 0x57
jmp case.default.0x4a4c2d
mov cl, 0x58
jmp case.default.0x4a4c2d
mov cl, 0x59
jmp case.default.0x4a4c2d
mov cl, 0x5a
movsx edx, al
add edx, 0xffffff9f
cmp edx, 0x19
ja case.default.0x4a4ca5
jmp dword [edx*4 + 0x4a4dc0]
mov al, 0x41
jmp case.default.0x4a4ca5
mov al, 0x42
jmp case.default.0x4a4ca5
mov al, 0x43
jmp case.default.0x4a4ca5
mov al, 0x44
jmp case.default.0x4a4ca5
mov al, 0x45
jmp case.default.0x4a4ca5
mov al, 0x46
jmp case.default.0x4a4ca5
mov al, 0x47
jmp case.default.0x4a4ca5
mov al, 0x48
jmp case.default.0x4a4ca5
mov al, 0x49
jmp case.default.0x4a4ca5
mov al, 0x4a
jmp case.default.0x4a4ca5
mov al, 0x4b
jmp case.default.0x4a4ca5
mov al, 0x4c
jmp case.default.0x4a4ca5
mov al, 0x4d
jmp case.default.0x4a4ca5
mov al, 0x4e
jmp case.default.0x4a4ca5
mov al, 0x4f
jmp case.default.0x4a4ca5
mov al, 0x50
jmp case.default.0x4a4ca5
mov al, 0x51
jmp case.default.0x4a4ca5
mov al, 0x52
jmp case.default.0x4a4ca5
mov al, 0x53
jmp case.default.0x4a4ca5
mov al, 0x54
jmp case.default.0x4a4ca5
mov al, 0x55
jmp case.default.0x4a4ca5
mov al, 0x56
jmp case.default.0x4a4ca5
mov al, 0x57
jmp case.default.0x4a4ca5
mov al, 0x58
jmp case.default.0x4a4ca5
mov al, 0x59
jmp case.default.0x4a4ca5
mov al, 0x5a
cmp cl, al
jne 0x4a4d24
mov cl, byte [ebx + 1]
inc ebx
dec edi
inc esi
test cl, cl
jne 0x4a4c10
test edi, edi
jne 0x4a4d31
pop edi
pop esi
mov eax, 1
pop ebx
ret
movzx eax, byte [ebx]
push eax
call fcn.004a4900
mov dl, al
movzx eax, byte [esi]
push eax
call fcn.004a4900
add esp, 8
xor ecx, ecx
cmp dl, al
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
ret
Function at 0x4a4e30
Capabilities:
Parse pe header

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 1
jb 0x4a4edc
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
sub esi, edx
lea esp, [esp]
mov al, byte [edx]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4a4e5d
jmp dword [ecx*4 + 0x4a4ee0]
mov al, 0x41
jmp case.default.0x4a4e5d
mov al, 0x42
jmp case.default.0x4a4e5d
mov al, 0x43
jmp case.default.0x4a4e5d
mov al, 0x44
jmp case.default.0x4a4e5d
mov al, 0x45
jmp case.default.0x4a4e5d
mov al, 0x46
jmp case.default.0x4a4e5d
mov al, 0x47
jmp case.default.0x4a4e5d
mov al, 0x48
jmp case.default.0x4a4e5d
mov al, 0x49
jmp case.default.0x4a4e5d
mov al, 0x4a
jmp case.default.0x4a4e5d
mov al, 0x4b
jmp case.default.0x4a4e5d
mov al, 0x4c
jmp case.default.0x4a4e5d
mov al, 0x4d
jmp case.default.0x4a4e5d
mov al, 0x4e
jmp case.default.0x4a4e5d
mov al, 0x4f
jmp case.default.0x4a4e5d
mov al, 0x50
jmp case.default.0x4a4e5d
mov al, 0x51
jmp case.default.0x4a4e5d
mov al, 0x52
jmp case.default.0x4a4e5d
mov al, 0x53
jmp case.default.0x4a4e5d
mov al, 0x54
jmp case.default.0x4a4e5d
mov al, 0x55
jmp case.default.0x4a4e5d
mov al, 0x56
jmp case.default.0x4a4e5d
mov al, 0x57
jmp case.default.0x4a4e5d
mov al, 0x58
jmp case.default.0x4a4e5d
mov al, 0x59
jmp case.default.0x4a4e5d
mov al, 0x5a
mov byte [esi + edx], al
mov al, byte [edx]
inc edx
test al, al
je 0x4a4edb
dec edi
jne 0x4a4e50
pop esi
pop edi
ret