joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a652a9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4a652c57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.4a607588
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a652b78
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.4a60824c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a652c3c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.4a60824c
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a652b6a
cmp dword [ebp - 0xc], 0
je 0x4a652b6a
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a652b64
mov eax, ebx
mov edx, esi
call fcn.4a6082a4
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a652c3c
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.4a608094
mov eax, dword [ebp - 0x14]
call fcn.4a607ee8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4a652c3c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a608094
mov eax, dword [ebp - 0x18]
call fcn.4a607ee8
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4a652c33
cmp dword [ebp - 0xc], 0
je 0x4a652c33
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4a652c2d
lea eax, [ebp - 0x1c]
mov edx, esi
mov ecx, 0
call fcn.4a607c04
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.4a608314
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a652c5e
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.4a607618
ret
Function at 0x4a652c68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a652dbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a652d0a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.4a60824c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x4a652d98
mov eax, dword [ebp + 8]
call fcn.4a607a58
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call fcn.4a60824c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.4a60824c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a652d98
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.4a608094
mov eax, dword [ebp - 0x14]
call fcn.4a607ee8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4a652d98
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, 0
call fcn.4a608094
mov eax, dword [ebp - 4]
call fcn.4a607a64
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.4a607ee8
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.4a608094
mov eax, dword [ebp - 0x18]
call fcn.4a607ee8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a652dc2
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.4a607618
lea eax, [ebp - 4]
call fcn.4a6075ac
ret
Function at 0x4a652dd0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a652ebb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a652e43
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.4a60824c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a652ea0
mov eax, dword [ebp - 4]
call fcn.4a60824c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a652ea0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.4a608094
mov eax, dword [ebp - 0xc]
call fcn.4a607ee8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4a652ea0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a608094
mov eax, dword [ebp - 0x10]
call fcn.4a607ee8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a652ec2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.4a607618
ret

Function at 0x4a653588
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.4a6168a8
test eax, eax
je 0x4a653639
cmp word [eax + 0x18], 0x20b
jne 0x4a6535c6
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x4a6535d8
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x4a653639
jmp 0x4a653633
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x4a6535ef
push ebp
call fcn.4a6533c8
pop ecx
jmp 0x4a653639
cmp dword [esi + 0x10], 0
je 0x4a653630
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x4a65362b
cmp edi, dword [ebx]
jne 0x4a653628
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a653628
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x4a6535fd
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x4a6535de
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a654808
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a65498b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.4a607588
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x4a65495f
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4a65495f
cmp dword [0x4a6d50dc], 0
jne 0x4a654888
push 0x4a65499c
push 0x4a6549c8
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.4a60d6e0
mov dword [0x4a6d50dc], eax
cmp dword [0x4a6d50dc], 0
je 0x4a6548ba
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x4a6d50dc]
test eax, eax
je 0x4a6548ba
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.4a6082f8
jmp 0x4a6548f1
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4a6548f1
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.4a607c04
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.4a608314
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x4a65491d
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.4a652200
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.4a612278
cmp dword [edi], 0
je 0x4a65495f
mov eax, dword [edi]
call fcn.4a607a58
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x4a65495f
test bl, bl
je 0x4a65494a
mov eax, edi
mov edx, 0x4a6549ec
call fcn.4a6083e4
jmp 0x4a65495f
mov eax, dword [edi]
call fcn.4a607a58
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.4a6085f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a654992
lea eax, [ebp - 0x21c]
call fcn.4a607588
lea eax, [ebp - 0x218]
call fcn.4a6075ac
lea eax, [ebp - 4]
call fcn.4a60a7cc
ret

Function at 0x4a655470
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4a65548a
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4a6554e9
mov eax, edi
call fcn.4a607a58
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x4a6554e4
mov eax, edi
call fcn.4a607a58
add eax, eax
add eax, 2
push eax
mov eax, edi
call fcn.4a60824c
mov edx, esi
pop ecx
call fcn.4a604a4c
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret
Function at 0x4a657810
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4a6579c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.4a657744
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4a6579a2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x4a6cbd58], 0
jne 0x4a657976
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.4a652f90
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.4a6109bc
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x4a6579e4
call fcn.4a607d1c
mov eax, dword [ebp - 0x2c]
call fcn.4a607ee8
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x4a6578ea
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.4a6109bc
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x4a6579e4
call fcn.4a607d1c
mov eax, dword [ebp - 0x34]
call fcn.4a607ee8
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x4a657905
xor esi, esi
push 0
push 0x4a6579fc
push 0x4a657a08
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4a657965
test bl, bl
je 0x4a65794c
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.4a60df34
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection_1
jmp 0x4a657965
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x4a657976
mov eax, esi
call fcn.4a68fdf8
mov dword [0x4a6cbd58], esi
cmp dword [0x4a6cbd58], 0
je 0x4a65798c
mov eax, dword [0x4a6cbd58]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6579a9
mov eax, dword [ebp - 8]
call fcn.4a6577fc
ret

Function at 0x4a6628c4
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x4a6cbd84], 0
jne 0x4a662957
xor eax, eax
call fcn.4a616048
mov dword [0x4a6cbd84], eax
cmp dword [0x4a6cbd84], 0
je 0x4a662957
mov eax, 0x4a662728
xor ecx, ecx
xor edx, edx
call fcn.4a61654c
mov dword [0x4a6cbd88], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4a6cbd98], eax
push 0x4a6cbd7c
push 4
push 0
push 0x4a662770
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a6cbd80], eax
cmp dword [0x4a6cbd80], 0
je 0x4a662957
mov edx, 0x4a662964
mov eax, dword [0x4a6cbd7c]
call fcn.4a653b94
push 2
mov eax, dword [0x4a6cbd80]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x4a6cbd80]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x4a6629a0
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x4a6cbd84], 0
je 0x4a662a71
mov ebx, dword [0x4a6cbd98]
xor eax, eax
mov dword [0x4a6cbd98], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x4a6cbd94], 0
je 0x4a6629e9
mov ebx, dword [0x4a6cbd94]
xor eax, eax
mov dword [0x4a6cbd94], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x4a6cbd90], 0xffffffff
mov eax, 0x4a662728
xor ecx, ecx
xor edx, edx
call fcn.4a616778
push 0x1f4
mov eax, dword [0x4a6cbd80]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x4a662a36
push 0
mov eax, dword [0x4a6cbd80]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x4a6cbd9c], 0
je 0x4a662a36
mov eax, dword [0x4a6cbd9c]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
mov dword [0x4a6cbd9c], eax
mov eax, dword [0x4a6cbd80]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x4a6cbd7c]
call fcn.4a653908
xor eax, eax
mov dword [0x4a6cbd80], eax
xor eax, eax
mov dword [0x4a6cbd7c], eax
xor eax, eax
mov dword [0x4a6cbd84], eax
pop ebx
ret
Function at 0x4a66a8d8
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.4a607ee8
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4a66a904
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4a66a904
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a66cdb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x4a6cb440], 0
je 0x4a66cdd6
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x4a66ce98
push 1
push 0x4a66cea0
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.4a66cd48
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.4a650d64
test al, al
jne 0x4a66ce40
cmp esi, 0x80090318
jne 0x4a66ce48
test edi, edi
je 0x4a66ce48
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4a66ce78
cmp dword [ebp - 0x24], 0
je 0x4a66ce78
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4a66ce6e
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4a66ce8c
cmp dword [ebp - 0x18], 0
je 0x4a66ce8c
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a66cea8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x4a66cf2d
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x4a6cb454]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x4a66d050
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x4a66d050
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
push 0x4a66d060
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.4a66cd48
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.4a66cdb0
mov ebp, eax
sub ebp, 0x80090318
je 0x4a66d048
sub ebp, 0x7ff6fce8
je 0x4a66cfc5
sub ebp, 0x90312
je 0x4a66d00d
sub ebp, 0xe
je 0x4a66d039
jmp 0x4a66d050
cmp dword [esp + 0x30], 5
jne 0x4a66d007
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.4a604a4c
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x4a66d050
cmp dword [esp + 0x30], 5
jne 0x4a66d032
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.4a604a4c
mov esi, dword [esp + 0x2c]
jmp 0x4a66cec2
xor esi, esi
jmp 0x4a66cec2
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x4a66cec2
or edi, 0xffffffff
jmp 0x4a66cec2
movzx eax, byte [esp]
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a66d068
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov esi, edx
mov ebp, eax
mov bl, 1
mov eax, esi
call fcn.4a607ee8
mov dword [esp], eax
mov dword [esp + 0x44], esi
mov eax, dword [esp + 0x44]
call fcn.4a607a64
mov edi, eax
mov dword [esp + 4], 0x400
cmp dword [ebp + 8], 0
je 0x4a66d19c
mov eax, dword [esp + 4]
cmp eax, dword [ebp + 0x68]
jbe 0x4a66d19c
mov eax, dword [ebp + 0x68]
mov dword [esp + 4], eax
jmp 0x4a66d19c
cmp edi, dword [esp + 4]
jbe 0x4a66d0c5
mov esi, dword [esp + 4]
jmp 0x4a66d0c7
mov esi, edi
cmp dword [ebp + 8], 0
je 0x4a66d181
mov edx, dword [ebp + 0x78]
add edx, dword [ebp + 0x60]
mov eax, dword [esp]
mov ecx, esi
call fcn.4a604a4c
push 3
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
add eax, esi
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x4c]
push eax
push 3
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], esi
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x64]
push eax
push 3
push 0x4a66d1b4
push 3
lea ecx, [esp + 0x30]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.4a66cd48
push 0
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebp + 0x54]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x4a66d179
push 0
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x24]
add eax, dword [esp + 0x30]
push eax
mov eax, dword [ebp + 0x78]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4a66d17d
xor ebx, ebx
jmp 0x4a66d197
mov bl, 1
jmp 0x4a66d197
push 0
push esi
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg bl
add dword [esp], esi
sub edi, esi
test bl, bl
je 0x4a66d1a8
test edi, edi
ja 0x4a66d0b9
mov eax, ebx
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a66df00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4a66e167
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4a66e123
cmp byte [0x4a6cb442], 0
jne 0x4a66df8b
mov eax, ebx
call fcn.4a653698
test al, al
je 0x4a66dfc8
push 0x4a66e188
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.4a61200c
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.4a624270
push dword [ebp - 0x21c]
push 0x4a66e1a0
lea eax, [ebp - 4]
mov edx, 3
call fcn.4a607da0
jmp 0x4a66dfd7
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.4a608094
push 0x4a66e1b0
lea eax, [ebp - 0x228]
mov edx, dword [0x4a6cbe0c]
mov ecx, 0
call fcn.4a607c04
push dword [ebp - 0x228]
push 0x4a66e1c0
push 0x4a66e1d0
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.4a66b2dc
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.4a608094
push dword [ebp - 0x22c]
push 0x4a66e1ec
push dword [ebp - 4]
push 0x4a66e204
push 0x4a66e1c0
push 0x4a66e214
push 0x4a66e1c0
push 0x4a66e244
push dword [ebp - 4]
push 0x4a66e204
push 0x4a66e1c0
push 0x4a66e1c0
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.4a607da0
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.4a66d068
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x4a66e123
cmp esi, 0xff
jbe 0x4a66e095
mov ebx, 0xff
jmp 0x4a66e097
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4a66e0b7
cmp ebx, dword [ebp - 0x14]
je 0x4a66e0c9
mov edx, 0x4a66e1c0
mov eax, edi
call fcn.4a66d068
mov byte [ebp - 0xd], 0
jmp 0x4a66e123
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.4a624138
lea eax, [ebp - 0x234]
mov edx, 0x4a66e1c0
call fcn.4a607cc4
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.4a66d068
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x4a66e11b
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x4a66e086
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a66e16e
lea eax, [ebp - 0x234]
call fcn.4a6075ac
lea eax, [ebp - 0x230]
call fcn.4a607588
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.4a607618
lea eax, [ebp - 4]
call fcn.4a6075ac
ret