joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e9b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f69d6
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov esi, dword [esp + 0x238]
lea eax, [esp + 0x30]
push eax
push 0x1f3
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x46eaac
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.004516b0
lea ecx, [esp + 0x14]
call fcn.00451c20
lea ecx, [esp + 0xc]
mov dword [esp + 0x230], 0
call fcn.0045b180
lea edx, [esp + 0x14]
add edi, 0x20
push edx
mov ecx, edi
mov byte [esp + 0x234], 1
call fcn.004c49f0
push eax
mov ecx, edi
call fcn.004c06c0
push eax
lea ecx, [esp + 0x18]
call fcn.0045b3c0
push 0x5af400
push 0x5af1ac
lea ecx, [esp + 0x1c]
call fcn.00452320
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00452a30
push str..tmp
mov ecx, esi
call fcn.004516b0
lea ecx, [esp + 0xc]
mov byte [esp + 0x230], 0
call fcn.0045b190
lea ecx, [esp + 0x14]
mov dword [esp + 0x230], 0xffffffff
call fcn.00451e70
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004d99c4
add esp, 0x228
ret 4

Function at 0x46ebd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f6a58
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.00451c20
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x54], 0
call fcn.0046e9b0
lea ecx, [esp + 0x10]
call fcn.004c49f0
test eax, eax
lea ecx, [esp + 0x10]
jne 0x46ec46
mov dword [esp + 0x50], 0xffffffff
call fcn.00451e70
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret
push 0
call fcn.004c06c0
push eax
call fcn.00457560
add esp, 8
test al, al
je 0x46ec7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], 0xffffffff
call fcn.00451e70
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret
lea ecx, [esp + 0x2c]
call fcn.00451c20
lea ecx, [esp + 0xc]
mov byte [esp + 0x50], 1
call fcn.0046c320
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x54], 2
call fcn.0046c2e0
push 0
lea ecx, [esp + 0x30]
call fcn.004c49f0
push eax
lea ecx, [esp + 0x34]
call fcn.004c06c0
push eax
lea ecx, [esp + 0x1c]
call fcn.004c06c0
push eax
call fcn.00457a20
add esp, 0x10
lea ecx, [esp + 0xc]
mov bl, al
mov byte [esp + 0x50], 1
call fcn.0046c330
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 0
call fcn.00451e70
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], 0xffffffff
call fcn.00451e70
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x470140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f6ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call fcn.00451b50
lea ecx, [esi + 0x24]
mov dword [esp + 0x30], 0
call fcn.004c06c0
push eax
lea ecx, [esp + 0x10]
call fcn.00451780
test al, al
je 0x470228
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4701c6
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00451e70
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 8
add esi, 0x40
mov ecx, esi
call fcn.004c49f0
test eax, eax
je 0x47019f
push 0x5b3754
mov ecx, esi
call fcn.00452dd0
test al, al
jne 0x47019f
mov ecx, esi
call fcn.004c49f0
push eax
mov ecx, esi
call fcn.004c06c0
push eax
push edi
call fcn.004dc0e4
add esp, 0xc
test eax, eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
jne 0x470234
call fcn.00451e70
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 8
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00451e70
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 8
Function at 0x4731c0
Capabilities:
Delete file
Move file

Disassembly:
mov eax, ecx
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x45a3ae
xor al, al
ret 0xc
lea edx, [eax + 8]
mov eax, dword [eax + 4]
push edx
push eax
call fcn.004705d0
test eax, eax
je 0x45a3a9
mov ecx, eax
jmp 0x4731c0
push 0xffffffffffffffff
push 0x4f7138
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 4]
mov edx, dword [eax + 0x1c]
lea esi, [ebp + 4]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
push 1
push str.AddEmbedded
mov ecx, esi
call edx
mov ecx, ebp
mov byte [esp + 0x17], 0
call fcn.00471020
test al, al
jne 0x473226
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov ecx, esi
call edx
xor al, al
jmp 0x473379
mov ebx, dword [esp + 0x44]
push esi
mov ecx, ebx
call fcn.00454170
push eax
call fcn.004a0670
mov edi, eax
add esp, 8
test edi, edi
je 0x47336c
mov ecx, dword [esp + 0x4c]
push esi
call fcn.00454170
mov ecx, dword [esp + 0x4c]
push eax
call fcn.00453f00
push eax
mov ecx, edi
call fcn.004a0580
lea ecx, [esp + 0x18]
call fcn.00451c20
lea eax, [esp + 0x18]
push eax
lea ecx, [ebp + 0x174]
mov dword [esp + 0x40], 0
call fcn.004c06c0
push eax
push str.ckZ.dat
call fcn.004587d0
add esp, 0xc
push esi
push 0
lea ecx, [esp + 0x20]
call fcn.004c06c0
push eax
mov ecx, edi
call fcn.0049fea0
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
push esi
mov ecx, ebx
call fcn.00454170
push eax
call fcn.00458240
add esp, 8
test al, al
je 0x47335b
push esi
mov ecx, ebx
call fcn.00454170
push eax
call fcn.00458370
add esp, 8
test al, al
jne 0x4732ec
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push str.Failed_to_delete_existing_EXE_file
mov ecx, esi
call eax
jmp 0x47335b
mov ecx, ebx
call fcn.00454170
push eax
lea ecx, [esp + 0x1c]
call fcn.004c06c0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x473356
lea ecx, [esp + 0x18]
call fcn.004c06c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esi]
lea ecx, [esp + 0x18]
call fcn.004c06c0
mov edx, dword [edi + 0x28]
push eax
push str.fromFilename
mov ecx, esi
call edx
mov edi, dword [esi]
mov ecx, ebx
call fcn.00454170
push eax
mov eax, dword [edi + 0x28]
push str.toFilename
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push str.Failed_to_move_EXE_file
mov ecx, esi
call eax
jmp 0x47335b
mov byte [esp + 0x17], 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00451e70
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
mov ecx, esi
call eax
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x479830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f7960
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
cmp byte [0x5e6617], 0
jne 0x4798ee
lea ecx, [esp + 0x14]
call fcn.00451c20
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0
call fcn.0045b180
mov eax, dword [str.VHJpYWwgUGVyaW9kIEV4cGlyZWQ]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 1
call fcn.0045cbe0
mov esi, dword [esp + 0x40]
test esi, esi
je 0x4798b9
mov edi, dword [esi]
lea ecx, [esp + 0x14]
call fcn.004c06c0
mov edx, dword [edi + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.0045b190
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.00451e70
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4

Function at 0x47a1b0
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax + 0x34]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x38], esi
mov ebx, 1
jle 0x47a1f6
push ebp
push edi
movzx edi, dl
jmp 0x47a1d0
mov ecx, dword [eax + 0x260]
mov ebp, ecx
shr ebp, 0x18
xor ebp, edi
shl ecx, 8
xor ecx, dword [ebp*4 + 0x5de198]
add esi, ebx
mov dword [eax + 0x260], ecx
cmp esi, dword [eax + 0x38]
jl 0x47a1d0
pop edi
pop ebp
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x47a27e
sub ecx, ebx
je 0x47a263
sub ecx, ebx
je 0x47a257
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
Function at 0x47c540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f9558
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00465c50
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.TreeInfo.0
mov byte [esi + 8], 0xce
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.00458b60
mov eax, dword [0x5ddcc0]
mov dword [esi + 0x2c], eax
add eax, 1
mov dword [0x5ddcc0], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x47df80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f7e13
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00465c50
mov eax, dword [esp + 0x24]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.TreeNode.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 0xce
je 0x47dff1
cmp byte [eax], bl
je 0x47dff1
push eax
mov ecx, esi
call fcn.0047d740
mov edi, dword [esp + 0x28]
cmp edi, ebx
je 0x47e023
cmp byte [edi], bl
je 0x47e023
push 0x1c
call fcn.004cabe6
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x47e01e
push edi
mov ecx, eax
call fcn.00451b50
jmp 0x47e020
xor eax, eax
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
Function at 0x47e040
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f7e38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.TreeNode.0
mov ecx, dword [esi + 0xc]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x20], ebx
mov byte [esi + 0x30], 0x31
je 0x47e08d
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0xc], ebx
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x47e09f
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x14], ebx
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x47e0b1
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x10], ebx
mov ecx, dword [esi + 0x20]
cmp ecx, ebx
je 0x47e0fb
call fcn.004c06c0
mov ebp, eax
xor edi, edi
cmp ebp, ebx
jle 0x47e0e9
mov ecx, dword [esi + 0x20]
push edi
call fcn.004c0780
cmp eax, ebx
je 0x47e0e2
cmp byte [eax + 0x30], 0xce
jne 0x47e0e2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
add edi, 1
cmp edi, ebp
jl 0x47e0c5
mov ecx, dword [esi + 0x20]
cmp ecx, ebx
je 0x47e0f8
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x20], ebx
mov ecx, dword [esi + 8]
cmp ecx, ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
je 0x47e124
cmp dword [ecx + 0xc], esi
jne 0x47e124
cmp byte [ecx + 8], 0xce
jne 0x47e121
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 8], ebx
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00465c70
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x47e2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f9bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
cmp dword [eax + 0xc], esi
mov ebp, dword [esp + 0x40]
jne 0x47e3d6
cmp dword [eax + 0x10], 0
je 0x47e396
push str.__xml
mov ecx, ebp
call fcn.004516b0
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x10], 0
je 0x47e38a
lea ecx, [esp + 0x14]
call fcn.00451c20
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x40], 0
mov byte [esp + 0x48], 0
call fcn.0047deb0
cmp byte [esp + 0x40], 0
je 0x47e36a
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x47e350
push str.standalone
call fcn.004aca40
lea ecx, [esp + 0x14]
call fcn.004c06c0
mov edx, dword [esi + 8]
mov ecx, dword [edx + 0x10]
push eax
push str.standalone
call fcn.0047d500
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0x10]
push ebp
call fcn.004ac980
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.00451e70
push str.____r_n
mov ecx, ebp
call fcn.004516b0
push ebp
mov ecx, esi
call fcn.0047d370
mov edx, dword [esi + 8]
mov ecx, dword [edx + 0x28]
test ecx, ecx
je 0x47e3d6
call fcn.004c49f0
test eax, eax
je 0x47e3d6
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x28]
call fcn.004c06c0
push eax
mov ecx, ebp
call fcn.004516b0
push 0xd
mov ecx, ebp
call fcn.00451260
push 0xa
mov ecx, ebp
call fcn.00451260
cmp dword [esp + 0x44], 0
jne 0x47e3e9
push 0x5aff2c
mov ecx, ebp
call fcn.004516b0
mov ecx, dword [esp + 0x48]
push ecx
push ebp
mov ecx, esi
call fcn.0047c6a0
push ebp
mov ecx, esi
call fcn.0047c7e0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x47e433
call fcn.004c06c0
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x47e433
mov ecx, dword [esi + 0x20]
push edi
call fcn.004c0780
mov ecx, dword [esp + 0x48]
add ecx, 1
push ecx
push edi
push ebp
mov ecx, eax
call fcn.0047e2b0
add edi, 1
cmp edi, ebx
jl 0x47e412
cmp dword [esi + 0x20], 0
je 0x47e440
mov edx, dword [esp + 0x48]
push edx
jmp 0x47e454
mov ecx, ebp
call fcn.00452b40
cmp al, 0xa
jne 0x47e452
mov eax, dword [esp + 0x48]
push eax
jmp 0x47e454
push 0
push ebp
mov ecx, esi
call fcn.0047c740
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0xc
Function at 0x47f430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f7f78
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.004ace00
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x38], 0
call fcn.004c06c0
push eax
lea ecx, [esp + 0xc]
call fcn.004ad000
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0047e750
add esp, 0x14
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
call fcn.004acf00
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret
Function at 0x47f6c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x218], eax
cmp byte [0x5ddcf4], 0
push ebp
mov ebp, dword [esp + 0x224]
jne 0x47f6fd
mov al, 1
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004d99c4
add esp, 0x21c
ret
push ebx
push esi
push edi
push 0x190
lea eax, [esp + 0x18]
push 0
push eax
call fcn.004db150
mov edi, dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x909
call edi
mov esi, eax
cmp esi, 0x276c
jne 0x47f7c5
mov ebx, 5
mov dword [esp + 0x10], 2
cmp ebx, 1
jl 0x47f78a
sub dword [esp + 0x10], 1
jns 0x47f758
mov dword [esp + 0x10], 9
sub ebx, 1
test ebx, ebx
je 0x47f78a
push 0x190
lea edx, [esp + 0x18]
push 0
push edx
call fcn.004db150
xor ecx, ecx
mov ch, byte [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov cl, bl
push ecx
call edi
mov esi, eax
cmp esi, 0x276c
je 0x47f741
test esi, esi
jne 0x47f7cd
mov edx, dword [esp + 0x10]
push edx
push ebx
lea eax, [esp + 0x1e0]
push str.Using_ws2_32.dll_version__d__d
push eax
call fcn.004daca4
mov edx, dword [ebp]
mov edx, dword [edx + 0x28]
add esp, 0x10
lea eax, [esp + 0x1d8]
push eax
push str.ws2_32_DLL_Version
mov ecx, ebp
call edx
jmp 0x47f85e
test esi, esi
je 0x47f85e
cmp esi, 0x276b
jne 0x47f7e2
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push str.The_underlying_network_subsystem_is_not_ready_for_network_communication.
jmp 0x47f85a
cmp esi, 0x276c
jne 0x47f7f7
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation.
jmp 0x47f85a
cmp esi, 0x2734
jne 0x47f80c
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress.
jmp 0x47f85a
cmp esi, 0x2753
jne 0x47f821
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached.
jmp 0x47f85a
cmp esi, 0x271e
jne 0x47f836
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push str.The_lpWSAData_is_not_a_valid_pointer.
jmp 0x47f85a
push esi
lea eax, [esp + 0x1a8]
push str.WSAStartup_error:_0x_x
push eax
call fcn.004daca4
mov edx, dword [ebp]
mov edx, dword [edx + 0x10]
add esp, 0xc
lea eax, [esp + 0x1a4]
push eax
mov ecx, ebp
call edx
mov ecx, dword [esp + 0x228]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
pop ebp
xor ecx, esp
mov byte [0x5ddcf4], 0
call fcn.004d99c4
add esp, 0x21c
ret
Function at 0x47fc80
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x4f8048
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
or ebp, 0xffffffff
cmp byte [0x5ddcf4], 0
je 0x47fcf4
lea ecx, [esp + 0x14]
call fcn.00468330
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x5c], 0
call fcn.0047f6c0
add esp, 4
test al, al
lea ecx, [esp + 0x14]
jne 0x47fceb
mov dword [esp + 0x58], 0xffffffff
call fcn.00468350
jmp 0x47fe75
mov dword [esp + 0x58], ebp
call fcn.00468350
mov esi, dword [esp + 0x60]
mov edi, dword [sym.imp.WS2_32.dll_gethostbyname]
push esi
call edi
test eax, eax
jne 0x47fe77
push esi
lea ecx, [esp + 0x38]
call fcn.00451b50
mov ebx, 1
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x5c], ebx
call fcn.00451b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 2
call fcn.00451070
push 0x20
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 9
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0xd
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0xa
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x27
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x22
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x3c
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x3e
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x3a
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x40
lea ecx, [esp + 0x1c]
call fcn.00452b60
push 0x3f
lea ecx, [esp + 0x1c]
call fcn.00452b60
lea ecx, [esp + 0x18]
call fcn.004c49f0
test eax, eax
lea ecx, [esp + 0x18]
je 0x47fe5f
call fcn.00452970
lea ecx, [esp + 0x18]
call fcn.004c49f0
lea ecx, [esp + 0x34]
mov esi, eax
call fcn.004c49f0
cmp esi, eax
je 0x47fe2c
lea ecx, [esp + 0x18]
call fcn.004c06c0
push eax
call edi
mov esi, eax
test esi, esi
je 0x47fe2c
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], bl
call fcn.00451e70
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], ebp
call fcn.00451e70
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
push 0x2e
lea ecx, [esp + 0x1c]
call fcn.00452f50
cmp eax, ebx
jne 0x47fe5b
push str.www.
lea ecx, [esp + 0x1c]
call fcn.00451300
lea ecx, [esp + 0x18]
call fcn.004c06c0
push eax
call edi
mov esi, eax
test esi, esi
jne 0x47fdfc
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], bl
call fcn.00451e70
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], ebp
call fcn.00451e70
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
Function at 0x480300
Capabilities:
Get socket status

Disassembly:
mov eax, dword [ecx + 0x4c]
sub esp, 0x10c
cmp eax, 0xffffffff
jne 0x48032c
mov ecx, dword [esp + 0x114]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.invalid_socket__not_ready_for_writing.
call edx
xor al, al
add esp, 0x10c
ret 8
mov ecx, dword [esp + 0x110]
test ecx, ecx
jne 0x48033c
mov ecx, 0x5460
mov dword [esp + 0xc], eax
lea eax, [esp]
push eax
push 0
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x480375
push str.select_returned_a_socket_error
jmp 0x48038a
cmp eax, 1
jne 0x480385
mov al, al
add esp, 0x10c
ret 8
push str.socket_is_not_ready_for_writing
mov ecx, dword [esp + 0x118]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
xor al, al
add esp, 0x10c
ret 8

Function at 0x4803b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push esi
mov esi, dword [ecx + 0x4c]
cmp esi, 0xffffffff
jne 0x4803de
mov ecx, dword [esp + 0x118]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.invalid_socket__not_ready_for_writing.
call edx
xor al, al
pop esi
add esp, 0x10c
ret 8
mov ecx, dword [esp + 0x114]
test ecx, ecx
jne 0x4803ee
mov ecx, 0x1499700
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp + 4], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
lea eax, [esp + 4]
push eax
push 0
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x48043c
push str.select_returned_a_socket_error
jmp 0x480452
cmp eax, 1
jne 0x48044d
mov al, al
pop esi
add esp, 0x10c
ret 8
push str.socket_is_not_ready_for_writing
mov ecx, dword [esp + 0x11c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
xor al, al
pop esi
add esp, 0x10c
ret 8