joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4490f9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x44912c
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x449127
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x449156
mov edx, dword [edi + 0x18]
push esi
mov esi, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x14]
cmovbe esi, ecx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.0049eca0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x4492e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4492f2
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4493b1
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
sub edi, 1
jne 0x44930a
pop edi
test esi, esi
je 0x4493cd
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ce0d8]
inc edx
sub esi, 1
jne 0x4493b5
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x44f1f5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x44f262
cmp dword [esi + 0x10], 0
je 0x44f262
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00457d60
mov ebx, esp
test ebx, ebx
je 0x44f262
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1b8
call fcn.0041f730
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0041e07a
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457808
leave
ret 0x10
Function at 0x44fee7
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x4c48f4
call fcn.00457873
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.0041c010
push eax
lea ecx, [ebp - 0x94]
call fcn.0041f533
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0041c016
mov ecx, eax
call fcn.0041fd25
test al, al
je 0x44ffd5
push ebx
lea ecx, [ebp - 0x94]
call fcn.0041f7cd
push edi
push 0x80
push 3
push edi
push 1
push connect
lea ecx, [ebp - 0x94]
call fcn.00418e1a
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44ff78
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041f68e
jmp 0x4500b6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x44ff64
push esi
mov dword [ebp - 0x2c8], edi
call fcn.00457b5c
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x4500a1
push edi
call fcn.00434c8a
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041f68e
jmp 0x4500b4
call fcn.0041c016
push eax
lea ecx, [ebp - 0x94]
call fcn.0041f7b0
call fcn.0041c10e
test al, al
je 0x44fff6
call fcn.0041c01c
jmp 0x45000d
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00418e1a
push eax
call fcn.00446b33
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x44ff64
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.00446573
add esp, 0x14
test eax, eax
jne 0x44ff64
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x44ff64
push esi
call fcn.00457b5c
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.00446f0a
add esp, 0x18
test eax, eax
je 0x450091
cmp eax, 0x600
je 0x450091
push edi
call fcn.00434c8a
pop ecx
call fcn.0041c10e
test al, al
jne 0x44ffc1
push ebx
call fcn.004463cf
jmp 0x44ffc0
call fcn.0041c10e
test al, al
jne 0x4500a1
push ebx
call fcn.004463cf
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041f68e
test edi, edi
jne 0x450128
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push connect
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x450124
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x450124
push esi
mov dword [ebp - 0x2d0], edi
call fcn.00457b5c
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x450120
push edi
call fcn.00434c8a
pop ecx
xor edi, edi
test edi, edi
jne 0x450128
xor eax, eax
jmp 0x450143
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.0045014b
push 1
push edi
mov esi, eax
call fcn.0045757d
pop ecx
pop ecx
mov eax, esi
call fcn.0045782e
ret 4
Function at 0x45204a
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
cmp esi, 0x4e
jne 0x452072
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, 8
jne 0x45212f
push ebx
push str.SysMonthCal32
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4520e8
push 0x20
pop edi
push edi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.0049e790
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], edi
push eax
push ebx
push 0x100e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x18], 0x1010003
je 0x4520e0
cmp dword [ebp - 0x18], 0x2010003
jne 0x45212b
xor eax, eax
inc eax
jmp 0x4521a9
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x14]
jl 0x452116
cmp eax, dword [ebp - 0xc]
jg 0x452116
cmp eax, dword [ebp - 0x10]
jl 0x452116
cmp eax, dword [ebp - 8]
jle 0x45212b
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 8
call fcn.004522e4
mov ebx, eax
mov eax, ebx
jmp 0x4521a9
mov eax, dword [ebp + 0xc]
mov ecx, 0x101
cmp esi, ecx
jne 0x45219d
cmp eax, 0x2e
je 0x452169
cmp eax, 8
je 0x452169
cmp eax, 0x1b
jne 0x45219d
push dword [ebp + 0x10]
push eax
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x14dc], 3
jmp 0x45218e
push dword [ebp + 0x10]
push eax
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x14dc], 2
mov ecx, dword [edi + 0x10]
call fcn.0045234c
push ebx
push ebx
push 0x10
mov ecx, edi
call fcn.0041f10a
mov eax, esi
jmp 0x4521a9
push dword [ebp + 0x10]
mov ecx, edi
push eax
push esi
call fcn.0041efd9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457808
leave
ret 0xc
Function at 0x4606f0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x460739
mov al, byte [esi]
push eax
call fcn.0046d060
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x460717
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x469710
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x6d0], 0
je 0x469797
cmp dword [esi + 0x1a4], 0
je 0x469761
push esi
call fcn.0045c0f0
push 1
push esi
mov byte [ebp + 8], al
call fcn.0045c330
push dword [esi + 0x154]
mov eax, dword [esi + 0x1a4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
push dword [ebp + 8]
push esi
call fcn.0045c330
add esp, 0x28
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x469797
push dword [esi + 0x150]
lea eax, [eax + eax*2]
push 1
add eax, 0x4d5a94
push 2
push eax
call fcn.004a83b9
push dword [esi + 0x150]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004a83b9
add esp, 0x20
pop esi
pop ebp
ret

Function at 0x46b290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.0046b2c0
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.004b7b09
Function at 0x46b510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x46b530
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x4d5ca0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x4d5cb0
push esi
mov dword [ebp - 8], ebx
call fcn.004b2a01
add esp, 8
test eax, eax
je 0x46b57c
test ebx, ebx
je 0x46b56c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x46b5a5
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46b5a5
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x46b668
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46b5c1
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x4f23b4]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46b65e
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x46b65e
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46b600
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46b620
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x46b635
mov eax, dword [ebp - 8]
test eax, eax
je 0x46b655
push 8
push 0
push ebx
call eax
jmp 0x46b65c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x4f23b8]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x46b680
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
je 0x46b6d9
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x46b6c6
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x46b6c0
shr eax, 8
cmp al, 2
je 0x46b6d9
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457808
mov esp, ebp
pop ebp
ret
push str.iphlpapi.dll
call fcn.0046b510
add esp, 4
mov dword [0x4f4fc8], eax
test eax, eax
je 0x46b70c
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x4f4fc4]
test eax, eax
cmovne ecx, eax
mov dword [0x4f4fc4], ecx
push 3
push 2
push 0
push 0
push 6
call fcn.004968e0
add esp, 0x14
test al, al
setne byte [0x4f61cc]
push 0x4f61d0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00457808
mov esp, ebp
pop ebp
ret

Function at 0x46e020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46e03e
cmp dword [esi + 0x78], 0
je 0x46e03e
push 2
push 3
push esi
call fcn.0046d7a0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.0046da70
add esp, 4
test esi, esi
je 0x46e05e
cmp dword [esi + 0x78], 0
je 0x46e05e
push 3
push esi
call fcn.0046d7e0
add esp, 8
pop esi
pop ebp
ret

Function at 0x46e110
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46e151
mov eax, dword [esi + 0x70]
cmp byte [eax + 0xf0], 0
jne 0x46e144
push 0
call fcn.0046e110
add esp, 4
test al, al
mov eax, dword [esi + 0x70]
setne cl
inc cl
mov byte [eax + 0xf0], cl
mov eax, dword [esi + 0x70]
cmp byte [eax + 0xf0], 2
pop esi
sete al
pop ebp
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x46e167
xor al, al
pop esi
pop ebp
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
pop ebp
ret
Function at 0x4783b0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4783cb
cmp dword [edi], 0
jne 0x4783dd
test esi, esi
je 0x4783d4
cmp dword [esi], 0
jne 0x4783dd
test ebx, ebx
je 0x478426
cmp dword [ebx], 0
je 0x478426
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push eax
call fcn.0049b030
add esp, 0xc
test ebx, ebx
je 0x4783f8
cmp dword [ebx], 0
jne 0x4783fa
xor ebx, ebx
test esi, esi
je 0x478403
cmp dword [esi], 0
jne 0x478405
xor esi, esi
test edi, edi
je 0x47840e
cmp dword [edi], 0
jne 0x478410
xor edi, edi
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00478360
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47b200
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00461070
push dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call fcn.00479bb0
push dword [ebp + 0xc]
mov edi, eax
call fcn.00479bb0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x47b287
lea eax, [ebp - 0x20]
push eax
call fcn.00461070
movups xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.00461120
add esp, 0x20
test edx, edx
ja 0x47b2aa
jb 0x47b275
cmp eax, 0x3e8
ja 0x47b2aa
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x47b240
test edi, edi
je 0x47b294
push edi
call fcn.004a2dbe
add esp, 4
test esi, esi
je 0x47b2a1
push esi
call fcn.004a2dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x47b2b7
push edi
call fcn.004a2dbe
add esp, 4
test esi, esi
je 0x47b2c4
push esi
call fcn.004a2dbe
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b690
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x47b80d
push esi
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x47b7f9
push edi
nop dword [eax]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47b6ee
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47b6e0
sub eax, edx
lea ecx, [eax + 1]
jmp 0x47b6f0
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 8], ecx
cmp eax, 2
jne 0x47b702
mov eax, 0x10
jmp 0x47b710
cmp eax, 0x17
jne 0x47b7b5
mov eax, 0x1c
cmp dword [esi + 0x18], 0
mov dword [ebp - 4], eax
je 0x47b7b5
mov edx, dword [esi + 0x10]
test edx, edx
je 0x47b7b5
cmp edx, eax
jb 0x47b7b5
add ecx, 0x20
add eax, ecx
push eax
call dword [0x4f23b4]
mov edi, eax
add esp, 4
test edi, edi
je 0x47b7ee
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x20]
push ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x18]
push eax
call fcn.0049eca0
mov edx, dword [ebp - 8]
add esp, 0xc
test edx, edx
je 0x47b7a3
mov eax, dword [edi + 0x18]
add eax, dword [ebp - 4]
push edx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.0049eca0
add esp, 0xc
mov eax, dword [ebp - 0xc]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0x47b7b2
mov dword [eax + 0x1c], edi
mov dword [ebp - 0xc], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x47b6d0
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
pop edi
test eax, eax
je 0x47b7d2
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x47b7f5
push ebx
call fcn.0047b660
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 8
jmp 0x47b7c3
test ebx, ebx
jne 0x47b805
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47bc20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.004a42d1
add esp, 0x18
test eax, eax
je 0x47bc42
cmp eax, 0xffffffff
jne 0x47bc44
xor eax, eax
pop ebp
ret

Function at 0x47bda0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0049e790
add esp, 0xc
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
pop ebp
ret
Function at 0x481840
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
mov ebx, dword [edi + 0xc]
mov esi, dword [ebx + 0x124]
push esi
mov dword [ebp - 0x88], 0xffffffff
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4818b6
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0x88], eax
jmp 0x4818bc
mov eax, dword [ebp - 0x88]
cmp eax, 0xffffffff
jne 0x4818e5
push str.Error_accept__ing_server_connect
push edi
call fcn.004697a0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457808
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server
push edi
call fcn.00469860
mov byte [ebx + 0x1cd], 0
push 1
push dword [ebp - 0x88]
call fcn.0049b0e0
lea eax, [ebp - 0x88]
push eax
push 1
push ebx
push edi
call fcn.00491bd0
add esp, 0x20
test eax, eax
jne 0x481974
cmp dword [edi + 0x1ac], eax
je 0x481972
push 1
push edi
call fcn.0045c330
mov eax, dword [edi + 0x1ac]
push 1
push dword [ebp - 0x88]
push dword [edi + 0x1b0]
call eax
push 0
push edi
mov esi, eax
call fcn.0045c330
add esp, 0x1c
test esi, esi
je 0x481972
push ebx
push edi
call fcn.00481dd0
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457808
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457808
mov esp, ebp
pop ebp
ret

Function at 0x483e00
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x483e32
push str.Couldnt_set_desired_mode
push esi
call fcn.004697a0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x483e49
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.00469860
add esp, 0xc
mov al, byte [ebp + 0x10]
cmp al, 0x13
jne 0x483e61
push ebx
push esi
call fcn.00483ac0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x14
jne 0x483e75
push esi
call fcn.00482b50
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x15
jne 0x483e89
push esi
call fcn.00483aa0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x16
jne 0x483e98
push esi
call fcn.00483ce0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret