joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593205
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x4bd64e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x4bd674
mov edx, eax
nop dword [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4bd660
mov edx, dword [ebp - 0x10]
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.004bda00
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4bd691
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x4bd7da
cmp dword [0x622e18], 0x71c71c7
je 0x4bd7f0
mov dword [ebp - 0x20], 0x622e14
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.00553ee1
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00428970
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x622e18]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5e2f00]
mov eax, dword [0x622e2c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5e2f00]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x622e10]
comiss xmm2, xmm1
jbe 0x4bd787
divss xmm0, xmm1
call fcn.004a6e40
call fcn.005545d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x622e2c]
cmp eax, ecx
jae 0x4bd763
cmp eax, 0x200
jae 0x4bd761
shl eax, 3
cmp eax, ecx
jae 0x4bd763
mov eax, ecx
push eax
call fcn.004bd800
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004bda00
mov ecx, dword [0x622e18]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x4bd78a
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x622e18], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x622e1c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x622e28]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x622e14]
jne 0x4bd7be
mov dword [ecx + eax*8], edi
jmp 0x4bd7d0
cmp esi, edx
jne 0x4bd7c7
mov dword [ecx + eax*8], edi
jmp 0x4bd7d4
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4bd7d4
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0053ec92
int3
Function at 0x4bf700
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WS2_32.dll_connect]

Function at 0x4bf850
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WS2_32.dll_inet_pton]
Function at 0x4c5d50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593edd
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov eax, dword [ebp + 0x14]
mov ecx, str.GetLastErrorMessage
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x40], edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c5dc6
test dx, dx
je 0x4c5dc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c5dc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c5da0
xor eax, eax
jmp 0x4c5dcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c5de5
cmp dword [ebx + 0x18], 0x10
lea ecx, [ebx + 4]
jb 0x4c5ddb
mov ecx, dword [ebx + 4]
mov dword [ebx + 0x14], 0
mov byte [ecx], 0
xorps xmm0, xmm0
mov dword [ebp - 0x3c], vtable.McAfee::Script::ScriptVariable.0
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.004b15e0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.004b1330
mov ecx, esi
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c5e40
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x38]
call fcn.00425790
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0x38]
cmp dword [ebp - 0x24], 8
mov edx, 0x811c9dc5
cmovae esi, dword [ebp - 0x38]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x4c5e86
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4c5e75
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.004a6b90
mov esi, dword [eax + 4]
test esi, esi
jne 0x4c5ea1
mov esi, dword [ebx + 0x20]
lea ecx, [ebp - 0x38]
call fcn.00425730
cmp esi, dword [ebx + 0x20]
jne 0x4c5ec0
sub esp, 0xc
mov ecx, ebx
push dword [ebp - 0x18]
call fcn.004c5a60
jmp 0x4c5f41
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
test edi, edi
je 0x4c5f5f
mov eax, dword [edi]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
push dword [ebp - 0x40]
call dword [0x5a0478]
mov ecx, edi
call esi
xor eax, eax
jmp 0x4c5f41
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00553cca
mov esp, ebp
pop ebp
ret 0x10
call fcn.0053ec55
int3
Function at 0x4ca320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xc], esi
mov eax, dword [esi + 4]
test eax, eax
je 0x4ca340
push ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
movzx eax, bl
lea edi, [esi + 0x24]
xor eax, 0x811c9dc5
mov dword [ebp - 8], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004ca9e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x4ca39e
mov eax, dword [edi + 4]
cmp eax, dword [esi + 0x28]
je 0x4ca470
mov esi, dword [eax + 0x14]
test esi, esi
je 0x4ca3b5
lock inc dword [esi + 4]
mov esi, dword [eax + 0x14]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.004ca9e0
or ebx, 0xffffffff
mov edi, dword [eax + 4]
test edi, edi
je 0x4ca44e
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 0x3c]
and ecx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x4ca400
cmp eax, edi
jne 0x4ca3f8
mov eax, dword [edx + 0x28]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x4ca408
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4ca408
cmp eax, edi
jne 0x4ca408
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
dec dword [edx + 0x2c]
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov ebx, dword [edi + 0x14]
test ebx, ebx
je 0x4ca440
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x4ca440
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
or eax, 0xffffffff
lock xadd dword [ebx + 8], eax
jne 0x4ca440
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push 0x18
push edi
call fcn.00554162
add esp, 8
or ebx, 0xffffffff
test esi, esi
je 0x4ca470
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4ca470
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x4ca470
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ca480
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x594785
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
sar eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x24]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004ca9e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x4ca50c
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x28]
jne 0x4ca527
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 0x14]
mov cl, byte [eax + 0xc]
mov byte [ebp - 0x2c], cl
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4ca541
lock inc dword [edi + 4]
mov edi, dword [eax + 0x14]
mov dword [ebp - 0x14], edi
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x4ca559
lock inc dword [edi + 4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 1
cmp cl, 1
jne 0x4ca57d
mov eax, dword [esi]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a0478]
mov ecx, dword [ebp - 0x18]
call esi
mov byte [ebp - 4], 2
mov eax, dword [ebx]
push str.OnTimeout
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x5a0478]
mov ecx, ebx
call esi
jmp 0x4ca5ce
test edi, edi
je 0x4ca613
or esi, 0xffffffff
lea ebx, [edi + 4]
mov eax, esi
lock xadd dword [ebx], eax
jne 0x4ca5f6
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x4ca5f6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, esi
lock xadd dword [ebx], eax
jne 0x4ca613
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x4ca613
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ca7f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x594845
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004ca9e0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4ca883
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xaaaaaaa
je 0x4ca9cc
lea eax, [edi + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x14], 0
call fcn.00553ee1
mov ecx, dword [ebx]
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
add esp, 4
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 1
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x5e2f00]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5e2f00]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x4ca96b
divss xmm0, xmm3
call fcn.004a6e40
call fcn.005545d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x4ca94a
cmp ebx, 0x200
jae 0x4ca948
shl ebx, 3
cmp ebx, ecx
jae 0x4ca94a
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.004cab20
push dword [ebp - 0x10]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004ca9e0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x4ca96e
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x18]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x14]
jne 0x4ca99c
mov dword [ecx + eax*8], esi
jmp 0x4ca9ab
cmp edi, edx
jne 0x4ca9a5
mov dword [ecx + eax*8], esi
jmp 0x4ca9af
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4ca9af
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0053ec92
int3
Function at 0x4cab20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x4cac83
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.004a6a90
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x4cac56
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x4cabd6
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x4cac49
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x4cac10
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x4cac08
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x4cac49
mov edi, eax
cmp dword [ebp - 4], eax
je 0x4cac26
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x4cac5f
cmp dword [ebp - 4], eax
jne 0x4cac17
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x4cab82
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x4cac49
push str.invalid_hash_bucket_count
call fcn.0053ec92
int3
Function at 0x4d0e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x61f190
push 0
call fcn.00553bde
mov edi, eax
mov dword [ebp - 8], 1
test edi, edi
je 0x4d103d
mov eax, dword [ebp + 8]
shr eax, 4
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
movzx eax, cx
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
je 0x4d0f2c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4d0f2c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4d0f2c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4d0f22
cmp esi, edx
jae 0x4d0f2c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4d0f10
cmp esi, edx
jae 0x4d0f2c
cmp word [esi], 0
jne 0x4d0f4d
mov ecx, dword [ebp - 8]
push ecx
inc ecx
mov dword [ebp - 8], ecx
mov ecx, 0x61f190
call fcn.00553bde
mov edi, eax
test edi, edi
je 0x4d103d
mov eax, dword [ebp - 0xc]
jmp 0x4d0ed0
test edi, edi
je 0x4d103d
mov eax, dword [ebp - 0x10]
inc eax
push 6
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4d103d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4d103d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4d103d
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and ebx, 0xf
jbe 0x4d0fba
cmp esi, ecx
jae 0x4d103d
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ebx, 1
jne 0x4d0fa4
cmp esi, ecx
jae 0x4d103d
movzx eax, word [esi]
test ax, ax
je 0x4d103d
push 0
push 0
push 0
push 0
push eax
lea ebx, [esi + 2]
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x4d1048
mov ecx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ecx]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x4d1007
mov ecx, dword [ebp - 4]
push edi
call fcn.004d1060
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
push 0
push 0
push edi
push eax
movzx eax, word [esi]
push eax
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
cmp edi, dword [eax - 8]
jg 0x4d1048
mov dword [eax - 0xc], edi
mov eax, dword [ecx]
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0042d790
int3
Function at 0x4d1290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4d12e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4d12e9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4d12da
cmp esi, edx
jae 0x4d12e9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4d12c8
cmp esi, edx
jae 0x4d12e9
cmp word [esi], 0
je 0x4d12e9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4d20c0
Capabilities:
Convert ip address from string
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11
push 2
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x28], eax
test ecx, ecx
je 0x4d20f8
cmp ecx, 0xffffffff
je 0x4d20f8
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
jne 0x4d21af
cmp word [esi + 4], 0
jne 0x4d21af
lea eax, [ebp - 8]
mov dword [ebp - 0xc], str.127.0.0.1
push eax
push str.127.0.0.1
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x4d215a
push 5
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d21af
lea eax, [ebp - 0xc]
mov edx, str.E:BT38d8cfda_976b_47ad_8468_b269487b30aeScriptHostJavaScriptScriptablePluginsLoggingPlugin_srcSimpleIPv4UDPPacketSender.cpp
push eax
push str.Invalid_IP_Address_Format:__hs
push 0x38
push str.McAfee::Script::CSimpleIPv4UDPPacketSender::setServerAddr
mov ecx, 5
call fcn.00428a80
add esp, 0x10
jmp 0x4d21af
cmp eax, 0xffffffff
jne 0x4d2191
push 5
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d21af
lea eax, [ebp - 0xc]
mov edx, str.E:BT38d8cfda_976b_47ad_8468_b269487b30aeScriptHostJavaScriptScriptablePluginsLoggingPlugin_srcSimpleIPv4UDPPacketSender.cpp
push eax
push str.Failed_to_set_the_server_address_to__hs
push 0x3d
push str.McAfee::Script::CSimpleIPv4UDPPacketSender::setServerAddr
mov ecx, 5
call fcn.00428a80
add esp, 0x10
jmp 0x4d21af
mov eax, 2
push 0x202
mov word [esi + 4], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 6], ax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
push 0x10
lea eax, [esi + 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x28]
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d2217
push 5
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d2204
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
lea ecx, [esi + 6]
lea eax, [ebp - 8]
mov edx, str.E:BT38d8cfda_976b_47ad_8468_b269487b30aeScriptHostJavaScriptScriptablePluginsLoggingPlugin_srcSimpleIPv4UDPPacketSender.cpp
push eax
push str.Failed_to_send_datagram__Last_Error:_0x_08X
push 0x4d
push str.McAfee::Script::CSimpleIPv4UDPPacketSender::sendBuffer
call fcn.00428a80
add esp, 0x10
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553cca
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp + 0xc]
jae 0x4d224c
push 1
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d224c
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
sub esp, 0xc
call fcn.004d2260
add esp, 0x18
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00553cca
mov esp, ebp
pop ebp
ret 8