joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467d70
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x467e18
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [esp], eax
je 0x467e18
mov eax, dword [eax + 0xc]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
test ecx, ecx
je 0x467e06
mov ebx, dword [esp + 0x118]
xor ebp, ebp
mov edx, dword [eax + ebp]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [edx], 0x31
jne 0x467e06
cmp byte [edx + 1], 0x39
jne 0x467e06
cmp byte [edx + 2], 0x32
jne 0x467e06
mov ecx, dword [esp + 0x10]
add ebp, 4
mov eax, dword [ecx + 0xc]
cmp dword [eax + ebp], 0
jne 0x467db8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret 4
xor eax, eax
add esp, 0x104
ret 4
Function at 0x4681c0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4f241c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa80
push edi
push 0x5209fc
push SysReAllocStringLen
lea ecx, [esp + 0x428]
call fcn.004c4470
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
push 0x208
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x424]
push eax
push 0
push str.SoftwareRealNetworksPreferencesDT_Codecs
mov dword [esp + 0xa9c], 0
call fcn.004c44c0
test eax, eax
pop edi
je 0x46838b
mov ecx, dword [0x50d0e0]
mov dword [esp], ecx
lea edx, [esp + 0xc]
mov byte [esp + 0xa88], 1
push edx
call fcn.004debba
add esp, 4
dec eax
cmp word [esp + eax*2 + 0xc], 0x5c
jne 0x468269
lea eax, [esp + 0xc]
lea ecx, [esp]
push eax
push str._scook.dll
push ecx
jmp 0x468278
lea edx, [esp + 0xc]
lea eax, [esp]
push edx
push 0x517618
push eax
call fcn.004074f0
mov edx, dword [esp + 0xc]
add esp, 0xc
lea ecx, [esp + 0x830]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x468354
cmp dword [esp + 0x850], 0x10000
je 0x46831c
mov eax, dword [0x50d0e0]
mov dword [esp + 8], eax
mov ecx, dword [0x525768]
lea edx, [esp + 8]
push ecx
push str._sCodecscook.dll
push edx
mov byte [esp + 0xa94], 2
call fcn.004074f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
add esp, 0xc
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [esp + 8]
mov ecx, dword [0x50d0e4]
mov byte [esp + 0xa88], 1
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x46831c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x46831c
mov eax, dword [esp + 8]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp]
mov edx, dword [0x50d0e4]
mov byte [esp + 0xa88], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x468404
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x468404
mov edx, dword [esp]
jmp 0x4683f8
mov eax, dword [esp]
mov edx, dword [0x50d0e4]
mov byte [esp + 0xa88], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x46838b
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x46838b
mov edx, dword [esp]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [0x50d0e0]
mov dword [esp + 4], eax
mov ecx, dword [0x525768]
lea edx, [esp + 4]
push ecx
push str._sCodecs_
push edx
mov byte [esp + 0xa94], 3
call fcn.004074f0
mov eax, dword [esp + 0x10]
add esp, 0xc
lea ecx, [esp + 0x41c]
push eax
push 0
push str.SoftwareRealNetworksPreferencesDT_Codecs
call fcn.004c4870
mov eax, dword [esp + 4]
mov edx, dword [0x50d0e4]
mov byte [esp + 0xa88], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x468404
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x468404
mov edx, dword [esp + 4]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
lea ecx, [esp + 0x41c]
mov dword [esp + 0xa88], 0xffffffff
call fcn.004c44b0
mov ecx, dword [esp + 0xa80]
mov dword fs:[0], ecx
add esp, 0xa8c
ret
Function at 0x4703d0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push 1
push 0
push esi
push str.IEXPLORE.EXE
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [0x50d0e4]
lea eax, [esi - 0xc]
cmp eax, ecx
je 0x470410
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x470410
push esi
call fcn.004de3a6
add esp, 4
pop esi
ret 4
Function at 0x470c70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x110]
push ecx
push str._s_system32driversetchosts
push edx
call fcn.004df42f
add esp, 0xc
lea eax, [esp + 0xc]
push 0x180
push 0x102
push eax
call fcn.004e0a4f
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x470d84
push esi
call fcn.004e09c5
push esi
mov ebx, eax
call fcn.004e08e5
add esp, 8
test ebx, ebx
jle 0x470d84
push ebx
call fcn.004de48f
lea ecx, [esp + 0x10]
push 0x517cd8
push ecx
mov edi, eax
call fcn.004deb38
mov esi, eax
add esp, 0xc
test esi, esi
je 0x470d7b
push esi
push ebx
push 1
push edi
call fcn.004dfc8a
push str.qvod.com
push edi
mov ebx, eax
call fcn.004df6d0
add esp, 0x18
test eax, eax
je 0x470d72
mov ecx, eax
mov edx, 0x30303030
add eax, 8
push str.qvod.com
mov dword [ecx], edx
push eax
mov dword [ecx + 4], edx
call fcn.004df6d0
add esp, 8
test eax, eax
jne 0x470d3c
push eax
push eax
push esi
call fcn.004dfda1
push esi
push ebx
push 1
push edi
call fcn.004df481
add esp, 0x1c
push esi
call fcn.004dea4e
add esp, 4
push edi
call fcn.004de3a6
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x488600
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp ebx, eax
mov dword [ebp - 4], eax
jne 0x48862f
mov dword [ebp - 0x10], eax
jmp 0x488661
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.004ded50
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x10], esi
mov edi, dword [ebp - 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
add ebx, 0xc
push ebx
call fcn.004de48f
mov ecx, ebx
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
mov dword [ebp - 0x14], esi
rep stosb byte es:[edi], al
call sub.WS2_32.dll_htonl
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4886ab
push 0x402
jmp 0x4886b0
push 0x403
call sub.WS2_32.dll_htonl
mov edi, dword [ebp - 0x10]
mov dword [esi + 4], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esi + 0xb]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp + 8]
push esi
push edi
call sub.WS2_32.dll_send
test eax, eax
jg 0x4886fe
test esi, esi
je 0x48871d
push esi
call fcn.004de3a6
add esp, 4
jmp 0x48871d
test esi, esi
je 0x48870b
push esi
call fcn.004de3a6
add esp, 4
push 0
lea edx, [ebp - 0x20]
push 0xc
push edx
push edi
call sub.WS2_32.dll_recv
test eax, eax
jg 0x488749
mov eax, dword [ebp + 0xc]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x488744
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x488744
push esi
call fcn.004de3a6
add esp, 4
or eax, 0xffffffff
jmp 0x4887a4
mov al, byte [ebp - 0x18]
test al, al
mov eax, dword [ebp + 0xc]
jne 0x48877b
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x488777
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x488777
push esi
call fcn.004de3a6
add esp, 4
xor eax, eax
jmp 0x4887a4
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x48879f
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x48879f
push esi
call fcn.004de3a6
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48f860
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, dword [esi + 0x14]
cmp ecx, edi
jl 0x48f889
cmp dword [esi + 0x18], edi
je 0x48f889
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x48f889
push ecx
call eax
mov eax, dword [esi + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0x1c]
mov dword [esi], edi
cmp eax, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x18], edi
je 0x48f8be
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.004de3a6
add esp, 4
mov dword [esi + 0x1c], edi
pop edi
pop esi
ret
Function at 0x4939c0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push 4
push eax
push 0x1005
push 0xffff
push ebx
mov dword [esp + 0x24], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
test eax, eax
mov esi, eax
jle 0x493a14
mov ebp, dword [sym.imp.WS2_32.dll_send]
push 0
push esi
push edi
push ebx
call ebp
test eax, eax
jle 0x493a14
sub esi, eax
add edi, eax
test esi, esi
jg 0x4939fd
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x493a20
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea eax, [esp + 0x10]
push 4
push eax
push 0x1006
push 0xffff
push ebp
mov dword [esp + 0x24], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
test edi, edi
mov esi, ebx
jbe 0x493a72
mov ecx, ebx
push 0
sub ecx, esi
add ecx, edi
push ecx
push esi
push ebp
call dword [sym.imp.WS2_32.dll_recv]
add esi, eax
mov edx, esi
sub edx, ebx
cmp edx, edi
jb 0x493a57
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x493a80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create raw socket
Create tcp socket

Disassembly:
sub esp, 0x130
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
mov ebp, ecx
push 0x503
call esi
push pe_nt_image_headers32
mov dword [esp + 0x38], eax
call esi
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14c]
push eax
call esi
mov ecx, dword [esp + 0x150]
mov dword [esp + 0x38], eax
push ecx
call esi
mov edx, dword [esp + 0x144]
mov dword [esp + 0x3c], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x100
jb 0x493aef
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x130
ret 0x18
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x154]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov word [esp + 0x24], 2
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x158]
mov dword [esp + 0x24], eax
push ecx
call dword [sym.imp.WS2_32.dll_htons]
push 6
push 1
push 2
mov word [esp + 0x2e], ax
call dword [sym.imp.WS2_32.dll_socket]
lea edx, [esp + 0x20]
mov edi, eax
push 0x10
push edx
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x493b77
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x130
ret 0x18
lea eax, [esp + 0x30]
push pe_nt_image_headers32
push eax
push edi
mov ecx, ebp
call fcn.004939c0
cmp eax, 0x110
je 0x493ba9
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x130
ret 0x18
lea ecx, [esp + 0x10]
push 0x10
push ecx
push edi
mov ecx, ebp
call fcn.00493a20
cmp eax, 0x10
je 0x493bd6
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x130
ret 0x18
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov ebx, dword [esp + 0x148]
mov esi, eax
test esi, esi
jle 0x493c04
push esi
push ebx
push edi
mov ecx, ebp
call fcn.00493a20
test eax, eax
jle 0x493c25
sub esi, eax
add ebx, eax
test esi, esi
jg 0x493bee
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, byte [esp + 0x18]
test al, al
je 0x493c3e
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x130
ret 0x18
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x130
ret 0x18
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0x18
Function at 0x493c60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create raw socket
Create tcp socket

Disassembly:
sub esp, 0x138
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_htonl]
push ebp
push esi
push edi
mov ebp, ecx
push 0x504
call ebx
push 0x114
mov dword [esp + 0x3c], eax
call ebx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x158]
push eax
call ebx
mov ecx, dword [esp + 0x15c]
mov dword [esp + 0x3c], eax
push ecx
call ebx
mov edx, dword [esp + 0x14c]
mov dword [esp + 0x40], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x100
jb 0x493ccf
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x138
ret 0x1c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x150]
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jb 0x493d1c
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x138
ret 0x1c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x144]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov word [esp + 0x14], 2
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x160]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [esp + 0x164]
mov dword [esp + 0x18], eax
push edx
call dword [sym.imp.WS2_32.dll_htons]
push 6
push 1
push 2
mov word [esp + 0x22], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [esp + 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x493da9
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x138
ret 0x1c
lea ecx, [esp + 0x34]
push 0x114
push ecx
push esi
mov ecx, ebp
call fcn.004939c0
cmp eax, 0x114
je 0x493ddb
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x138
ret 0x1c
mov edi, dword [esp + 0x15c]
mov edx, dword [esp + 0x154]
push edi
push edx
push esi
mov ecx, ebp
call fcn.004939c0
cmp edi, eax
je 0x493e10
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x138
ret 0x1c
lea eax, [esp + 0x24]
push 0x10
push eax
push esi
mov ecx, ebp
call fcn.00493a20
test eax, eax
push esi
jg 0x493e3c
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x138
ret 0x1c
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x30]
push ecx
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret 0x1c
Function at 0x494bc0
Capabilities:
Resolve dns

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
je 0x494dc8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
inc ebp
push ebp
call fcn.004de48f
mov ecx, ebp
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004ed62c
push str.http:__
push ebx
call fcn.004df6d0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x494c44
test ebx, ebx
je 0x494dc8
jmp 0x494dbf
mov edi, str.http:__
or ecx, 0xffffffff
xor eax, eax
push 0x519cf4
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
push edx
mov dword [esp + 0x24], edx
call fcn.004df6d0
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x494dbb
add ebp, ebx
cmp eax, ebp
mov dword [esp + 0x14], ebp
ja 0x494dbb
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub esi, ecx
inc esi
push esi
call fcn.004de48f
mov ecx, esi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
dec esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
push esi
push eax
push ebp
call fcn.004de950
mov eax, dword [esp + 0x20]
push 0x510aa4
push eax
lea esi, [eax + 1]
mov dword [esp + 0x34], esi
call fcn.004df6d0
add esp, 0x18
test eax, eax
je 0x494da7
cmp eax, dword [esp + 0x14]
ja 0x494da7
sub eax, esi
inc eax
mov esi, eax
push esi
call fcn.004de48f
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x14], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
dec esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
push eax
push esi
call fcn.004de950
push esi
call fcn.004dfbc5
add esp, 0x14
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x24]
push ebp
mov word [ecx], ax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x494d55
test ebx, ebx
je 0x494d41
push ebx
call fcn.004de3a6
add esp, 4
test ebp, ebp
je 0x494d4e
push ebp
call fcn.004de3a6
add esp, 4
test esi, esi
je 0x494dc8
push esi
jmp 0x494dc0
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov edi, dword [esp + 0x20]
mov eax, ecx
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
je 0x494d7d
push ebx
call fcn.004de3a6
add esp, 4
test ebp, ebp
je 0x494d8a
push ebp
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x494d9b
push eax
call fcn.004de3a6
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
test ebx, ebx
je 0x494db4
push ebx
call fcn.004de3a6
add esp, 4
test ebp, ebp
je 0x494dc8
push ebp
jmp 0x494dc0
test ebx, ebx
je 0x494dc8
push ebx
call fcn.004de3a6
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret 0xc
Function at 0x4adb50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f733a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
push edi
mov byte [esi], al
call fcn.00411770
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x10]
push edi
mov dword [esp + 0x1c], edi
mov byte [ecx], dl
call fcn.00411770
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x20]
push edi
mov byte [esp + 0x1c], 1
mov byte [ecx], al
call fcn.00411770
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x30]
push edi
mov byte [esp + 0x1c], 2
mov byte [ecx], dl
call fcn.00411770
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x40]
push edi
mov byte [esp + 0x1c], 3
mov byte [ecx], al
call fcn.00411770
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x50]
push edi
mov byte [esp + 0x1c], 4
mov byte [ecx], dl
call fcn.00411770
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x60]
push edi
mov byte [esp + 0x1c], 5
mov byte [ecx], al
call fcn.00411770
lea ecx, [esp + 0xb]
mov byte [esp + 0x18], 6
push ecx
lea ecx, [esi + 0x78]
call fcn.004bc7e0
mov dl, byte [esp + 0xb]
mov cl, byte [esp + 0xb]
mov eax, 0x4fc294
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], eax
mov byte [esi + 0x90], dl
mov dl, byte [esp + 0xb]
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x88], eax
mov byte [esi + 0xa8], cl
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa0], eax
mov byte [esi + 0xc0], dl
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xb8], 0x4fc288
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret