joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d81e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6b75
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x168], edi
lea esi, [edi + 0xc]
mov dword [edi], vtable.io::Io.0
mov ecx, esi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 0x164], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414550
mov dword [esi], eax
lea eax, [edi + 0x14]
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [eax], vtable.plat::Timer::Callback.0
mov dword [esi], vtable.rdr::FdOutStream::Callback.0
mov dword [edi + 0x1c], vtable.io::FdHandler.0
mov dword [edi + 0x20], 0xffffffff
mov byte [edi + 0x24], 1
mov byte [edi + 0x28], 0
mov dword [edi], vtable.io::FdIo.0
mov dword [eax], vtable.io::FdIo.1.0
mov dword [esi], vtable.io::FdIo.2.0
mov dword [edi + 0x1c], vtable.io::FdIo.3.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], 0
mov byte [ebp - 4], 5
mov word [edi + 0x80], 0
mov dword [edi + 0x84], 0
call fcn.004bf810
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov byte [edi + 0x28], al
test ecx, ecx
js 0x4d83c9
cmp dword [edi + 0x20], 0
jge 0x4d83e8
mov al, byte [ebp + 0xc]
mov byte [edi + 0x24], al
push 0x3c
mov dword [edi + 0x20], ecx
call fcn.0054450d
add esp, 4
mov dword [ebp - 0x164], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x4d837a
push dword [ebp + 0x14]
mov ecx, eax
push dword [edi + 0x20]
call fcn.004e3ac0
jmp 0x4d837c
xor eax, eax
push 0x38
mov byte [ebp - 4], 5
mov dword [edi + 4], eax
call fcn.0054450d
add esp, 4
mov dword [ebp - 0x164], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x4d83aa
push dword [ebp + 0x18]
mov ecx, eax
push dword [edi + 0x20]
call fcn.004e3ec0
jmp 0x4d83ac
xor eax, eax
cmp byte [ebp + 0x1c], 0
mov dword [edi + 8], eax
mov byte [ebp - 4], 5
mov dword [eax + 0x30], esi
je 0x4d83c9
push 0
push dword [edi + 0x20]
call fcn.004bec90
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 0x18
push 0x37
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_baseio_fdio.cxx
push str.fd___0
lea ecx, [ebp - 0x160]
call fcn.00465850
push eax
call fcn.004658d0
int3
Function at 0x4d93f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6dc6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x613384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004d81e0
mov dword [esi], vtable.io::TcpIo.0
mov dword [esi + 0x14], vtable.io::TcpIo.1.0
mov dword [esi + 0x18], vtable.io::TcpIo.2.0
mov dword [esi + 0x1c], vtable.io::TcpIo.3.0
mov dword [ebp - 4], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], 5
jne 0x4d9524
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 1
push eax
push 1
push 6
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4d94ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.unable_to_setsockopt_TCP_NODELAY:__d
push 0x6185a8
call fcn.00406750
add esp, 0xc
mov ecx, esi
call fcn.004d9970
mov ecx, eax
call fcn.004813c0
test al, al
je 0x4d9524
mov ecx, esi
call fcn.004d9b80
mov ecx, eax
call fcn.004813c0
test al, al
je 0x4d9524
push 0xffffffffffffffff
push str.secureTransport
call fcn.00448d00
add esp, 8
mov dword [ebp + 0x10], eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 6
push eax
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0xc]
call fcn.00413bb0
push dword [ebp + 0x10]
call fcn.0054454b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4d9800
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0xc]
xor eax, 1
push 4
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 1
push 6
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4d9841
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.unable_to_setsockopt_TCP_NODELAY:__d
push 0x6185a8
call fcn.00406750
add esp, 0xc
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret
Function at 0x4d9ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6f31
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x613384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 4]
mov dword [edi], vtable.io::FdHandler.0
mov dword [edi + 4], 0xffffffff
mov byte [edi + 8], 0
mov byte [edi + 0xc], 0
lea esi, [ebx + 0x14]
mov dword [ebx], vtable.io::IpResolverMgr.0
push 0
mov dword [edi], vtable.io::IpResolverMgr.1.0
mov ecx, esi
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004d9ff0
mov dword [esi], eax
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], ebx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 2
call fcn.004bc250
mov dword [ebx + 0x40], eax
call fcn.004bf810
mov ecx, dword [ebx + 0x40]
push 1
push edi
call fcn.004bc090
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4de8d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a77bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x613384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x18], eax
lea eax, [edi + 0x40]
mov dword [edi + 8], edx
mov dword [edi + 0xc], esi
mov dword [edi + 0x14], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xffffffff
mov byte [edi + 0x2c], 0
mov dword [edi + 0x30], 0x150
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], eax
mov byte [edi + 0x3c], 1
lea eax, [edi + 0x590]
mov dword [ebp - 4], 0
mov dword [edi + 0x580], 0x150
mov dword [edi + 0x584], 0
mov dword [edi + 0x588], eax
mov byte [edi + 0x58c], 1
lea eax, [edi + 0xae0]
mov dword [edi + 0xad0], 0x150
mov dword [edi + 0xad4], 0
mov dword [edi + 0xad8], eax
mov byte [edi + 0xadc], 1
lea ecx, [edi + 0x1020]
mov dword [ebp + 8], ecx
lea eax, [ecx + 0x10]
mov dword [ecx], 0x80
mov dword [ecx + 4], 0
mov dword [ecx + 8], eax
mov byte [ecx + 0xc], 1
lea eax, [edx + 1]
mov byte [ebp - 4], 3
push eax
call fcn.004e1880
lea ecx, [edi + 0x1230]
mov dword [ebp + 8], ecx
lea eax, [ecx + 0x10]
mov dword [ecx], 0x14
mov dword [ecx + 4], 0
mov dword [ecx + 8], eax
mov byte [ecx + 0xc], 1
push esi
mov byte [ebp - 4], 5
call fcn.004e1880
lea ecx, [edi + 0x1290]
mov dword [ebp + 8], ecx
lea eax, [ecx + 0x10]
mov dword [ecx], 0x14
mov dword [ecx + 4], 0
mov dword [ecx + 8], eax
mov byte [ecx + 0xc], 1
push esi
mov byte [ebp - 4], 7
call fcn.004e1880
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4e3000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
cmp byte [esi + 0x58], 0
jne 0x4e3089
lea eax, [esi + 0x40]
push eax
push 0
push dword [ebp + 0xc]
push ecx
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4e306f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4e30a6
cmp byte [esi + 0x30], 0
mov byte [esi + 0x58], 1
je 0x4e3060
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 8
push dword [esi + 0x2c]
lea ecx, [esi + 0x54]
call fcn.004cd570
test al, al
je 0x4e30b1
push 1
mov ecx, esi
call fcn.004e2e40
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 8
push 0x43
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_baseoswinhandleinstream.cxx
push str._pending
lea ecx, [ebp - 0x154]
call fcn.00465850
push eax
call fcn.004658d0
push eax
push 0x5c7204
call fcn.004e3170
push str.Timed_out
lea ecx, [ebp - 0x148]
call fcn.004b9980
push 0x607af8
lea eax, [ebp - 0x148]
push eax
call fcn.005461fc
int3

Function at 0x4e31e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7a9c
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x160], edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x15c], eax
mov dword [edi + 4], vtable.os::RegKeyExistsCallback.0
mov dword [edi], vtable.os::RegKeyExistsMonitor.0
mov dword [edi + 4], vtable.os::RegKeyExistsMonitor.1.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0xf003f
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0xf003f
mov dword [edi + 0x28], 0
mov byte [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
lea esi, [edi + 0x38]
mov byte [edi + 0x34], 0
push 0
mov dword [ebp - 0x160], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x4e32e8
push dword [ebp + 0x10]
mov ecx, edi
mov byte [ebp - 4], 6
push dword [ebp - 0x15c]
mov byte [edi + 0x3c], 0
push ebx
call fcn.004e36d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEvent
lea ecx, [ebp - 0x158]
call fcn.0040a6b0
push 0x5f5000
lea eax, [ebp - 0x158]
push eax
call fcn.005461fc
int3
Function at 0x4e3b70
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp byte [ebp + 0x10], 0
mov ebx, 0x2710
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x20c], 0
je 0x4e3bbb
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], 1
cmp byte [ebp + 0x14], 0
je 0x4e3bd1
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x35c], 0
test esi, esi
js 0x4e3c24
lea eax, [esi - 1]
cmp eax, 0x7ffffffd
lea ecx, [esi + 1]
mov eax, 0x10624dd3
cmova ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x36c], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x36c]
mov dword [ebp - 0x35c], eax
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0047db50
mov ecx, eax
mov dword [ebp - 0x358], edx
mov eax, esi
add esp, 0xc
imul ebx
mov ebx, edx
mov edi, eax
test ebx, ebx
jg 0x4e3c63
jl 0x4e3c4c
test edi, edi
jae 0x4e3c63
xorps xmm0, xmm0
movlpd qword [ebp - 0x364], xmm0
mov ebx, dword [ebp - 0x360]
mov edi, dword [ebp - 0x364]
add edi, ecx
adc ebx, dword [ebp - 0x358]
cmp dword [ebp - 0x108], 0
mov dword [ebp - 0x358], 0
jne 0x4e3c90
cmp dword [ebp - 0x20c], 0
jne 0x4e3c90
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4e3cea
push dword [ebp - 0x35c]
lea eax, [ebp - 0x20c]
push 0
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x358], eax
test eax, eax
jns 0x4e3ce8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2714
jne 0x4e3d73
mov eax, dword [ebp - 0x358]
test eax, eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x20c], 0
jg 0x4e3d51
test esi, esi
js 0x4e3d51
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0047db50
add esp, 0xc
sub edi, eax
sbb ebx, edx
add edi, 0x270f
adc ebx, 0
cmp ebx, 0x1387
jg 0x4e3d3c
jl 0x4e3d1b
cmp edi, 0xffffd8f0
jae 0x4e3d3c
push 0
push 0x2710
push ebx
push edi
call fcn.00544c80
mov esi, eax
cmp edx, 0xffffffff
jl 0x4e3d4f
jg 0x4e3d4b
cmp esi, 0x80000000
jbe 0x4e3d4f
jmp 0x4e3d4b
mov esi, accept
mov dword [ebp - 0x360], 0
test esi, esi
jns 0x4e3d51
xor esi, esi
mov eax, dword [ebp - 0x358]
test eax, eax
js 0x4e3b89
mov ecx, dword [ebp - 4]
setne al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
push eax
push str.select
lea ecx, [ebp - 0x354]
call fcn.0040a6b0
push 0x5f5000
lea eax, [ebp - 0x354]
push eax
call fcn.005461fc
int3
Function at 0x4e3da0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x39], 0
jne 0x4e3e6e
push 0
push dword [ebp + 0xc]
push ebx
push dword [esi + 0x34]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x4e3e25
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x4e3e4d
call edi
cmp eax, 0x2714
je 0x4e3e12
call edi
cmp eax, 0x2733
jne 0x4e3e8f
cmp byte [esi + 0x30], 0
jne 0x4e3e38
push 0
push 1
push dword [esi + 0x2c]
push dword [esi + 0x34]
call fcn.004e3b70
add esp, 0x10
test al, al
je 0x4e3e6e
push 0
push dword [ebp + 0xc]
push ebx
push dword [esi + 0x34]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4e3dde
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 8
push str.End_of_IO_stream
lea ecx, [ebp - 0x148]
call fcn.0040b070
push 0x5f51a4
lea eax, [ebp - 0x148]
push eax
call fcn.005461fc
push str.Timed_out
lea ecx, [ebp - 0x148]
call fcn.004b9980
push 0x607af8
lea eax, [ebp - 0x148]
push eax
call fcn.005461fc
call sub.KERNEL32.dll_GetLastError
push eax
push str.read
lea ecx, [ebp - 0x14c]
call fcn.0040a6b0
push 0x5f5000
lea eax, [ebp - 0x14c]
push eax
call fcn.005461fc
int3

Function at 0x4e3ec0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
push 0xffffffffffffffff
mov dword [ebp - 4], esi
call fcn.004b9280
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
lea edi, [esi + 0x34]
mov dword [esi], vtable.rdr::FdOutStream.0
push edi
push 0x1001
push 0xffff
push eax
mov dword [esi + 0x28], eax
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [edi], 0
mov dword [ebp + 0xc], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4e3f3a
cmp dword [edi], 0x10000
jge 0x4e3f3a
push 4
push edi
push 0x1001
push 0xffff
push dword [esi + 0x28]
mov dword [edi], 0x10000
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [edi]
mov ecx, 0x8000
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
cmovl eax, ecx
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4e40c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7bdb
mov eax, dword fs:[0]
push eax
sub esp, 0x3f0
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3fc], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x34]
cmp ecx, eax
push 0
cmovl eax, ecx
push eax
push edx
push dword [esi + 0x28]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jns 0x4e41c8
call ebx
cmp eax, 0x2733
jne 0x4e4153
xor edi, edi
cmp byte [ebp + 0x10], 0
je 0x4e41c8
push 1
push edi
push dword [esi + 0x18]
push dword [esi + 0x28]
call fcn.004e3b70
add esp, 0x10
test al, al
je 0x4e4164
mov edx, dword [ebp - 0x3fc]
jmp 0x4e40ff
call ebx
cmp eax, 0x2714
jne 0x4e4178
mov edx, dword [ebp - 0x3fc]
jmp 0x4e40ff
mov ecx, esi
call fcn.004e4020
test al, al
je 0x4e421e
jmp 0x4e41fd
call ebx
push eax
push str.write
lea ecx, [ebp - 0x2a8]
call fcn.0040a6b0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004e4020
test al, al
jne 0x4e423b
lea eax, [ebp - 0x2a4]
push eax
push 0x5abc68
push 0x61863c
call fcn.00406750
add esp, 0xc
cmp byte [ebp + 0x10], 0
jne 0x4e425e
xor eax, eax
jmp 0x4e41df
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4e41dd
mov edx, dword [ecx]
test edi, edi
sete al
movzx eax, al
push eax
push esi
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 0xc
push str.Timed_out
lea ecx, [ebp - 0x154]
call fcn.004b9980
push 0x607af8
lea eax, [ebp - 0x154]
push eax
call fcn.005461fc
push 0x65
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_base_rdr_fdoutstream.cxx
push str.doesThrowErrors__
lea ecx, [ebp - 0x160]
call fcn.00465850
push eax
call fcn.004658d0
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x158]
call fcn.0045c6f0
push 0x5f5000
lea eax, [ebp - 0x158]
push eax
call fcn.005461fc
push 0x6c
push str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.6.xlabelcon_windows_64_rvcore_base_rdr_fdoutstream.cxx
push str._needWrite
lea ecx, [ebp - 0x3f8]
call fcn.00465850
lea ecx, [ebp - 0x2a8]
mov esi, eax
call fcn.0040f280
push eax
push 0x5abc68
push esi
call fcn.0042c940
add esp, 0xc
push eax
call fcn.004658d0
int3
Function at 0x4ef8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.004ec8a0
lea eax, [ebp - 0x1c]
push eax
call fcn.004ec8a0
mov edi, dword [ebp + 8]
add edi, 0x4c
push 0
push edi
call fcn.004ec800
add esp, 0x10
cmp eax, 1
je 0x4ef909
mov eax, 0xffffb080
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0
push esi
call fcn.004ec800
mov ecx, dword [ebp + 0x1c]
test eax, eax
push esi
sete al
mov byte [ecx], al
lea eax, [ebp - 0x10]
push eax
call fcn.004eafa0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4efa23
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004ee0f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4efa23
mov eax, dword [ebp + 0x1c]
movzx eax, byte [eax]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.005110b0
mov ebx, eax
add esp, 0xc
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x4efa23
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push ebx
push esi
call fcn.00546c70
add esp, 0xc
test edi, edi
je 0x4ef9cd
movzx eax, byte [ebp + 0x18]
mov dword [ebp + 8], eax
xor esi, esi
test eax, eax
je 0x4ef9c5
mov edi, ebx
nop word [eax + eax]
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.004ec800
add edi, dword [ebp + 0x14]
mov ecx, esi
shl al, cl
inc esi
mov ecx, dword [ebp + 0x10]
add esp, 8
or byte [ecx + ebx], al
mov eax, dword [ebp + 8]
cmp esi, eax
jb 0x4ef9a0
mov edi, dword [ebp + 0x14]
inc ebx
cmp ebx, edi
jb 0x4ef992
mov esi, dword [ebp + 0x10]
xor al, al
mov byte [ebp + 0xb], al
cmp edi, 1
jb 0x4efa20
mov bh, byte [esi]
nop dword [eax]
mov dl, byte [esi + 1]
inc esi
mov dh, bh
mov bl, 1
mov bh, dl
movzx ecx, dh
and dl, byte [ebp + 0xb]
xor bh, al
mov al, bh
and al, 1
sub bl, al
movzx eax, bl
imul ecx, eax
mov al, bh
shl bl, 7
or bl, dh
and al, cl
xor bh, cl
or al, dl
mov byte [esi], bh
mov byte [ebp + 0xb], al
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], esi
mov byte [eax], bl
mov al, byte [ebp + 0xb]
sub edi, 1
jne 0x4ef9e0
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
call fcn.004ec050
lea eax, [ebp - 0x10]
push eax
call fcn.004ec050
add esp, 8
mov eax, ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4f6260
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5c89b0], 0
mov eax, 0x5c89b0
je 0x4f6281
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x10], ecx
je 0x4f6288
add eax, 0x14
cmp dword [eax], 0
jne 0x4f6274
mov eax, 0xffffffd2
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
xor eax, eax
pop ebp
ret
Function at 0x4f62f0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x5c89b0
mov edx, edi
test eax, eax
je 0x4f6371
cmp dword [0x5c89b0], 0
je 0x4f6371
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x4f6367
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x4f6332
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4f6337
add edx, 4
add eax, 4
sub esi, 4
jae 0x4f6321
cmp esi, 0xfffffffc
je 0x4f637b
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x4f6364
cmp esi, 0xfffffffd
je 0x4f637b
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x4f6364
cmp esi, 0xfffffffe
je 0x4f637b
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x4f6364
cmp esi, 0xffffffff
je 0x4f637b
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x4f637b
mov eax, dword [ebp + 8]
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x4f6310
pop edi
pop esi
mov eax, 0xffffffd2
pop ebx
pop ebp
ret
test edi, edi
je 0x4f6371
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4f6540
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x5c8860
mov edx, edi
test eax, eax
je 0x4f65c1
cmp dword [0x5c8860], 0
je 0x4f65c1
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x4f65b7
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x4f6582
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4f6587
add edx, 4
add eax, 4
sub esi, 4
jae 0x4f6571
cmp esi, 0xfffffffc
je 0x4f65c8
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x4f65b4
cmp esi, 0xfffffffd
je 0x4f65c8
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x4f65b4
cmp esi, 0xfffffffe
je 0x4f65c8
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x4f65b4
cmp esi, 0xffffffff
je 0x4f65c8
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x4f65c8
mov eax, dword [ebp + 8]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x4f6560
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret