joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b145
Capabilities:
Check if file exists
Create shortcut via ishelllink
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47b1e3
and eax, 0xfffffffe
push eax
push edi
call esi
lea eax, [ebp - 8]
push eax
push 0x79aa04
push 1
push 0
push 0x79aa34
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x47b1e3
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x79aa24
push eax
call dword [ecx]
test eax, eax
jl 0x47b1e3
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 2
push edi
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x47b1e3
mov eax, dword [ebp - 8]
test eax, eax
je 0x47b1cc
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x47b1e3
mov eax, dword [ebp - 4]
test eax, eax
je 0x47b1dc
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0xc], 1
push ebx
push edi
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x47b1f7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x47b204
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
leave
ret 8
Function at 0x4809b5
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 0x18
mov eax, 0x7648c9
call fcn.0048d201
lea ecx, [ebp - 0x24]
call fcn.004808a4
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x480a40
push 0x78c2f8
push 0x863898
call fcn.00461aa9
pop ecx
pop ecx
xor esi, esi
lea ecx, [ebp - 0x24]
call fcn.0044ce11
push dword [ebp - 0x24]
call fcn.00481e6e
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0x230
leave
ret 4
lea eax, [ebp]
push eax
push esi
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x480a6a
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x238]
cmp eax, dword [ecx]
je 0x480a77
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x480a53
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x480a06
mov esi, dword [ebp + 8]
jmp 0x480a08

Function at 0x480a7c
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
call fcn.00478f32
push str.Globalyjs_exit_mutex
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], ebx
cmp eax, ebx
je 0x480aac
push eax
call edi
mov dword [esi], ebx
mov eax, dword [esi + 0x50]
cmp eax, ebx
je 0x480ac1
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x50]
call edi
mov eax, dword [esi + 0xa4]
cmp eax, ebx
je 0x480ad3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esi, 0xb4
mov ecx, esi
call fcn.005bd570
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.00453fc9
Function at 0x481311
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp eax, ebx
je 0x481325
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0xc]
push 0x210
mov dword [esi + 0x5c], eax
call fcn.00481e3f
push dword [ebp + 0x18]
mov edi, eax
lea eax, [edi + 8]
push eax
mov dword [edi], ebx
mov dword [edi + 4], esi
call dword [sym.imp.USER32.dll_wsprintfW]
push ebx
push ebx
push edi
push 0x48128f
push ebx
push ebx
call fcn.0048e0cb
add esp, 0x24
pop edi
mov dword [esi + 0x50], eax
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x48d1f2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x84dfc0]
jne 0x48d1fc
repz ret
jmp fcn.00497ddc

Function at 0x4a71cf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00495a20
and dword [ebp - 4], 0
cmp dword [0x86352c], 0
mov ebx, eax
jne 0x4a7280
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4a7331
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x78f660
push edi
call esi
test eax, eax
je 0x4a7331
push eax
call fcn.004959ae
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x86352c], eax
call esi
push eax
call fcn.004959ae
mov dword [esp], 0x78f63c
push edi
mov dword [0x863530], eax
call esi
push eax
call fcn.004959ae
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x863534], eax
call esi
push eax
call fcn.004959ae
pop ecx
mov dword [0x86353c], eax
test eax, eax
je 0x4a7280
push 0x78f608
push edi
call esi
push eax
call fcn.004959ae
pop ecx
mov dword [0x863538], eax
mov eax, dword [0x863538]
cmp eax, ebx
je 0x4a72d8
cmp dword [0x86353c], ebx
je 0x4a72d8
push eax
call fcn.00495a29
push dword [0x86353c]
mov esi, eax
call fcn.00495a29
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4a72d8
test edi, edi
je 0x4a72d8
call esi
test eax, eax
je 0x4a72cf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a72cf
test byte [ebp - 0xc], 1
jne 0x4a72d8
or dword [ebp + 0x10], 0x200000
jmp 0x4a7311
mov eax, dword [0x863530]
cmp eax, ebx
je 0x4a7311
push eax
call fcn.00495a29
pop ecx
test eax, eax
je 0x4a7311
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4a7311
mov eax, dword [0x863534]
cmp eax, ebx
je 0x4a7311
push eax
call fcn.00495a29
pop ecx
test eax, eax
je 0x4a7311
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x86352c]
call fcn.00495a29
pop ecx
test eax, eax
je 0x4a7331
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a7333
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b3e90
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
push esi
push str.kernel32
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4b3eaa
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0x78b4e0
push ebx
mov dword [esp + 0x18], edi
call fcn.006cedd6
add esp, 8
test eax, eax
je 0x4b3ef6
test edi, edi
je 0x4b3ee7
push 8
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
test edi, edi
je 0x4b3f1c
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3f1c
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x4b3fd0
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b3f35
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x84f470]
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3fc6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4b3fc6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b3f63
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b3f80
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4b3f90
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b3fbd
push 8
push 0
push esi
call eax
push esi
mov ebp, eax
call dword [0x84f474]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push esi
call dword [0x84f474]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret

Function at 0x4b3fe0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x84dfc0]
xor eax, esp
mov dword [esp + 0x190], eax
test byte [esp + 0x198], 2
je 0x4b403f
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4b4025
mov eax, dword [esp]
cmp al, 2
jne 0x4b401f
shr eax, 8
cmp al, 2
je 0x4b403f
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0048d1f2
add esp, 0x194
ret
push str.iphlpapi.dll
call fcn.004b3e90
add esp, 4
mov dword [0x863560], eax
test eax, eax
je 0x4b406a
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b406a
mov dword [0x863564], eax
push 3
push 2
push 0
push 6
call fcn.004c6cb0
add esp, 0x10
neg eax
sbb eax, eax
neg eax
push 0x86a2a8
mov dword [0x86a2b0], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x190]
xor ecx, esp
xor eax, eax
call fcn.0048d1f2
add esp, 0x194
ret
Function at 0x4bd190
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4bd1d3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 0x2733
sete cl
mov dword [edx], 0
mov eax, ecx
neg eax
sbb eax, eax
and eax, 0x19
add eax, 0x38
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x4bd250
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 0xbf4], edi
je 0x4bd2e5
cmp dword [esi + 0x618], edi
je 0x4bd2a5
push 1
push esi
call fcn.004bb190
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x618]
push edx
push eax
push esi
call ecx
push 0
push esi
mov edi, eax
call fcn.004bb190
add esp, 0x24
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x4bd2e5
cmp eax, 2
jg 0x4bd2e5
mov edx, dword [esi + 0x5a8]
push edx
push 1
lea eax, [eax + eax*2 + 0x79134c]
push 2
push eax
call fcn.00490265
mov ecx, dword [esi + 0x5a8]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
push 1
push edx
push eax
call fcn.00490265
add esp, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x4bd780
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [ebx + 0x5f0]
push ebp
mov ebp, dword [ebx + eax*4 + 0x420]
mov ecx, eax
shl ecx, 4
push esi
lea esi, [ecx + ebx + 0x448]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x40], 3
je 0x4bd823
cmp dword [ebx + eax*4 + 0x438], 0x4bd490
jne 0x4bd823
cmp dword [esi], 0
je 0x4bd7be
test edi, edi
je 0x4bd823
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.004e4840
add esp, 0x14
cmp eax, 0xffffffff
je 0x4bd823
test al, 1
je 0x4bd823
cmp dword [esi], 0
jne 0x4bd80c
mov eax, dword [ebx]
mov eax, dword [eax + 0x974]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x84f470]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
cmp eax, ecx
jne 0x4bd803
pop edi
pop esi
lea eax, [ecx + 0x1b]
pop ebp
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
add ecx, dword [esi + 8]
push 0
push edi
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4bd823
add dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x4bd830
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x84dfc0]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x10c]
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
mov ebp, dword [ebx + eax*4 + 0x420]
push esi
mov esi, dword [esp + 0x124]
push edi
mov edi, dword [esp + 0x120]
call fcn.004bd780
test eax, eax
je 0x4bd87f
mov dword [esi], 0x1b
or eax, 0xffffffff
jmp 0x4bd8e9
mov eax, dword [esp + 0x124]
push 0
push eax
push edi
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x4bd8e7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x4bd8b8
xor edi, edi
mov dword [esi], 0x51
jmp 0x4bd8e7
push 0x100
lea ecx, [esp + 0x14]
push ecx
push ebp
call fcn.004eb470
mov edx, dword [ebx]
push eax
push str.Send_failure:__s
push edx
call fcn.004bd3d0
mov eax, dword [ebx]
mov dword [eax + 0xeb4], ebp
add esp, 0x18
mov dword [esi], 0x37
mov eax, edi
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d1f2
add esp, 0x104
ret

Function at 0x4bf760
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push eax
call fcn.00530220
add esp, 4
mov dword [esp + 0xc], eax
jmp fcn.0049be15

Function at 0x4c08d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + eax]
mov ebx, 0x1505
cmp esi, edi
jae 0x4c08c0
movzx eax, byte [esi]
push eax
call fcn.004c48a0
mov edx, ebx
shl edx, 5
movsx ecx, al
add edx, ebx
xor ecx, edx
inc esi
add esp, 4
mov ebx, ecx
cmp esi, edi
jb 0x4c08a1
pop edi
pop esi
movzx eax, bl
pop ebx
ret
push ecx
push esi
mov esi, eax
test esi, esi
je 0x4c08fd
call fcn.004c06e0
test eax, eax
jne 0x4c08fd
lea eax, [esp + 4]
push eax
call fcn.004c0830
add esp, 4
mov ecx, eax
mov eax, dword [esp + 4]
pop esi
add esp, 4
jmp 0x4c0890
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4c23e0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0xc28], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x4c241e
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004bd2f0
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0xb40]
push edx
mov dword [esp + 0xc], 1
call fcn.004bf740
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xb44]
push eax
call fcn.004bf740
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4c2497
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004bd2f0
add esp, 0x10
add esp, 0x14
ret
Function at 0x4c2da0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x84dfc0]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
mov esi, dword [esp + 0x190]
push edi
push 0x80
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0x80
call fcn.0048d310
mov eax, dword [esp + 0x1a4]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4c2e39
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x100
lea ecx, [esp + 0x90]
mov edi, eax
push ecx
push edi
call fcn.004eb470
mov edx, dword [esi]
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
push edx
call fcn.004bd3d0
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.0048d1f2
add esp, 0x188
ret
mov edx, dword [esp + 8]
lea eax, [esi + 0x3d4]
push eax
lea ecx, [esi + 0x3a4]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004c2be0
add esp, 0x10
test eax, eax
jne 0x4c2e96
push ebx
call fcn.00491c39
mov edi, eax
call fcn.00491c39
mov edx, dword [edi]
push 0x100
lea ecx, [esp + 0x94]
push ecx
push edx
mov ebx, eax
call fcn.004eb470
mov ecx, dword [esi]
push eax
mov eax, dword [ebx]
push eax
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.004bd3d0
add esp, 0x1c
pop ebx
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
xor ecx, esp
call fcn.0048d1f2
add esp, 0x188
ret

Function at 0x4c3060
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
mov eax, dword [0x84dfc0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push esi
mov esi, dword [eax]
push 4
lea eax, [esp + 8]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x4c30c1
push 0x100
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004eb470
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004bd2f0
add esp, 0x18
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0048d1f2
add esp, 0x108
ret

Function at 0x4c3180
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x474], 0
je 0x4c319d
push eax
call fcn.004b4e00
add esp, 4
test eax, eax
jne 0x4c31bd
xor eax, eax
ret
mov eax, dword [eax + 0x420]
cmp eax, 0xffffffff
je 0x4c319a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4c31bd
ret
mov eax, 1
ret
Function at 0x4c4ec0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], 0
mov eax, dword [esp + 0x1c]
push edx
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 4], eax
test eax, eax
jne 0x4c5063
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4c5041
push ebx
push ebp
push esi
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4c4f2e
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c4f20
sub eax, edx
lea ebx, [eax + 1]
jmp 0x4c4f30
xor ebx, ebx
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4c4f3d
lea ebp, [eax + 0xe]
jmp 0x4c4f49
cmp eax, 0x17
jne 0x4c4fe4
lea ebp, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4c4fe4
mov eax, dword [edi + 0x10]
test eax, eax
jbe 0x4c4fe4
cmp eax, ebp
jb 0x4c4fe4
lea edx, [ebx + ebp + 0x20]
push edx
call dword [0x84f470]
mov esi, eax
xor eax, eax
add esp, 4
cmp esi, eax
je 0x4c4ff1
mov ecx, dword [edi]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x20]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x18]
push ebp
push ecx
push eax
call fcn.004909c0
add esp, 0xc
test ebx, ebx
je 0x4c4fca
mov edx, dword [esi + 0x18]
lea eax, [edx + ebp]
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 0x14]
push ebx
push ecx
push eax
call fcn.004909c0
add esp, 0xc
cmp dword [esp + 0x10], 0
jne 0x4c4fd5
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4c4fe0
mov dword [eax + 0x1c], esi
mov dword [esp + 0x18], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4c4f13
jmp 0x4c4ff9
mov dword [esp + 0x14], 8
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
test eax, eax
je 0x4c500b
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 8], 0
je 0x4c503a
mov edx, dword [esp + 4]
push edx
call fcn.004c4e90
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
add esp, 4
mov dword [ecx], eax
mov eax, dword [esp + 8]
pop edi
add esp, 0x10
ret
cmp dword [esp + 4], 0
jne 0x4c5054
push 0x2af9
mov dword [esp + 0xc], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 8]
pop edi
add esp, 0x10
ret
Function at 0x4c6a30
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.0048e0cb
add esp, 0x18
test eax, eax
je 0x4c6a53
cmp eax, 0xffffffff
jne 0x4c6a55
xor eax, eax
ret

Function at 0x4c6c90
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x5f8], 2
jne 0x4c6ca6
mov dword [esp + 4], eax
jmp fcn.004c6c40
mov eax, 1
ret

Function at 0x4c7030
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1b8
mov eax, dword [0x84dfc0]
xor eax, esp
mov dword [esp + 0x1b4], eax
cmp dword [0x863654], 0
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
jne 0x4c7067
call fcn.004c7020
test eax, eax
je 0x4c707f
mov dword [0x863654], 1
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1b4]
xor ecx, esp
call fcn.0048d1f2
add esp, 0x1b8
ret
mov eax, dword [esi + 0xa50]
test eax, eax
je 0x4c70a0
push 0x400
push eax
call fcn.004f6940
add esp, 8
call fcn.004c7020
test eax, eax
jne 0x4c7067
push ebx
push ebp
push edi
mov esi, 2
lea edi, [esp + 0x84]
mov dword [esp + 0x20], 4
jmp 0x4c70c0
lea eax, [esp + 0x34]
push eax
call fcn.004c6aa0
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
push 0
push 1
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call fcn.004e4450
add esp, 0xc
push ebp
push ebx
lea eax, [esi - 1]
push 0
push eax
call fcn.0048d6e0
lea ecx, [esp + 0x74]
mov ebx, esi
imul ebx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
call fcn.004c6aa0
mov eax, dword [eax + 8]
cdq
mov dword [esp + 0x34], edx
lea edx, [esp + 0x68]
push edx
mov ebp, eax
call fcn.004c6aa0
mov ecx, dword [esp + 0x38]
add esp, 8
add ebp, dword [eax]
push 0
adc ecx, dword [eax + 4]
lea edx, [esi + 1]
push edx
push ecx
push ebp
mov dword [esp + 0x38], edx
call fcn.0048d6e0
shld edx, eax, 8
xor dword [esp + 0x14], edx
shl eax, 8
xor dword [esp + 0x10], eax
lea eax, [esp + 0x44]
push eax
call fcn.004c6aa0
lea ecx, [esp + 0x58]
push ecx
lea ebp, [eax + 8]
call fcn.004c6aa0
mov edx, dword [ebp]
add edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esi, 2
imul edx, esi
mov esi, dword [esp + 0x30]
shl edx, 0x10
mov dword [edi], eax
xor ebx, edx
mov edx, dword [esp + 0x24]
mov dword [edi + 4], ecx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], edx
add esp, 8
add edi, 0x10
sub dword [esp + 0x20], 1
jne 0x4c70c0
fld qword [0x792318]
sub esp, 8
fstp qword [esp]
lea eax, [esp + 0x8c]
push 0x40
push eax
call fcn.004f67b0
add esp, 0x10
call fcn.004c7020
test eax, eax
je 0x4c70a3
lea ecx, [esp + 0xc4]
push 0x100
push ecx
mov byte [esp + 0xcc], 0
call fcn.004f6aa0
add esp, 8
cmp byte [esp + 0xc4], 0
pop edi
pop ebp
pop ebx
je 0x4c7219
lea edx, [esp + 0xb8]
push 0x400
push edx
call fcn.004f6940
add esp, 8
call fcn.004c7020
test eax, eax
jne 0x4c7067
mov eax, dword [esp + 0x18]
push str.libcurl_is_now_using_a_weak_random_seed__n
push eax
call fcn.004bd2f0
add esp, 8
call fcn.004c7020
mov ecx, dword [esp + 0x1b8]
neg eax
sbb eax, eax
and eax, 0xffffffdd
pop esi
xor ecx, esp
add eax, 0x23
call fcn.0048d1f2
add esp, 0x1b8
ret
Function at 0x4cd920
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
xor ebp, ebp
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x84f478]
mov edi, eax
add esp, 8
test edi, edi
je 0x4cd8e8
lea ebx, [ebx]
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x4cd900
cmp esi, ebx
je 0x4cd900
cmp esi, 0x8000
ja 0x4cd900
cmp esi, ebx
jb 0x4cd8f9
push esi
push edi
call dword [0x84f478]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4cd8b0
push ebp
call dword [0x84f474]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x84f474]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
jmp 0x4cd890