joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452ac0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
xor ecx, ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x452cce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x451240]
call fcn.00408ba0
add esp, 4
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x452cad
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x452ca6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x248]
mov edx, 0x22c
call fcn.004318a0
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_Process32FirstW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
jmp 0x452c85
cmp dword [ebp - 0x240], 0
jbe 0x452c6c
mov eax, dword [ebp - 0x240]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x452c6c
xor eax, eax
push ebp
push 0x452c65
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00452960
cmp dword [ebp - 0x1c], 0
je 0x452c4e
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x451240]
call fcn.00408ba0
add esp, 4
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
lea eax, [edx + eax*4 - 8]
mov edx, dword [ebp - 0x1c]
call fcn.00406e48
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x240]
mov dword [edx + eax*4 - 0xc], ecx
cmp byte [ebp - 1], 0
je 0x452c3a
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 - 8]
lea ecx, [ebp - 0x24c]
xor edx, edx
call fcn.004523c0
mov edx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
lea eax, [ecx + eax*4 - 4]
call fcn.00406e48
jmp 0x452c4e
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
lea eax, [edx + eax*4 - 4]
call fcn.00406a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c6c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_Process32NextW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x452b61
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452cad
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452cd5
lea eax, [ebp - 0x24c]
call fcn.00406a84
lea eax, [ebp - 0x1c]
call fcn.00406a84
ret
Function at 0x452ce0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
xor edx, edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452e07
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x451240]
call fcn.00408ba0
add esp, 4
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 8
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x452dee
mov dword [ebp - 0x434], 0x428
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_Module32FirstW
test eax, eax
je 0x452de5
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x451240]
call fcn.00408ba0
add esp, 4
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [edx + eax*4 - 8]
lea edx, [ebp - 0x214]
mov ecx, 0x104
call fcn.00407728
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 - 8]
lea ecx, [ebp - 0x438]
xor edx, edx
call fcn.004523c0
mov edx, dword [ebp - 0x438]
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
lea eax, [ecx + eax*4 - 4]
call fcn.00406e48
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_Module32NextW
test eax, eax
jne 0x452d5b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e0e
lea eax, [ebp - 0x438]
call fcn.00406a84
ret
Function at 0x453c10
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x453d19
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453cfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040767c
push eax
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x453ca6
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x1c], eax
push 0x453d34
push dword [ebp - 8]
push 0x453d6c
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004078f4
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov dl, 2
call fcn.0043f1c0
call fcn.00406244
jmp 0x453d03
mov edx, 0x453d80
mov eax, dword [ebp - 0xc]
call fcn.00433e30
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x453cda
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 1
push ebp
mov eax, dword [ebp - 0x20]
call fcn.00453680
pop ecx
test al, al
je 0x453cda
inc dword [ebp - 0x18]
dec dword [ebp - 0x24]
jne 0x453cc4
mov byte [ebp - 0x11], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453d03
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_CloseEventLog
push ebp
call fcn.00453620
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453d20
lea eax, [ebp - 0x28]
call fcn.00406a84
ret
Function at 0x455bb0
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x455cad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00406f64
mov edx, eax
add edx, 0x1c
lea eax, [ebp - 0x14]
xor ecx, ecx
call fcn.004074a4
mov eax, dword [ebp - 0x14]
call fcn.004073e0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
mov edx, 8
call fcn.004318a0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xc]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x14]
call fcn.00406f64
push eax
mov eax, dword [ebp - 0x14]
call fcn.004073e0
pop edx
call fcn.004318a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406f64
push eax
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00406f64
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004073e0
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.icmp.dll_IcmpSendEcho
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jl 0x455c97
mov eax, dword [ebp - 0x24]
cmp dword [eax + 4], 0
jne 0x455c97
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov dl, byte [edx + 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 8]
mov dword [eax], edx
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455cb4
lea eax, [ebp - 0x14]
call fcn.00406aa8
ret
Function at 0x47d500
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, eax
mov ecx, edx
test ecx, ecx
je 0x47d50f
sub ecx, 4
mov ecx, dword [ecx]
test ecx, ecx
jle 0x47d530
mov ebx, 1
mov esi, eax
add esi, esi
add esi, esi
shr eax, 0x1e
or esi, eax
movzx eax, word [edx + ebx*2 - 2]
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x47d518
pop esi
pop ebx
ret
Function at 0x4815a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x481929
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4815e7
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0040767c
push eax
call sub.kernel32.dll_LoadLibraryExW_1
mov dword [ebp - 0x28], eax
jmp 0x4815f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x48190b
xor eax, eax
push ebp
push 0x481720
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
push eax
push 1
push 0x10
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FindResourceExW
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x481630
call fcn.00406244
jmp 0x48190b
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x481650
call fcn.00406244
jmp 0x48190b
xor eax, eax
push ebp
push 0x4816f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0x10
xor ecx, ecx
call fcn.004074a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406f64
test eax, eax
jle 0x4816e2
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x4816db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406f64
push eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00407028
mov edx, eax
mov eax, dword [ebp - 0x34]
pop ecx
call fcn.00404c50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4816e2
mov eax, dword [ebp - 0x30]
call fcn.0040c48c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481700
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481930
lea eax, [ebp - 0x14]
call fcn.00406a84
lea eax, [ebp - 0xc]
call fcn.00406a84
ret
Function at 0x4b8d60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.00405058
lea eax, [ebp - 0x46]
xor ecx, ecx
mov edx, 0x40
call fcn.00405058
cmp dword [ebp - 4], 0
je 0x4b8e22
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
movzx eax, word [ebp + 8]
mov edx, dword [ebp - 4]
movzx edx, word [edx]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x4b8dde
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.004b8d10
mov eax, dword [ebp - 4]
movzx eax, word [eax + 2]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.00404c50
jmp 0x4b8dee
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.00404c50
movzx edx, word [ebp - 6]
dec edx
test dx, dx
jb 0x4b8e08
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x4b8dff
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 4]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b8e30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x4b8eb1
movzx edx, word [eax]
mov word [ebp - 6], dx
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call dword [esi + 8]
movzx edx, word [ebp - 6]
dec edx
test edx, edx
jl 0x4b8e6f
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x6a
inc eax
dec edx
jne 0x4b8e68
mov esi, dword [ebx + 0x154]
mov eax, ebx
call dword [esi + 4]
mov esi, dword [ebx + 0x154]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
call dword [esi + 0xc]
mov eax, dword [ebx + 0x154]
mov esi, eax
movzx ecx, word [eax + 2]
mov edx, dword [ebp - 4]
mov eax, ebx
call dword [esi + 0xc]
mov esi, dword [ebx + 0x154]
mov edx, dword [ebp - 4]
mov eax, ebx
call dword [esi + 8]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b8f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push esi
push edi
push ebx
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [esi], eax
add esi, 4
add edx, 4
dec ecx
jne 0x4b8f5a
mov ecx, 0x30
mov edi, dword [esi - 0x1c]
mov eax, dword [esi - 8]
mov ebx, eax
mov edx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x4b8f73
pop ebx
pop edi
pop esi
pop ecx
pop ecx
pop ebp
ret
Function at 0x4b95b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
add edx, 4
dec ecx
jne 0x4b95b8
mov ecx, 0x40
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x4b95d1
pop ebx
ret
Function at 0x4b9b50
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0xd4
call fcn.00405058
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
pop ebp
ret

Function at 0x4c5860
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c5957
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00432cd0
mov eax, dword [ebp - 0x1c]
call fcn.00432f00
push 9
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040767c
push eax
mov eax, dword [ebp - 4]
call fcn.0040767c
push eax
call sub.kernel32.dll_MoveFileWithProgressW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
cmp byte [ebp - 0xa], 0
je 0x4c58ee
cmp word [ebp + 0xa], 0
je 0x4c593c
mov eax, dword [ebp - 8]
call fcn.0042e930
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
jmp 0x4c593c
cmp byte [ebp - 9], 0
je 0x4c5917
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004c5600
test al, al
je 0x4c5917
mov eax, dword [ebp - 4]
call fcn.0042e630
mov byte [ebp - 0xa], 1
jmp 0x4c593c
push 0x4c5974
push dword [ebp - 4]
push 0x4c59ac
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004078f4
mov eax, dword [ebp - 0x20]
call fcn.004c55b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c595e
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406ae4
ret
Function at 0x4c7d20
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_ResetEvent
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ConnectNamedPipe
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0x15], 0
je 0x4c7d93
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, 0x4c7e3c
mov edx, 0x4c7e60
call fcn.0043edc0
push 0x4c7e3c
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.0043f1c0
mov eax, dword [ebp - 0x14]
sub eax, 0x217
je 0x4c7da6
sub eax, 0x1ce
je 0x4c7dec
jmp 0x4c7df2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_SetEvent
test eax, eax
jne 0x4c7e20
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, 0x4c7e3c
mov edx, 0x4c7ea4
call fcn.0043edc0
push 0x4c7e3c
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.0043f1c0
jmp 0x4c7e26
mov byte [ebp - 0x16], 1
jmp 0x4c7e20
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, 0x4c7e3c
mov edx, 0x4c7e60
call fcn.0043edc0
push 0x4c7e3c
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.0043f1c0
jmp 0x4c7e26
mov al, byte [ebp - 0x16]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x4c8120
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c823d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x18], 0x40000003
cmp byte [ebp - 5], 0
je 0x4c815e
or dword [ebp - 0x18], 0x80000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
push 0x1388
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
push 0xff
push 6
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.0040767c
push eax
call sub.kernel32.dll_CreateNamedPipeW
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffffffff
jne 0x4c81e8
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x40]
mov edx, 0x4c825c
call fcn.0040786c
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, 0x4c82a0
call fcn.0043ee40
push 0x4c82a0
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov dl, 2
call fcn.0043f1c0
jmp 0x4c8222
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x40]
mov edx, 0x4c82c4
call fcn.0040786c
mov edx, dword [ebp - 0x20]
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, 0x4c82a0
call fcn.0043edc0
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004c7d20
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8244
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406ae4
ret

Function at 0x4c9210
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
push 0
push 1
push 2
call sub.wsock32.dll_socket_1
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4c9236
call fcn.004c9160
jmp 0x4c92b8
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 1
push 6
mov eax, dword [esi]
push eax
call sub.wsock32.dll_setsockopt_1
inc eax
jne 0x4c9260
call fcn.004c9160
mov eax, esi
call fcn.004c91e0
jmp 0x4c92b8
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov eax, dword [esi]
push eax
call sub.wsock32.dll_setsockopt_1
inc eax
jne 0x4c928d
call fcn.004c9160
mov eax, esi
call fcn.004c91e0
jmp 0x4c92b8
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov eax, dword [esi]
push eax
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x4c92b6
call fcn.004c9160
mov eax, esi
call fcn.004c91e0
jmp 0x4c92b8
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c92c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.00405058
mov word [ebp - 0x18], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
push 0x7f000001
call sub.wsock32.dll_htonl
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_bind_1
mov esi, eax
inc esi
jne 0x4c932a
call fcn.004c9160
mov ebx, eax
cmp bl, 2
je 0x4c92fd
cmp bl, 1
je 0x4c932a
mov eax, edi
call fcn.004c91e0
jmp 0x4c938d
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_getsockname_1
mov esi, eax
inc esi
jne 0x4c9360
call fcn.004c9160
mov ebx, eax
cmp bl, 2
je 0x4c932a
cmp bl, 1
je 0x4c9360
mov eax, edi
call fcn.004c91e0
jmp 0x4c938d
push 5
mov eax, dword [edi]
push eax
call sub.wsock32.dll_listen_1
mov esi, eax
inc esi
jne 0x4c9389
call fcn.004c9160
mov ebx, eax
cmp bl, 2
je 0x4c9360
cmp bl, 1
je 0x4c9389
mov eax, edi
call fcn.004c91e0
jmp 0x4c938d
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c93a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
or esi, 0xffffffff
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c93ea
call fcn.004c9160
mov ebx, eax
cmp bl, 2
je 0x4c93b4
cmp bl, 1
je 0x4c93e5
mov eax, edi
call fcn.004c91e0
mov dword [ebp - 0xc], esi
jmp 0x4c93ed
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret