joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5dce4c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.ZrulElectricalNet.0
mov eax, dword [esi + 0x3c]
xor ebx, ebx
mov dword [esp + 0x20], 8
test eax, eax
jle 0x470f81
xor eax, eax
mov ecx, dword [esi + 0x40]
mov ebp, dword [ecx + eax*4]
lea eax, [ecx + eax*4]
test ebp, ebp
je 0x470f76
mov eax, dword [ebp + 8]
test eax, eax
jne 0x470f63
mov edi, dword [ebp + 4]
and edi, 0x7f
call fcn.004db3c0
mov eax, dword [eax + edi*4 - 4]
push ebp
mov ecx, eax
call fcn.004da850
test eax, eax
je 0x470f76
mov edx, 0xffff
add word [eax + 0x8e], dx
mov ecx, eax
call fcn.004d9ef0
mov ecx, dword [esi + 0x3c]
inc ebx
movzx eax, bx
cmp eax, ecx
jl 0x470f34
mov ecx, esi
call fcn.004d4780
mov ecx, esi
call fcn.004702f0
mov edi, dword [esi + 0x44]
lea ebp, [esi + 0x44]
test edi, edi
jge 0x470fd5
cmp edi, 0x100
jle 0x470fa8
mov edi, 0x100
jmp 0x470fb1
test edi, edi
jg 0x470fb1
mov edi, 1
mov ebx, dword [ebp + 8]
push ebp
call fcn.004dbfc0
mov edx, dword [eax]
mov edx, dword [edx + 4]
add esp, 4
lea ecx, [edi*4]
push ecx
push ebx
mov ecx, eax
call edx
mov dword [ebp + 8], eax
mov dword [ebp], edi
mov eax, dword [ebp + 4]
test eax, eax
jge 0x470ff5
lea ecx, [eax*4]
mov eax, dword [ebp + 8]
add eax, ecx
je 0x470ff0
mov dword [eax], 0
add ecx, 4
js 0x470fe3
lea ecx, [esi + 0xa0]
mov dword [ebp + 4], 0
mov byte [esp + 0x20], 7
call fcn.00440ab0
mov eax, dword [esi + 0x9c]
mov byte [esp + 0x20], 6
test eax, eax
je 0x47103d
mov edi, dword [eax + 4]
and edi, 0x7f
call fcn.004db3c0
mov edi, dword [eax + edi*4 - 4]
mov eax, dword [esi + 0x9c]
mov ecx, dword [edi + 0x14]
mov ecx, dword [ecx + 4]
push eax
push edi
call fcn.004ddcd0
lea ecx, [esi + 0x94]
mov byte [esp + 0x20], 5
call fcn.004d4f60
lea ecx, [esi + 0x88]
mov byte [esp + 0x20], 4
call fcn.004d4f60
mov eax, dword [esi + 0x78]
mov byte [esp + 0x20], 3
test eax, eax
je 0x471088
mov edi, dword [eax + 4]
and edi, 0x7f
call fcn.004db3c0
mov edi, dword [eax + edi*4 - 4]
mov eax, dword [esi + 0x78]
mov ecx, dword [edi + 0x14]
mov ecx, dword [ecx + 4]
push eax
push edi
call fcn.004ddcd0
mov ecx, ebp
mov byte [esp + 0x20], 2
call fcn.0041deb0
lea ecx, [esi + 0x38]
mov byte [esp + 0x20], 1
call fcn.0041deb0
lea ecx, [esi + 0xc]
mov byte [esp + 0x20], 0
call fcn.004d4f60
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.004d45e0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4784f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dd6c4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ZrulEnetGrp.0
mov dword [esp + 0x14], 4
call fcn.004d4780
mov ecx, esi
call fcn.004782b0
mov ecx, esi
call fcn.00478110
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 3
call fcn.00440ab0
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 2
call fcn.0041deb0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], 1
call fcn.004d4f60
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 0
call fcn.0041deb0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004d45e0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x49f670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dfdf9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [ecx + 0x34]
add ecx, 0x2c
push eax
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0
call fcn.004f0980
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
mov dword [esp + 0x3c], 1
call fcn.004f0550
mov esi, dword [esp + 0x40]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov byte [esp + 0x3c], 2
call fcn.004f7030
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x38], 1
call fcn.00440ab0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 0
call fcn.004f0040
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 4

Function at 0x4bcfe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dfdf9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [ecx + 0x30]
add ecx, 0x28
push eax
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0
call fcn.004f0980
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
mov dword [esp + 0x3c], 1
call fcn.004f0550
mov esi, dword [esp + 0x40]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov byte [esp + 0x3c], 2
call fcn.004f7030
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x38], 1
call fcn.00440ab0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 0
call fcn.004f0040
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 4
Function at 0x4d2350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e21e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.004ddd60
xor eax, eax
mov dword [esi], vtable.ZlayDatabase.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
lea edi, [esi + 0x68]
mov dword [esi + 0x60], eax
mov ecx, edi
mov dword [esp + 0x18], 0
mov dword [esi + 0x64], eax
call fcn.005bd770
xor ecx, ecx
xor edx, edx
mov byte [esp + 0x18], 1
mov dword [esi + 0x74], 0
mov word [esi + 0x78], cx
mov word [esi + 0x7a], dx
call fcn.005c2640
test eax, eax
jne 0x4d2405
mov eax, 0x5f3b6e
push eax
mov ecx, edi
call fcn.005be130
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov ecx, esi
mov dword [esi + 0x64], eax
call fcn.004d2290
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4d2fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5e2208
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x34]
push ebx
lea ecx, [esp + 0x18]
xor ebp, ebp
call fcn.004e2f10
push 0x3a
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], ebp
call fcn.004db920
push eax
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
cmp eax, ebp
jne 0x4d3001
lea ecx, [esp + 0x1c]
call fcn.004db920
jmp 0x4d3002
inc eax
push eax
call fcn.005bf2f0
add esp, 4
test eax, eax
jne 0x4d3034
push 0x4e6d
call fcn.005c2c00
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004d1ff0
xor eax, eax
jmp 0x4d30bf
mov eax, dword [esp + 0x38]
push eax
mov ecx, esi
call fcn.004d2210
cmp word [esi + 0x78], bp
jne 0x4d309f
xor ecx, ecx
cmp dword [esp + 0x3c], ebp
sete cl
mov edi, ecx
push edi
push ebx
mov ecx, esi
call dword [esp + 0x48]
test eax, eax
je 0x4d3098
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
push edx
push eax
mov ecx, esi
call fcn.004d2490
test eax, eax
je 0x4d3082
mov ecx, 1
mov dword [esi + 0x74], edi
mov word [esi + 0x78], cx
mov ebp, ecx
jmp 0x4d30ac
push 1
mov ecx, esi
call fcn.004e0020
movzx edx, al
push edx
mov ecx, esi
call fcn.004dfeb0
jmp 0x4d30ac
call fcn.004d1e60
jmp 0x4d30ac
push 0x4e31
call fcn.005c2c00
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004d1ff0
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
Function at 0x4daf60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e2918
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x40]
mov eax, dword [esi + 0xc]
mov ecx, eax
shr ecx, 3
test cl, 1
jne 0x4db0c5
mov edx, eax
shr edx, 1
test dl, 1
je 0x4dafb9
and eax, 0xfffffffc
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
jmp 0x4db0c5
mov ecx, dword [esi]
mov edi, dword [esi + 8]
shr ecx, 1
mov dword [esp + 0x14], edi
cmp ecx, 0x7fffffff
jne 0x4dafcf
or ecx, 0xffffffff
mov eax, dword [esi + 4]
push 0
push ecx
shr eax, 7
push eax
push ebp
lea ecx, [esp + 0x28]
call fcn.004e7840
mov edx, dword [esp + 0x18]
push 4
lea eax, [esp + 0x44]
push eax
mov eax, dword [edx]
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], 0
call eax
push 1
lea ecx, [esp + 0x44]
push 4
push ecx
call fcn.004dc5e0
mov ecx, dword [esp + 0x4c]
mov eax, ecx
shr eax, 0x13
shl eax, 4
xor eax, dword [esi + 0xc]
and ecx, 0x7ffff
and eax, 0x1fff0
xor dword [esi + 0xc], eax
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ebx, ecx
add esp, 0xc
mov ecx, edi
call eax
mov ecx, edi
cmp ebx, eax
jne 0x4db097
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [ebp + 8]
push eax
call fcn.004dc110
test byte [edi + 8], 1
mov ebx, eax
je 0x4db065
mov ebp, dword [ebp + 0x14]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [ebp + 0xc]
call fcn.004dad20
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
and dword [esi + 0xc], 0xfffffffe
mov edx, dword [ebx + 0xc]
lea ecx, [esp + 0x18]
push ecx
push edi
call edx
add esp, 8
lea ecx, [esp + 0x18]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.004e7960
mov eax, esi
jmp 0x4db0c7
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
call edx
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push edi
call edx
and dword [esi + 0xc], 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esi + 8], 0
mov dword [esp + 0x38], 0xffffffff
call fcn.004e7960
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4dc6b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x638e34]
sub esp, 0x10
test ecx, ecx
je 0x4dc6f5
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4dc6f5
push esi
push edi
lea eax, [esp + 8]
push str._ENTERING__member_copy__src_p__dst_p_
push eax
mov dword [esp + 0x10], str..._util.cpp
mov dword [esp + 0x14], 0x6c
mov dword [esp + 0x18], 0x14
call fcn.004e4a60
add esp, 0x10
mov ecx, dword [edi]
mov dword [esi], ecx
movzx edx, word [edi + 4]
mov dword [esi + 4], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 8], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0xc], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x18], ecx
movzx edx, word [edi + 6]
mov word [esi + 0x1c], dx
mov ax, word [edi + 8]
mov word [esi + 0x1e], ax
mov cx, word [edi + 0xa]
mov word [esi + 0x20], cx
movzx edx, word [edi + 0xc]
mov word [esi + 0x22], dx
mov ecx, dword [0x638e34]
test ecx, ecx
je 0x4dc77d
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x4dc77d
lea eax, [esp]
push str._EXITING__member_copy__
push eax
mov dword [esp + 8], str..._util.cpp
mov dword [esp + 0xc], 0x7a
mov dword [esp + 0x10], 0x28
call fcn.004e4a60
add esp, 8
add esp, 0x10
ret

Function at 0x4dde70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e2b31
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0
call fcn.004db8d0
lea eax, [esp + 0x20]
push eax
lea ebx, [esp + 0x1c]
mov dword [esp + 0x34], 1
call fcn.004dddb0
add esp, 4
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
call fcn.004dbc20
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 4
call fcn.004db9d0
push 0x5fdaf0
lea ecx, [esp + 0x14]
call fcn.004dba00
mov ecx, ebx
call fcn.004db920
push eax
lea ecx, [esp + 0x14]
call fcn.004dba00
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.004dba00
push 0
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004dbc20
mov eax, 1
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov byte [esp + 0x30], al
call fcn.004db9d0
mov ecx, ebx
mov byte [esp + 0x30], 0
call fcn.004db9d0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x4df860
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x5e2e6e
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x294], eax
push ebx
push esi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x2a4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2b4]
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.004da4a0
xor ebx, ebx
push ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x2b0], ebx
mov dword [esi], vtable.PzExtDatabaseInst.0
call fcn.004db8d0
push ebx
lea ecx, [esi + 0x24]
mov byte [esp + 0x2b0], 1
call fcn.004db8d0
push ebx
lea ecx, [esi + 0x2c]
mov byte [esp + 0x2b0], 2
call fcn.004db8d0
push ebx
lea ecx, [esi + 0x34]
mov byte [esp + 0x2b0], 3
call fcn.004db8d0
push ebx
lea ecx, [esi + 0x3c]
mov byte [esp + 0x2b0], 4
call fcn.004db8d0
push ebx
lea ecx, [esi + 0x44]
mov byte [esp + 0x2b0], 5
call fcn.004db8d0
push ebx
lea ecx, [esi + 0x4c]
mov byte [esp + 0x2b0], 6
call fcn.004db8d0
push 0x2000
lea eax, [esi + 0x60]
push ebx
push eax
mov byte [esp + 0x2b8], 7
mov dword [esi + 0x58], 0xffffffff
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
lea ecx, [esi + 0x306c]
call fcn.004db8d0
push ebx
lea ecx, [esi + 0x3074]
mov byte [esp + 0x2b0], 8
call fcn.004db8d0
mov dword [esi + 0x3094], ebx
lea eax, [esi + 0x308c]
mov dword [eax + 4], eax
mov dword [eax], eax
mov ecx, dword [esi + 0x3084]
lea edx, [esp + 0x10]
and ecx, 0xffffffa2
push edx
or ecx, 0x22
push 0x101
mov dword [esi + 0x3084], ecx
mov byte [esi + 0x307c], 1
mov dword [esi + 0x3080], ebx
mov byte [esi + 0x3098], bl
mov dword [esi + 0x3088], 1
call sub.WSOCK32.dll_WSAStartup
cmp dword [0x638c10], ebx
jne 0x4df9f6
push 0x100
lea eax, [esp + 0x1a4]
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x4df9f6
lea ecx, [esp + 0x1a0]
push ecx
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x4df9f6
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [0x638c10], ecx
mov eax, esi
mov ecx, dword [esp + 0x2a4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x2a4
ret 4

Function at 0x4e0d20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x638e28]
test ecx, ecx
je 0x4e0db8
push esi
xor esi, esi
cmp dword [ecx + 8], esi
jbe 0x4e0d6a
mov eax, dword [ecx]
mov edx, dword [eax + esi*8]
mov ecx, dword [edx + 8]
lea eax, [eax + esi*8]
movzx eax, byte [eax + 4]
add eax, eax
xor eax, dword [ecx + 0x3084]
push 0
and eax, 2
xor dword [ecx + 0x3084], eax
push edx
call fcn.004dfb20
mov ecx, dword [0x638e28]
inc esi
cmp esi, dword [ecx + 8]
jb 0x4e0d36
push 0
mov esi, ecx
call fcn.004e0be0
cmp dword [esi + 4], 0
jbe 0x4e0d90
push edi
mov edi, dword [esi]
push esi
call fcn.004dbfc0
mov edx, dword [eax]
add esp, 4
mov ecx, eax
mov eax, dword [edx + 8]
push edi
call eax
pop edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [0x638e28], 0
pop esi
ret
Function at 0x4e2250
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov ecx, dword [0x638e34]
sub esp, 0x10
test ecx, ecx
je 0x4e229f
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4e229f
mov eax, edi
test edi, edi
jne 0x4e2274
mov eax, str._null_
push eax
lea eax, [esp + 4]
push str._ENTERING__GetInAddr_name_s_
push eax
mov dword [esp + 0xc], str..._xpathmake.cpp
mov dword [esp + 0x10], 0x33b
mov dword [esp + 0x14], 0x14
call fcn.004e4a60
add esp, 0xc
push esi
push edi
call sub.WSOCK32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e22be
push edi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4e22be
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov esi, dword [edx]
mov ecx, dword [0x638e34]
test ecx, ecx
je 0x4e22ff
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x4e22ff
push esi
lea eax, [esp + 8]
push str._EXITING__GetInAddr__:__x
push eax
mov dword [esp + 0x10], str..._xpathmake.cpp
mov dword [esp + 0x14], 0x365
mov dword [esp + 0x18], 0x28
call fcn.004e4a60
add esp, 0xc
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4e2d00
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x5e337b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
push edi
call fcn.004db8d0
mov dword [esp + 0x28], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov ecx, dword [0x638e34]
mov byte [esp + 0x28], 1
cmp ecx, edi
je 0x4e2d85
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4e2d85
lea eax, [esp + 0x10]
push str._ENTERING__PzExtServerRepl::PzExtServerRepl__
push eax
mov dword [esp + 0x18], str..._xpathmake.cpp
mov dword [esp + 0x1c], 0x375
mov dword [esp + 0x20], 0x14
call fcn.004e4a60
add esp, 8
push str.ZDEFAULT_SERVER
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
cmp eax, edi
je 0x4e2dc6
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.004dbc50
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.004db920
push eax
mov ecx, esi
call fcn.004e2a90
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.004db9d0
mov ecx, dword [0x638e34]
cmp ecx, edi
je 0x4e2e06
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x28
jl 0x4e2e06
lea ecx, [esp + 0x10]
push str._EXITING__PzExtServerRepl::PzExtServerRepl__
push ecx
mov dword [esp + 0x18], str..._xpathmake.cpp
mov dword [esp + 0x1c], 0x37c
mov dword [esp + 0x20], 0x28
call fcn.004e4a60
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4e58f0
Capabilities:
Query environment variable
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x638e34]
test ecx, ecx
je 0x4e5954
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4e5954
mov eax, ebx
test ebx, ebx
jne 0x4e591d
mov eax, str._NULL_
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
push ecx
push ebp
push eax
lea edx, [esp + 0x18]
push str._ENTERING__PzLocalFile::Open__filename_s__flags_u__mask_u_
push edx
mov dword [esp + 0x20], str..._osfile.cpp
mov dword [esp + 0x24], 0x124
mov dword [esp + 0x28], 0x14
call fcn.004e4a60
add esp, 0x14
jmp 0x4e5958
mov ebp, dword [esp + 0x24]
cmp byte [esi + 8], 0
je 0x4e5967
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, ebp
and eax, 0x10
or eax, 0x801
add eax, eax
mov ecx, ebp
and ecx, 0xc0
or eax, ecx
push edi
add eax, eax
add eax, eax
mov edi, ebp
push 0x180
add eax, eax
and edi, 2
or eax, edi
push 0x40
push eax
push ebx
call dword [sym.imp.MSVCR90.dll__sopen]
add esp, 0x10
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x4e59f8
mov ecx, dword [0x638e34]
test ecx, ecx
je 0x4e59f8
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x4e59f8
test ebx, ebx
jne 0x4e59c4
mov ebx, str._null_
mov dword [esp + 0x10], str..._osfile.cpp
mov dword [esp + 0x14], 0x13f
mov dword [esp + 0x18], 0xa
call dword [sym.imp.MSVCR90.dll__errno]
mov ecx, dword [eax]
push ecx
push ebx
lea edx, [esp + 0x18]
push str.FAILED:_sopen_filename_s_:__d
push edx
call fcn.004e4a60
add esp, 0x10
mov al, byte [0x638e38]
test al, al
jne 0x4e5a25
push str.ZPOS_DREAD
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x4e5a1c
mov byte [0x638e38], 1
jmp 0x4e5a29
mov byte [0x638e38], 0xff
jmp 0x4e5a8e
cmp al, 1
jne 0x4e5a8e
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x4e5a8e
test edi, edi
jne 0x4e5a8e
push 2
push edi
push eax
call dword [sym.imp.MSVCR90.dll__lseek]
push 0x100000
mov ebp, eax
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
add esp, 0x10
xor ebx, ebx
mov edi, eax
test ebp, ebp
jbe 0x4e5a73
mov eax, dword [esi + 0x10]
push 0x100000
push edi
push eax
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
test eax, eax
jle 0x4e5a73
add ebx, eax
cmp ebx, ebp
jb 0x4e5a56
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esi + 0x10]
push 0
push 0
push ecx
call dword [sym.imp.MSVCR90.dll__lseek]
mov ebp, dword [esp + 0x38]
add esp, 0x10
xor bl, bl
cmp dword [esi + 0x10], 0xffffffff
pop edi
je 0x4e5aa2
mov dword [esi + 4], ebp
mov byte [esi + 8], 1
mov bl, 1
jmp 0x4e5aae
add esi, 0xc
push esi
call fcn.004e0fe0
add esp, 4
mov ecx, dword [0x638e34]
test ecx, ecx
je 0x4e5af2
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x28
jl 0x4e5af2
movzx ecx, bl
push ecx
lea edx, [esp + 0x10]
push str._ENTERING__PzLocalFile::Open__:__d
push edx
mov dword [esp + 0x18], str..._osfile.cpp
mov dword [esp + 0x1c], 0x17f
mov dword [esp + 0x20], 0x28
call fcn.004e4a60
add esp, 0xc
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x10
ret 0xc