joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0eb0
Capabilities:
Delete file

Disassembly:
mov eax, 0x4004
call fcn.004b5ac0
mov eax, dword [0x557200]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push eax
lea eax, [esp + 4]
push 0x2000
push eax
call fcn.004e1170
add esp, 0xc
test eax, eax
jne 0x4e0f22
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4e0f0d
xor eax, eax
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.004b4f32
add esp, 0x4004
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e0ef4
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.004b4f32
add esp, 0x4004
ret 8

Function at 0x4e0f40
Capabilities:
Move file

Disassembly:
mov eax, 0x8004
call fcn.004b5ac0
mov eax, dword [0x557200]
xor eax, esp
mov dword [esp + 0x8000], eax
mov eax, dword [esp + 0x8008]
push esi
mov esi, dword [esp + 0x8010]
push eax
lea eax, [esp + 0x4008]
push 0x2000
push eax
call fcn.004e1170
add esp, 0xc
test eax, eax
jne 0x4e0fde
push esi
lea eax, [esp + 8]
push 0x2000
push eax
call fcn.004e1170
add esp, 0xc
test eax, eax
jne 0x4e0fde
push 3
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x400c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4e0fcb
xor eax, eax
pop esi
mov ecx, dword [esp + 0x8000]
xor ecx, esp
call fcn.004b4f32
add esp, 0x8004
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4e0fb1
call esi
add eax, 0xafc80
mov ecx, dword [esp + 0x8004]
pop esi
xor ecx, esp
call fcn.004b4f32
add esp, 0x8004
ret 0xc

Function at 0x4e1270
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x2c], 0
je 0x4e1319
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
cmp dword [esi + 0x48], 1
jne 0x4e1312
push edi
mov edi, dword [esi + 0x3c]
test edi, edi
je 0x4e1311
push ebx
mov ebx, dword [esi + 0x38]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4e12d2
mov eax, dword [esp + 0x14]
add dword [esi + 0x50], eax
adc dword [esi + 0x54], ebp
add ebx, eax
sub edi, eax
jne 0x4e12a0
pop ebx
mov dword [esi + 0x3c], edi
mov eax, ebp
pop edi
pop ebp
pop esi
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x4e12f6
mov eax, dword [esp + 0x14]
xor ebp, ebp
add dword [esi + 0x50], eax
mov eax, ebp
pop ebx
adc dword [esi + 0x54], ebp
pop edi
mov dword [esi + 0x3c], ebp
pop ebp
pop esi
ret 4
call edi
mov ebp, eax
mov eax, dword [esp + 0x14]
add dword [esi + 0x50], eax
adc dword [esi + 0x54], 0
add ebp, 0xafc80
jne 0x4e1310
mov dword [esi + 0x3c], ebp
pop ebx
pop edi
mov eax, ebp
pop ebp
pop esi
ret 4
xor eax, eax
pop esi
ret 4
Function at 0x4e1910
Capabilities:
Read file on windows
Read pipe

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x4e199d
cmp byte [esi + 8], al
je 0x4e199d
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x4e197e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x4e195d
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
ret
call esi
add eax, 0xafc80
mov ecx, 0x1117e
cmp eax, 0xafced
pop edi
cmove eax, ecx
mov ecx, dword [esp + 0x14]
pop esi
mov dword [ecx], 0
ret
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4e1998
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], 0
mov eax, 0xb
ret
cmp edi, eax
cmova edi, eax
mov ecx, dword [esi + 0xc]
mov eax, ecx
test ecx, ecx
je 0x4e19c8
cmp byte [esi + 8], 0
jne 0x4e19c8
mov eax, dword [esi + 0x50]
mov dword [ecx + 8], eax
mov cl, 0x20
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
call fcn.00501280
mov ecx, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esp + 0x20]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e19e8
xor eax, eax
jmp 0x4e1ad5
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
je 0x4e1ad5
call ebx
add eax, 0xafc80
cmp eax, 0xb0065
jne 0x4e1ab0
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
test ecx, ecx
jl 0x4e1a31
jg 0x4e1a21
test eax, eax
je 0x4e1a31
push 0
push 0x3e8
push ecx
push eax
call fcn.004b5860
jmp 0x4e1a3e
and eax, ecx
cmp eax, 0xffffffff
jne 0x4e1a3c
or eax, eax
jmp 0x4e1a3e
xor eax, eax
push eax
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
call ebp
mov edi, eax
cmp edi, 0x80
je 0x4e1a11
pop ebp
test edi, edi
je 0x4e1a5f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4e1a7a
xor eax, eax
jmp 0x4e1ad5
call ebx
test eax, eax
je 0x4e1ad5
call ebx
add eax, 0xafc80
cmp eax, 0xb0064
je 0x4e1a95
cmp eax, 0xb0063
jne 0x4e1ab0
cmp edi, 0x102
jne 0x4e1ab0
mov edx, dword [esp + 0x1c]
mov eax, 0x11177
mov ecx, dword [esp + 0x18]
pop ebx
pop edi
mov dword [edx], ecx
pop esi
ret
cmp eax, 0xafced
jne 0x4e1aca
mov edx, dword [esp + 0x1c]
mov eax, 0x1117e
mov ecx, dword [esp + 0x18]
pop ebx
pop edi
mov dword [edx], ecx
pop esi
ret
cmp eax, 0xafca6
je 0x4e1ab7
test eax, eax
jne 0x4e1af3
cmp dword [esp + 0x18], 0
je 0x4e1ab7
cmp dword [esi + 0xc], 0
je 0x4e1af3
cmp byte [esi + 8], 0
jne 0x4e1af3
mov ecx, dword [esp + 0x18]
add dword [esi + 0x50], ecx
adc dword [esi + 0x54], 0
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
pop ebx
pop edi
mov dword [edx], ecx
pop esi
ret
Function at 0x4e1ec0
Capabilities:
Allocate thread local storage
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x557200]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [0x560e50]
mov ecx, eax
inc eax
mov dword [0x560e50], eax
test ecx, ecx
jne 0x4e1f83
lea eax, [esp + 4]
push eax
call fcn.004e8270
add esp, 4
test eax, eax
jne 0x4e1fa0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x560f80], eax
call fcn.004de2e0
test eax, eax
jne 0x4e1fa5
push eax
push eax
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004de0f0
test eax, eax
je 0x4e1f41
mov eax, 0x4e22
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.004b4f32
add esp, 0x19c
ret
push str.apr_initialize
push dword [esp + 4]
call fcn.004de3c0
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4e1fa5
mov eax, dword [esp + 8]
cmp al, 2
jne 0x4e1f9a
shr eax, 8
test al, al
jne 0x4e1f9a
push dword [esp]
call fcn.0040a020
push dword [esp + 4]
call fcn.004e5e00
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.004b4f32
add esp, 0x19c
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x11
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.004b4f32
add esp, 0x19c
ret

Function at 0x4e1fd0
Capabilities:
Allocate thread local storage

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
push 8
push esi
call fcn.004dde90
mov edi, dword [esp + 0xc]
mov dword [edi], eax
test eax, eax
jne 0x4e1ff2
pop edi
mov eax, 0xc
pop esi
ret 0xc
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [edi]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
je 0x4e200b
pop edi
xor eax, eax
pop esi
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4e2004
call esi
pop edi
add eax, 0xafc80
pop esi
ret 0xc

Function at 0x4e2060
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
test eax, eax
je 0x4e207c
xor eax, eax
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e2077
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
ret 8

Function at 0x4e20a0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
push dword [esp + 4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4e20ba
xor eax, eax
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e20b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
ret 8
Function at 0x4e4940
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6004
call fcn.004b5ac0
mov eax, dword [0x557200]
xor eax, esp
mov dword [esp + 0x6000], eax
push esi
mov esi, dword [esp + 0x600c]
lea eax, [esp + 0x2004]
push edi
mov edi, dword [esp + 0x6018]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4e4994
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4e49f0
call esi
add eax, 0xafc80
jmp 0x4e49f2
lea eax, [esp + 0x2008]
push eax
lea eax, [esp + 0xc]
push 0x2000
push eax
call fcn.004e10c0
add esp, 0xc
test eax, eax
jne 0x4e49f2
test byte [esp + 0x6014], 0x10
jne 0x4e49e3
mov cl, byte [esp + 8]
lea eax, [esp + 8]
mov dword [esi], eax
test cl, cl
je 0x4e49e3
nop word [eax + eax]
cmp cl, 0x5c
jne 0x4e49da
mov byte [eax], 0x2f
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov cl, byte [eax]
test cl, cl
jne 0x4e49d0
lea eax, [esp + 8]
push eax
push edi
call fcn.004de600
mov dword [esi], eax
xor eax, eax
mov ecx, dword [esp + 0x6008]
pop edi
pop esi
xor ecx, esp
call fcn.004b4f32
add esp, 0x6004
ret 0xc

Function at 0x4e4bf0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4004
call fcn.004b5ac0
mov eax, dword [0x557200]
xor eax, esp
mov dword [esp + 0x4000], eax
cmp dword [0x560ea8], 0x1e
mov eax, dword [esp + 0x4008]
push eax
jl 0x4e4c3b
lea eax, [esp + 4]
push 0x2000
push eax
call fcn.004e1170
add esp, 0xc
test eax, eax
jne 0x4e4c66
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x4e4c41
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x4e4c61
cmp eax, 1
je 0x4e4c61
xor eax, eax
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.004b4f32
add esp, 0x4004
ret
mov eax, 0x4e38
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.004b4f32
add esp, 0x4004
ret
Function at 0x4e4ec0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4018
call fcn.004b5ac0
mov eax, dword [0x557200]
xor eax, esp
mov dword [esp + 0x4014], eax
mov edx, dword [esp + 0x4020]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x4020]
push ebp
mov ebp, dword [esp + 0x402c]
push esi
mov dword [esp + 0x14], 0x2000
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e4f00
sub ecx, esi
lea eax, [ecx + 1]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x14]
push eax
push edx
call fcn.004e8590
cmp eax, 0x11178
jne 0x4e4f36
mov eax, 0x26
jmp 0x4e4fe3
test eax, eax
jne 0x4e4fe3
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0x2c]
push eax
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x4e4f70
mov eax, 2
jmp 0x4e4fe2
test esi, esi
jne 0x4e4f83
push 0x536db7
push ebp
call fcn.004de600
mov dword [ebx], eax
jmp 0x4e4fe0
lea eax, [esi + esi]
push eax
push ebp
call fcn.004dde90
push esi
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
push eax
call edi
mov edi, dword [esp + 0x10]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e4fa3
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [esp + 0x20], eax
lea eax, [eax + eax*2]
push eax
push ebp
mov dword [esp + 0x24], eax
call fcn.004dde90
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x28]
push eax
push edi
call fcn.004e8420
test eax, eax
jne 0x4e4fe2
mov dword [ebx], esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x4020]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b4f32
add esp, 0x4018
ret 0xc
Function at 0x4e6100
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x418
mov eax, dword [0x557200]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x424]
push edi
mov edi, dword [esp + 0x424]
cmp dword [esi + 0x10], 0x17
jne 0x4e6192
cmp word [esi + 0x30], 0
jne 0x4e6192
cmp word [esi + 0x32], 0
jne 0x4e6192
cmp word [esi + 0x34], 0
jne 0x4e6192
cmp word [esi + 0x36], 0
jne 0x4e6192
cmp word [esi + 0x38], 0
jne 0x4e6192
mov eax, 0xffff
cmp word [esi + 0x3a], ax
jne 0x4e6192
mov eax, dword [esi + 0x20]
mov ecx, 4
mov dword [esp + 8], 2
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x42c]
test eax, eax
cmovne ecx, eax
lea eax, [esp + 0x18]
push ecx
push 0
push 0
push 0x401
push eax
push 0x10
lea eax, [esp + 0x20]
jmp 0x4e61b8
mov eax, dword [esp + 0x42c]
mov ecx, 4
test eax, eax
cmovne ecx, eax
lea eax, [esp + 0x18]
push ecx
push 0
push 0
push 0x401
push eax
push dword [esi + 0x14]
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x4e61d0
mov dword [edi], 0
add eax, 0xa3930
jmp 0x4e61e3
lea eax, [esp + 0x18]
push eax
push dword [esi]
call fcn.004de600
mov dword [esi + 4], eax
mov dword [edi], eax
xor eax, eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
xor ecx, esp
call fcn.004b4f32
add esp, 0x418
ret 0xc

Function at 0x4e65f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
test eax, eax
jne 0x4e6677
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x30], eax
jne 0x4e6608
cmp dword [esi + 0x2c], eax
je 0x4e6667
mov eax, dword [esi + 0x10]
mov dword [eax + 0x14], 0x1c
mov ecx, dword [esi + 0x10]
lea eax, [ecx + 0x14]
push eax
lea eax, [ecx + 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x4e6644
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
test eax, eax
je 0x4e6667
call edi
add eax, 0xafc80
je 0x4e6667
pop edi
pop esi
ret 0xc
mov eax, dword [esi + 0x10]
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
movzx eax, word [eax + 0x2a]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esi + 0x10]
mov word [ecx + 0xc], ax
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
ret 0xc
cmp eax, 1
jne 0x4e66ee
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x34], 0
je 0x4e66de
mov eax, dword [esi + 0x14]
mov dword [eax + 0x14], 0x1c
mov ecx, dword [esi + 0x14]
lea eax, [ecx + 0x14]
push eax
lea eax, [ecx + 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jns 0x4e66c2
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
test eax, eax
je 0x4e66de
call edi
add eax, 0xafc80
je 0x4e66de
pop edi
pop esi
ret 0xc
mov eax, dword [esi + 0x14]
mov dword [esi + 0x34], 0
movzx eax, word [eax + 0x2a]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esi + 0x14]
mov word [ecx + 0xc], ax
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x14]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
ret 0xc
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov dword [eax], 0
mov eax, 0x16
ret 0xc
Function at 0x4e6760
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x40]
xor ecx, ecx
push edi
mov edi, dword [esp + 0x34]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
movups xmmword [esp + 0x1c], xmm0
test edi, edi
jne 0x4e67a5
mov eax, dword [esp + 0x3c]
or dword [esp + 0xc], 1
movzx eax, ax
push eax
push esi
call fcn.004de4e0
mov ecx, eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x10]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4e67da
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
test eax, eax
jne 0x4e67cd
pop edi
pop esi
add esp, 0x24
ret
call esi
pop edi
add eax, 0xafc80
pop esi
add esp, 0x24
ret
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
xor ebp, ebp
test ebx, ebx
je 0x4e68d6
nop word [eax + eax]
mov eax, dword [ebx + 4]
cmp eax, 2
je 0x4e6801
cmp eax, 0x17
jne 0x4e68c1
push 0x44
push 0
push 0x44
push esi
call fcn.004dde90
push eax
call fcn.004b73e0
mov esi, eax
mov eax, dword [esp + 0x58]
mov dword [esi], eax
lea edi, [esi + 0x28]
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push edi
call fcn.004b6e60
mov eax, dword [ebx + 4]
add esp, 0x18
mov word [edi], ax
mov edi, dword [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esi + 0x10], eax
test di, di
je 0x4e6856
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0x2a], ax
mov eax, dword [esp + 0x10]
mov word [esi + 0xc], di
cmp eax, 2
jne 0x4e6875
mov dword [esi + 0x14], 0x10
lea eax, [esi + 0x2c]
mov dword [esi + 0x1c], 0x10
mov dword [esi + 0x18], 4
jmp 0x4e6892
cmp eax, 0x17
jne 0x4e6895
mov dword [esi + 0x14], 0x1c
lea eax, [esi + 0x30]
mov dword [esi + 0x1c], 0x2e
mov dword [esi + 0x18], 0x10
mov dword [esi + 0x20], eax
test ebp, ebp
jne 0x4e68b6
mov edi, dword [esp + 0x3c]
test edi, edi
je 0x4e68ae
push edi
push dword [esp + 0x50]
call fcn.004de600
mov dword [esi + 4], eax
mov eax, dword [esp + 0x38]
mov dword [eax], esi
jmp 0x4e68bf
mov eax, dword [ebp + 4]
mov dword [esi + 4], eax
mov dword [ebp + 0x24], esi
mov ebp, esi
mov eax, dword [ebx + 0x1c]
mov ebx, eax
mov esi, dword [esp + 0x4c]
test eax, eax
jne 0x4e67f0
mov ebx, dword [esp + 0x40]
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
xor eax, eax
mov ecx, 0x4e2e
test ebp, ebp
pop ebp
pop ebx
pop edi
cmove eax, ecx
pop esi
add esp, 0x24
ret
Function at 0x4e70b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0
push 0
mov eax, dword [edi]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x4e711d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x4e7105
mov dword [edi], eax
pop edi
add esp, 0xc
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], 0
add eax, 0xafc80
pop edi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 4]
mov dword [edi], eax
xor eax, eax
pop edi
add esp, 0xc
ret 0xc

Function at 0x4e7130
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x18]
push dword [eax + 0x14]
add eax, 0x28
push eax
push dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push dword [esi]
push dword [esp + 0x24]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x4e7179
mov dword [esi], 0
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
test eax, eax
je 0x4e717b
call esi
add eax, 0xafc80
pop esi
ret 0x14
mov dword [esi], eax
xor eax, eax
pop esi
ret 0x14
Function at 0x4e7590
Capabilities:
Set socket configuration

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4e75c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4e75c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xafc80
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x4e75d0
Capabilities:
Set socket configuration

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 1
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4e7607
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4e7607
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xafc80
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x4e8230
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x4e8267
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4e8262
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e8262
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
ret 8
xor eax, eax
ret 8
mov eax, 0x4e3b
ret 8

Function at 0x4e8270
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x560ea8]
test ecx, ecx
jne 0x4e83b3
push 0x560eb0
mov dword [0x560eb0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x560ec0], 2
jne 0x4e83a8
mov al, byte [0x560ec4]
push esi
mov esi, 0x560ec4
test al, al
je 0x4e82f7
nop
movzx eax, al
push eax
call fcn.004c3440
add esp, 4
test eax, eax
jne 0x4e82f7
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4e82b0
mov eax, dword [0x560eac]
mov ecx, dword [0x560eb4]
pop esi
cmp ecx, 3
jb 0x4e83a8
je 0x4e83a8
cmp ecx, 4
jne 0x4e8343
cmp eax, 2
jae 0x4e830c
mov ecx, 0x28
jmp 0x4e83ad
cmp byte [esi], 0
je 0x4e82c8
push esi
call fcn.004beb63
add esp, 4
mov dword [0x560eac], eax
jmp 0x4e82cd
ja 0x4e8318
mov ecx, 0x2a
jmp 0x4e83ad
cmp eax, 3
ja 0x4e8327
mov ecx, 0x2b
jmp 0x4e83ad
cmp eax, 4
ja 0x4e8333
mov ecx, 0x2c
jmp 0x4e83ad
mov ecx, 5
cmp ecx, eax
sbb ecx, ecx
neg ecx
add ecx, 0x2d
jmp 0x4e83ad
cmp ecx, 5
jne 0x4e838d
mov ecx, dword [0x560eb8]
test ecx, ecx
jne 0x4e8368
test eax, eax
jne 0x4e835b
lea ecx, [eax + 0x32]
jmp 0x4e83ad
xor ecx, ecx
cmp eax, 1
setne cl
add ecx, 0x33
jmp 0x4e83ad
cmp ecx, 2
jne 0x4e8374
mov ecx, 0x46
jmp 0x4e83ad
cmp eax, 1
jae 0x4e8380
mov ecx, 0x3c
jmp 0x4e83ad
xor ecx, ecx
cmp eax, 1
setne cl
add ecx, 0x3d
jmp 0x4e83ad
cmp ecx, 6
jne 0x4e8379
cmp dword [0x560eb8], 0
mov ecx, 0x5a
mov eax, 0x50
cmove ecx, eax
jmp 0x4e83ad
mov ecx, 1
mov dword [0x560ea8], ecx
mov eax, dword [esp + 4]
mov dword [eax], ecx
xor eax, eax
cmp dword [0x560ea8], 1
mov ecx, 0x4e2e
cmovl eax, ecx
ret
Function at 0x4ea110
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push esi
xor eax, eax
xor esi, esi
cmp dword [0x560ea8], 0x32
mov ecx, 0x40
cmovge eax, ecx
or eax, 0xf0000000
push eax
push 1
push esi
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4ea15b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x4ea14f
pop esi
pop ecx
ret 8
call esi
add eax, 0xafc80
pop esi
pop ecx
ret 8
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4ea199
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x4ea191
xor esi, esi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop ecx
ret 8
call esi
lea esi, [eax + 0xafc80]
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop ecx
ret 8