joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e9850
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d124
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x5644a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d8], ecx
push str..json
mov eax, dword [ebp - 0x2d8]
add eax, 0x24
push eax
lea ecx, [ebp - 0x54]
push ecx
call fcn.004523b0
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x2a4], 0
push 0x24c
push 0
lea edx, [ebp - 0x2a0]
push edx
call fcn.00491e40
add esp, 0xc
mov dword [ebp - 0x2a8], 0
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040acf0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0xffffffff
jne 0x4e9906
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00402c30
jmp 0x4e99ec
lea ecx, [ebp - 0x2bc]
call fcn.0050ea20
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e0], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2e0]
push edx
lea ecx, [ebp - 0x2d0]
call fcn.0050ea20
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e8], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2e8]
push ecx
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x2d4], esp
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x2d8]
add ecx, 0x24
push ecx
push edx
call fcn.004523b0
add esp, 0xc
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2d8]
call fcn.004e78c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2d0]
call fcn.0050ea10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2bc]
call fcn.0050ea10
lea edx, [ebp - 0x2a4]
push edx
mov eax, dword [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4e9906
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00402c30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490d41
mov esp, ebp
pop ebp
ret
Function at 0x4f2370
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523fb0
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x5644a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp - 0x80]
add ecx, 0x10
call fcn.004f2fd0
cmp eax, 1
je 0x4f23bf
mov ecx, dword [ebp - 0x80]
add ecx, 0x10
call fcn.004f2fd0
cmp eax, 9
jne 0x4f24b5
push str.keep_alive_packet
lea ecx, [ebp - 0x6c]
call fcn.00402a30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.004101a0
mov dword [ebp - 0x24], eax
push str.172.168.10.1
lea ecx, [ebp - 0x50]
call fcn.00402a30
mov byte [ebp - 4], 1
push 0x26ac
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x7c]
push ecx
call fcn.0050bf30
add esp, 0xc
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov edx, dword [0x56a474]
and edx, 1
jne 0x4f2456
mov eax, dword [0x56a474]
or eax, 1
mov dword [0x56a474], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x56a470], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x56a470]
cmp eax, 0x1f4
jbe 0x4f249a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x56a470], eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x6c]
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x80]
add ecx, 8
mov eax, dword [ebp - 0x80]
mov edx, dword [eax + 8]
mov eax, dword [edx + 8]
call eax
jmp 0x4f2456
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00402ab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00402ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490d41
mov esp, ebp
pop ebp
ret
Function at 0x4f3030
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x48]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x38
push eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x4f30a1
push 1
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x1c], eax
jmp 0x4f30a8
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 4], 0xffffffff
jne 0x4f30b3
or eax, 0xffffffff
jmp 0x4f30b5
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4f30c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 3
mov dword [ebp - 0xc], 0
push 0
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x48
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x38
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x34], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4f3163
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x34], 0x3e5
je 0x4f3163
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp eax, 0xa
jge 0x4f315e
jmp 0x4f30ee
or eax, 0xffffffff
jmp 0x4f3174
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
add eax, 1
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4f3180
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 1
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4f31ac
or eax, 0xffffffff
jmp 0x4f32cf
mov dword [ebp - 0x14], 0
push 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4f31fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x4f31fd
mov edx, dword [ebp + 8]
movzx eax, word [edx + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp + 8]
mov word [edx + 2], ax
jmp 0x4f3222
cmp dword [ebp - 0x14], 0
je 0x4f3222
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
je 0x4f3222
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x4f32cf
cmp dword [ebp - 0x14], 0
je 0x4f3239
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
je 0x4f31b3
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 4
lea edx, [ebp - 4]
push edx
push 0x9800000c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebp - 0xc], 0x80000
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x1002
push 0xffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1001
push 0xffff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0xc], 0x7d0
push 4
lea edx, [ebp - 0xc]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4f4eb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 2
push 0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4f4f29
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x34], 0x3e5
je 0x4f4f29
or eax, 0xffffffff
jmp 0x4f4f3a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4f4f40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 3
push 0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4f4fbb
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x34], 0x3e5
je 0x4f4fbb
or eax, 0xffffffff
jmp 0x4f4fcc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4f5020
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4f5046
or eax, 0xffffffff
jmp 0x4f5129
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0050be50
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x4f50a9
mov edx, 2
mov eax, dword [ebp + 8]
mov word [eax], dx
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004936df
add esp, 4
call fcn.004936f1
cdq
mov ecx, 0x2710
idiv ecx
add edx, 0x2710
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp + 8]
mov word [edx + 2], ax
push 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4f50f3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x4f50f3
mov edx, dword [ebp + 8]
movzx eax, word [edx + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp + 8]
mov word [edx + 2], ax
jmp 0x4f510b
cmp dword [ebp - 8], 0
je 0x4f510b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
je 0x4f510b
or eax, 0xffffffff
jmp 0x4f5129
cmp dword [ebp - 8], 0
je 0x4f511e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
je 0x4f50a9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4f63a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a41e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5644a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
xor eax, eax
mov word [ebp - 0x10], ax
xor ecx, ecx
mov word [ebp - 0xe], cx
push 4
lea edx, [ebp - 0x10]
push edx
push 0x80
push 0xffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax - 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 0x24]
sub ecx, 0xc
mov edx, dword [ebp - 0x24]
mov eax, dword [edx - 0xc]
mov edx, dword [eax + 0x14]
call edx
mov eax, dword [ebp - 0x24]
add eax, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.00403330
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx - 4], 0
jle 0x4f642d
mov edx, dword [ebp - 0x24]
mov byte [edx + 0xae], 1
jmp 0x4f6464
lea ecx, [ebp - 0x18]
call fcn.00441c40
mov eax, dword [ebp - 0x24]
sub eax, 0xc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x4f645d
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
call edx
mov dword [ebp - 0x28], eax
jmp 0x4f6464
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403360
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4f7570
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52738e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5644a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
xor eax, eax
mov word [ebp - 0xe], ax
xor ecx, ecx
mov word [ebp - 0x10], cx
push 4
lea edx, [ebp - 0x10]
push edx
push 0x80
push 0xffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax - 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 0x24]
sub ecx, 0xc
mov edx, dword [ebp - 0x24]
mov eax, dword [edx - 0xc]
mov edx, dword [eax + 0x14]
call edx
mov eax, dword [ebp - 0x24]
add eax, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.00403330
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx - 4], 0
jle 0x4f75fd
mov edx, dword [ebp - 0x24]
mov byte [edx + 0xaa], 1
jmp 0x4f7634
lea ecx, [ebp - 0x18]
call fcn.00441c40
mov eax, dword [ebp - 0x24]
sub eax, 0xc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x4f762d
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
call edx
mov dword [ebp - 0x28], eax
jmp 0x4f7634
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403360
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4f7a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x4f7a59
or eax, 0xffffffff
jmp 0x4f7a8b
push 0
push 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
push 0x4f7960
push 0
push 0
call fcn.004944c8
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4f7a89
or eax, 0xffffffff
jmp 0x4f7a8b
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4f7a90
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x509260
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x700c
push 0xffff
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x5092ab
cmp dword [ebp - 8], 0xffffffff
je 0x5092eb
cmp dword [ebp - 8], 0x1e
jle 0x5092eb
xor ecx, ecx
mov word [ebp - 0x10], cx
xor edx, edx
mov word [ebp - 0xe], dx
push 4
lea eax, [ebp - 0x10]
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x54], 0xffffffff
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x509300
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x54], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x54], 0xffffffff
jne 0x509337
or eax, 0xffffffff
jmp 0x5093a1
mov eax, dword [ebp - 0xc]
add eax, 0x20
push eax
lea ecx, [ebp - 8]
push ecx
push 0x20
push 0x20
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x38]
sub eax, 0x40
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x50939f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x50939f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x54], 0xffffffff
or eax, 0xffffffff
jmp 0x5093a1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x50aec0
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x20000013
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x50af30
cmp dword [ebp - 0x20], 0xc8
jne 0x50af21
cmp dword [ebp - 0x1c], 0
je 0x50af38
cmp dword [ebp - 0x20], 0x12e
jne 0x50af30
cmp dword [ebp - 0x1c], 0
je 0x50af38
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x50af8d
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x20]
push eax
push 0x20000005
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x50af7b
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x50af8d
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x50b030
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5242d4
mov eax, dword fs:[0]
push eax
mov eax, 0x2144
call fcn.004a5c90
mov eax, dword [0x5644a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2150], ecx
mov byte [ebp - 0x114], 0
push 0xff
push 0
lea eax, [ebp - 0x113]
push eax
call fcn.00491e40
add esp, 0xc
mov byte [ebp - 0x125], 1
lea ecx, [ebp - 0x124]
call fcn.0042c910
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2150]
cmp dword [ecx + 0x50], 0
je 0x50b0ca
mov edx, dword [ebp - 0x2150]
mov eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp - 0x2150]
call fcn.0050aec0
mov ecx, dword [ebp - 0x2150]
mov ecx, dword [ecx + 0x50]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ebp - 0x2138], 0x2000
mov byte [ebp - 0x2134], 0
push 0x1fff
push 0
lea edx, [ebp - 0x2133]
push edx
call fcn.00491e40
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
push 0x2000
lea ecx, [ebp - 0x2134]
push ecx
mov edx, dword [ebp - 0x2150]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x50b19f
cmp dword [ebp - 0x130], 0
je 0x50b19f
mov ecx, dword [ebp - 0x2150]
cmp dword [ecx + 0x54], 0
je 0x50b15c
mov edx, dword [ebp - 0x2150]
mov eax, dword [edx + 0x54]
mov ecx, dword [ebp - 0x130]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
mov eax, dword [ebp - 0x2150]
mov eax, dword [eax + 0x54]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea ecx, [ebp - 0x2140]
push ecx
lea ecx, [ebp - 0x124]
call fcn.00486f00
mov edx, dword [eax]
mov dword [ebp - 0x213c], edx
mov eax, dword [ebp - 0x130]
lea ecx, [ebp + eax - 0x2134]
push ecx
lea edx, [ebp - 0x2134]
push edx
mov eax, dword [ebp - 0x213c]
push eax
lea ecx, [ebp - 0x124]
call fcn.00426ab0
jmp 0x50b1c0
cmp dword [ebp - 0x12c], 0
jne 0x50b1be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x2150]
mov dword [ecx + 0x4c], eax
mov byte [ebp - 0x125], 0
jmp 0x50b1cd
mov edx, 1
test edx, edx
jne 0x50b0ca
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x50b240
mov ecx, dword [ebp - 0x2150]
call fcn.0050aff0
test eax, eax
je 0x50b240
lea ecx, [ebp - 0x2144]
push ecx
lea ecx, [ebp - 0x124]
call fcn.00486f00
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x2148]
push eax
lea ecx, [ebp - 0x124]
call fcn.0045bd10
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x2150]
mov ecx, dword [edx + 0x5c]
call fcn.00426af0
mov byte [ebp - 0x2149], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00426590
mov al, byte [ebp - 0x2149]
jmp 0x50b27d
mov eax, dword [ebp - 0x2150]
cmp dword [eax + 0x4c], 0xffffffff
jne 0x50b25e
mov ecx, dword [ebp - 0x2150]
mov edx, dword [ebp - 0x2150]
mov eax, dword [edx + 0x48]
mov dword [ecx + 0x4c], eax
mov byte [ebp - 0x214a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00426590
mov al, byte [ebp - 0x214a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490d41
mov esp, ebp
pop ebp
ret