joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b24d0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4b24e6
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
ret
or eax, 0xffffffff
ret

Function at 0x4b24f0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x4b2548
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.004b24d0
add esp, 4
cmp eax, 0xffffffff
je 0x4b2543
push edi
push eax
call sub.WS2_32.dll_inet_ntoa
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.004b5b60
add esp, 8
mov esi, eax
pop edi
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x4b2640
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x4b2653
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.004b5d80
add esp, 4
test eax, eax
jne 0x4b2665
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x4b2674
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x4b26cb
mov ebx, dword [ebx + 4]
push edi
call fcn.0051703b
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b26ae
push ebp
call fcn.00517064
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.004b5170
push ebp
mov esi, eax
call fcn.00517064
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x4b270d
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.004ad390
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x4b270a
push esi
call fcn.004ad420
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4b2ba0
Capabilities:
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call sub.WS2_32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b2bc7
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4b2bc7
mov eax, dword [eax + 0xc]
pop edi
pop esi
mov ecx, dword [eax]
mov eax, dword [ecx]
ret
mov eax, esi
pop edi
pop esi
ret
Function at 0x4b2bd0
Capabilities:
Initialize winsock library
Send icmp echo request

Disassembly:
sub esp, 0x2a8
lea eax, [esp + 0x118]
push ebp
push eax
push 0x202
or ebp, 0xffffffff
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x4b2c67
mov ecx, dword [esp + 0x2b4]
push ebx
push esi
push edi
push ecx
call fcn.004b2ba0
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x4b2c55
mov eax, dword [esp + 0x2d4]
mov edi, 0x2710
test eax, eax
je 0x4b2c21
mov edi, dword [esp + 0x2cc]
call sub.icmp.dll_IcmpCreateFile
mov esi, eax
test esi, esi
je 0x4b2c55
push edi
lea edx, [esp + 0x14]
push 0x116
push edx
push 0
push 0xd
push 0x6dcffc
push ebx
push esi
call sub.icmp.dll_IcmpSendEcho
test eax, eax
je 0x4b2c4f
mov ebp, dword [esp + 0x18]
push esi
call sub.icmp.dll_IcmpCloseHandle
call sub.WS2_32.dll_WSACleanup
pop edi
pop esi
mov eax, ebp
pop ebx
pop ebp
add esp, 0x2a8
ret
mov eax, ebp
pop ebp
add esp, 0x2a8
ret
Function at 0x4b2ca0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
push edi
ja 0x4b2d20
je 0x4b2d11
cmp eax, 0x80000101
ja 0x4b2d0a
je 0x4b2d11
cmp eax, reloc.WS2_32.dll_connect
je 0x4b2ced
cmp eax, reloc.WS2_32.dll_getpeername
jne 0x4b2d35
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 3
test eax, eax
je 0x4b2d7b
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x4b2d7b
mov ebp, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 1
mov ebx, ecx
inc ebx
jmp 0x4b2d7b
cmp eax, 0x80000201
jne 0x4b2d35
mov ebx, 4
lea ebp, [esp + 0x44]
mov dword [esp + 0xc], ebx
jmp 0x4b2d7b
cmp eax, 0x80000401
je 0x4b2d66
cmp eax, 0x80000501
je 0x4b2d52
cmp eax, 0x80000601
je 0x4b2d3e
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.0050446c
jmp 0x4b2d73
fld dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.0050446c
jmp 0x4b2d73
mov eax, dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea ebp, [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004b5c10
mov edi, dword [esp + 0x3c]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
test edx, edx
je 0x4b2e56
test ecx, ecx
je 0x4b2e56
inc ecx
push esi
push ecx
call fcn.0051703b
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00504740
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4b2df8
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4b2e4c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4b2e41
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00517064
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x4b2ff0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x4b3010
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4b3053
push edi
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.004b5b60
add esp, 8
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x4b3680
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4b369e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4b3693
pop esi
ret

Function at 0x4b37a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x4b37b3
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.004b5d80
add esp, 4
test eax, eax
jne 0x4b37c5
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x4b383c
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x4b386e
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4b3828
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4b37f8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x4b386e
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x4b386e
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x4b3857
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x4b38e0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x4b38f6
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.004b5d80
add esp, 4
test eax, eax
jne 0x4b390d
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, dword [esi]
push ebx
push ebp
cmp eax, 1
push edi
mov dword [esp + 0x10], 1
jne 0x4b39bd
mov esi, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
mov ebx, eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x4b3a25
cmp edi, ebx
jae 0x4b3a25
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x4b3a25
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4b3a25
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push edi
push esi
mov ebx, eax
call ebp
test ebx, ebx
je 0x4b3a25
mov al, byte [esp + 0x24]
test al, al
je 0x4b3a1d
cmp al, 0x1a
jne 0x4b3a25
pop edi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
cmp eax, 2
jne 0x4b3a25
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.004b6110
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x4b3a25
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x4b3a25
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4b3a25
mov edx, dword [esi]
lea eax, [esp + 0x24]
push 1
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebp, eax
call dword [edx + 0x18]
test ebp, ebp
je 0x4b3a25
mov al, byte [esp + 0x24]
test al, al
je 0x4b3a1d
cmp al, 0x1a
jne 0x4b3a25
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x4b3a40
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
push edi
jne 0x4b3a59
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push esi
call fcn.004b5d80
add esp, 4
test eax, eax
jne 0x4b3a6e
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, 1
jne 0x4b3bae
mov edi, dword [esi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
push 0
push 0
push edi
mov dword [esp + 0x24], edi
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4b3aac
push 2
push 0
push 0
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0x1000
xor ebp, ebp
call fcn.00505042
add esp, 4
mov ebx, eax
lea eax, [esp + 0x20]
mov esi, ebx
push ebp
push eax
push 0x1000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b3b8e
mov edx, dword [esp + 0x20]
xor ecx, ecx
test edx, edx
jbe 0x4b3af4
mov al, byte [esi]
cmp al, 0xd
je 0x4b3b36
cmp al, 0xa
je 0x4b3b36
inc ecx
inc esi
cmp ecx, edx
jb 0x4b3ae4
add ebp, edx
cmp edx, 0x1000
jb 0x4b3b38
push 0x1000
push ebx
call fcn.00504d13
mov ebx, eax
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, 0x1000
jne 0x4b3b38
lea ecx, [esp + 0x20]
push 0
lea esi, [ebx + ebp]
push ecx
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b3b8e
jmp 0x4b3ada
add ebp, ecx
lea edx, [ebp + 1]
push edx
call fcn.004ad390
mov ecx, dword [esp + 0x14]
mov edi, eax
mov al, byte [esi]
add esp, 4
add ecx, ebp
cmp al, 0xd
je 0x4b3b56
cmp al, 0xa
jne 0x4b3b5f
mov al, byte [esi + 1]
inc ecx
cmp al, 0xa
jne 0x4b3b5f
inc ecx
mov eax, dword [esp + 0x14]
push 0
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
push ebx
push edi
call fcn.005044a0
push ebx
mov byte [edi + ebp], 0
call fcn.00504c2a
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call fcn.00504c2a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x4b3c3c
mov esi, dword [esi + 4]
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi]
push edx
push 0xffffffffffffffff
push 0
mov ecx, esi
call dword [eax + 0x30]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
test eax, eax
jbe 0x4b3bf7
mov cl, byte [ebp]
cmp cl, 0xd
je 0x4b3bf7
cmp cl, 0xa
je 0x4b3bf7
inc ebx
inc ebp
cmp ebx, eax
jb 0x4b3be4
lea eax, [ebx + 1]
push eax
call fcn.004ad390
mov ecx, dword [esp + 0x18]
mov edi, eax
mov al, byte [ebp]
add esp, 4
add ecx, ebx
cmp al, 0xd
je 0x4b3c16
cmp al, 0xa
jne 0x4b3c1f
mov al, byte [ebp + 1]
inc ecx
cmp al, 0xa
jne 0x4b3c1f
inc ecx
mov edx, dword [esi]
push 0
push ecx
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
call fcn.005044a0
add esp, 0xc
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4b71d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x4b7206
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x4bb510
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520d68
push 0x505f98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00506120
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bb6c0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x4bb701
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x4bb76e
cmp dword [esp + 0x1c], 2
jne 0x4bb76e
cmp dword [esp + 0x10], 5
jne 0x4bb76e
cmp dword [esp + 0x14], 1
jne 0x4bb76e
push 0x6ddac0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4bb758
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4bb749
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x4bb751
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x4bb76e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret
Function at 0x4bfa10
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x348
push ebx
push esi
push edi
mov edi, ecx
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
lea eax, [esp + 0xc]
push 7
and esi, 0xffff
push eax
push 0x1004
push esi
call ebx
lea ecx, [esp + 0xc]
push ecx
call fcn.00504460
add esp, 4
lea edx, [esp + 0x14c]
mov dword [edi + 4], eax
push 0x104
push edx
push 0x1002
push esi
call ebx
lea eax, [esp + 0x14c]
lea ecx, [edi + 0xc]
push eax
call fcn.005173d5
lea ecx, [esp + 0xc]
push 7
push ecx
push 5
push esi
call ebx
lea edx, [esp + 0xc]
push edx
call fcn.00504460
add esp, 4
mov dword [edi + 0x10], eax
lea eax, [esp + 0x3c]
push 0x64
push eax
push 0x1003
push esi
call ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [edi + 0x14]
call fcn.005173d5
lea edx, [esp + 0x3c]
push 0x64
push edx
push 0x20
push esi
call ebx
lea eax, [esp + 0x3c]
lea ecx, [edi + 8]
push eax
call fcn.005173d5
lea ecx, [esp + 0x14]
push 7
push ecx
push 0x14
push esi
call ebx
lea edx, [esp + 0x14]
lea ecx, [edi + 0x18]
push edx
call fcn.005173d5
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea ecx, [esp + 0x250]
push 0x104
and eax, 0xffff
push ecx
push eax
call sub.KERNEL32.dll_VerLanguageNameA
cmp eax, 0x104
ja 0x4bfb14
lea edx, [esp + 0x250]
lea ecx, [edi + 0x1c]
push edx
call fcn.005173d5
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x4bfb4f
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x1c]
push ecx
push 0x6dde40
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [edi + 0x20]
push eax
call fcn.005173d5
pop edi
pop esi
pop ebx
add esp, 0x348
ret
Function at 0x4c5380
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push 0x800
call fcn.00505042
mov esi, dword [esp + 0x18]
add esp, 4
mov edx, eax
xor ebp, ebp
test esi, esi
mov dword [esp + 0xc], edx
jne 0x4c53a8
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 0x800
jbe 0x4c53c3
pop esi
pop ebp
pop ebx
pop ecx
ret
mov al, byte [esi]
inc esi
test al, al
je 0x4c5499
cmp ebp, 0x400
je 0x4c5484
cmp al, 0x25
jne 0x4c5463
mov al, byte [esi]
inc esi
test al, al
je 0x4c547c
mov cl, byte [esi]
inc esi
test cl, cl
mov byte [esp + 0x14], cl
je 0x4c547c
movsx eax, al
push eax
call fcn.00504a46
movsx ecx, byte [esp + 0x18]
push ecx
mov bl, al
call fcn.00504a46
movsx edx, bl
push edx
mov byte [esp + 0x20], al
call fcn.00506405
add esp, 0xc
test eax, eax
je 0x4c5492
movsx eax, byte [esp + 0x14]
push eax
call fcn.00506405
add esp, 4
test eax, eax
je 0x4c5492
cmp bl, 0x39
jg 0x4c5442
add bl, 0xd0
jmp 0x4c5445
add bl, 0xa9
mov al, byte [esp + 0x14]
cmp al, 0x39
jg 0x4c5451
add al, 0xd0
jmp 0x4c5453
add al, 0xa9
mov ecx, dword [esp + 0xc]
shl bl, 4
add bl, al
mov edx, ecx
mov byte [ecx + ebp], bl
jmp 0x4c5470
cmp al, 0x2b
jne 0x4c546d
mov byte [edx + ebp], 0x20
jmp 0x4c5470
mov byte [edx + ebp], al
mov al, byte [esi]
inc ebp
inc esi
test al, al
jne 0x4c53ce
cmp ebp, 0x400
jne 0x4c5499
pop esi
pop ebp
mov byte [edx + 0x3ff], 0
mov eax, edx
pop ebx
pop ecx
ret
push 0
call fcn.00506763
mov byte [edx + ebp], 0
pop esi
pop ebp
mov eax, edx
pop ebx
pop ecx
ret

Function at 0x4c9070
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 0
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
pop ecx
ret

Function at 0x4c90a0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
pop ecx
ret

Function at 0x4c90d0
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4c90f0
or eax, 0xffffffff
add esp, 0x190
ret
push 6
push 1
push 2
call sub.WS2_32.dll_socket
add esp, 0x190
ret
Function at 0x4c9120
Capabilities:
Connect socket
Get socket status

Disassembly:
sub esp, 0x228
push esi
mov esi, dword [esp + 0x234]
test esi, esi
je 0x4c930e
mov ecx, dword [esp + 0x23c]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
push ebx
shr eax, 0x1f
add edx, eax
push edi
test edx, edx
mov edi, 1
mov dword [esp + 0xc], edx
jg 0x4c9161
mov dword [esp + 0xc], edi
xor ecx, ecx
push esi
mov dword [esp + 0x18], ecx
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x240]
mov dword [esp + 0x18], eax
push edx
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x238]
mov word [esp + 0x16], ax
push esi
call fcn.004c90a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 0x14]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
jge 0x4c92f7
call fcn.004c8d10
push eax
call fcn.004c9320
add esp, 4
cmp eax, 0xffffd8cd
je 0x4c91f4
cmp eax, 0xffffd8cc
je 0x4c91f4
push esi
mov edi, eax
call fcn.004c9070
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], 0
test eax, eax
jle 0x4c92a9
lea ebx, [esi + 1]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push 0
lea eax, [esp + 0x138]
push edx
push eax
push ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x148], esi
mov dword [esp + 0x144], edi
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0x2710
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x4c92dd
lea ecx, [esp + 0x2c]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4c92f7
lea edx, [esp + 0x130]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4c92f7
mov ecx, dword [esp + 0x248]
mov eax, dword [esp + 0x24c]
cmp dword [ecx], eax
je 0x4c92c3
call fcn.004c8d10
test eax, eax
jne 0x4c92dd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x4c920b
push esi
mov edi, 0xfffffff5
call fcn.004c9070
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
push esi
mov edi, 0xffffffec
call fcn.004c9070
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
push esi
mov edi, 0xfffffffb
call fcn.004c9070
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
push esi
xor edi, edi
call fcn.004c9070
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
xor eax, eax
pop esi
add esp, 0x228
ret