joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d15c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4d15ec
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4d15dd
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x4d1620
cmp dword [esi + 8], 0
jne 0x4d1610
push 0x567118
push dword [eax + 8]
call fcn.004fd480
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4d1610
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004fdad0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4d1642
mov eax, dword [esi + 8]
test eax, eax
je 0x4d163c
push eax
call fcn.004fe020
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4d2e40
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4d2e72
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x4d2ff0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4d3023
push 0x2e
push edi
call fcn.00507e20
add esp, 8
test eax, eax
je 0x4d3021
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4d3ec0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4d3eed
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4d3f34
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4d3f3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4d3f9a
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
push 1
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
push 1
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
lea ebx, [ebx + 1]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x4d3f60
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4d3fc7
nop
mov eax, dword [esi + 4]
push 1
push str.6digit
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x54d317
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4d3fa0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ee360
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4ee399
push esi
push str.fcntl__d__F_GETFL_
push esi
call fcn.004f8400
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4ee480
Capabilities:
Connect socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
cmp dword [esi], edi
jge 0x4ee4b6
movzx eax, word [ebx]
push edi
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
test eax, eax
jl 0x4ee513
push eax
mov edi, 1
call fcn.004ee360
add esp, 4
test eax, eax
jl 0x4ee504
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
push ecx
push ebx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x4ee520
mov eax, dword [esi]
push eax
call fcn.004ee420
add esp, 4
cmp eax, 0x2733
je 0x4ee51a
cmp eax, 0x2714
je 0x4ee51a
cmp eax, 0x2734
je 0x4ee51a
cmp eax, 0x2726
je 0x4ee51a
cmp eax, 0x274d
jne 0x4ee500
pop edi
pop esi
mov eax, 2
pop ebx
ret
test edi, edi
je 0x4ee513
mov ecx, dword [esi]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4f4f80
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x4c
push esi
push edi
mov edi, dword [esp + 0x58]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4f4f9b
push eax
push 0
call fcn.004f2250
add esp, 8
test byte [edi + 0x1c], 4
je 0x4f4fa9
or esi, 0xffffffff
jmp 0x4f50ec
push ebx
mov ebx, dword [esp + 0x60]
lea eax, [esp + 0xc]
push eax
push 0x4004667f
push ebx
mov dword [esp + 0x18], 0x1000
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jl 0x4f4fda
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x4f4fda
cmp eax, 0x1000
jle 0x4f4fdf
mov eax, 0x1000
mov esi, dword [esp + 0x64]
test esi, esi
jl 0x4f4feb
cmp esi, eax
jle 0x4f4fed
mov esi, eax
push 4
push esi
push edi
call fcn.004f4950
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4f5005
or esi, eax
jmp 0x4f50eb
push 1
lea ecx, [esp + 0x18]
push ecx
push 2
lea edx, [esp + 0x24]
push edx
push esi
push edi
call fcn.004f4e30
mov esi, eax
add esp, 0x18
xor eax, eax
test esi, esi
jle 0x4f5045
jmp 0x4f5030
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x3c], ecx
mov dword [esp + eax*8 + 0x38], edx
inc eax
cmp eax, esi
jl 0x4f5030
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
lea edx, [esp + 0x4c]
push edx
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x4f507e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x4f508f
or esi, 0xffffffff
jmp 0x4f50eb
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
jne 0x4f508b
or esi, ebx
jmp 0x4f50eb
test ebx, ebx
jne 0x4f5093
xor esi, esi
jmp 0x4f50eb
xor edi, edi
push ebp
mov ebp, ebx
test esi, esi
jle 0x4f50d1
mov edx, dword [esp + 0x18]
mov ecx, dword [edx]
test byte [ecx + 0x10], 8
je 0x4f50ac
xor eax, eax
jmp 0x4f50c1
mov eax, dword [ecx + 4]
sub eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp eax, 0x7fffffff
jbe 0x4f50c1
mov eax, bind
cmp eax, ebp
jge 0x4f5106
add dword [ecx + 0xc], eax
mov edx, dword [edx]
inc edi
sub ebp, eax
cmp edi, esi
jl 0x4f50a0
mov eax, dword [esp + 0x60]
add dword [eax + 0xc], ebx
add dword [eax + 0x10], ebx
push eax
call fcn.004f2cb0
mov edi, dword [esp + 0x64]
add esp, 4
mov esi, ebx
pop ebp
pop ebx
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4f50fe
push eax
push 0
call fcn.004f2260
add esp, 8
pop edi
mov eax, esi
pop esi
add esp, 0x4c
ret
mov eax, ecx
add dword [eax + 0xc], ebp
mov eax, dword [esp + 0x60]
mov dword [eax + 8], edx
jmp 0x4f50d5
Function at 0x4f5120
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x84
push ebx
push ebp
mov ebp, dword [esp + 0x90]
push esi
mov esi, dword [ebp]
push edi
mov ebx, eax
xor edi, edi
test ebx, ebx
jge 0x4f514a
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret
cmp dword [ebp + 0x18], edi
je 0x4f51bd
call fcn.004f22b0
test eax, eax
je 0x4f51bd
mov eax, dword [ebp + 0x18]
push eax
call fcn.004f1f40
add esp, 4
test eax, eax
jne 0x4f51bd
push 0x5810ac
push 0x5810c4
push 0x8e9
push 0x5810f4
push 0x581100
push 0xdeaddead
call fcn.004f8430
add esp, 0x18
push str.evbuffer_write_iovec
push str._evthread_is_debug_lock_held__buffer___lock_
push 0x8e9
push 0x58116c
push 0x581178
call fcn.00503f40
add eax, 0x40
push eax
call fcn.004fdc40
add esp, 0x18
call fcn.0050be00
test esi, esi
je 0x4f51f5
cmp edi, 0x10
jge 0x4f51f1
test ebx, ebx
je 0x4f51f1
mov ecx, dword [esi + 0x14]
add ecx, dword [esi + 8]
mov dword [esp + edi*8 + 0x18], ecx
cmp ebx, dword [esi + 0xc]
jb 0x4f51ec
mov edx, dword [esi + 0xc]
mov dword [esp + edi*8 + 0x14], edx
sub ebx, dword [esi + 0xc]
mov esi, dword [esi]
inc edi
test esi, esi
jne 0x4f51c1
jmp 0x4f51f1
mov dword [esp + edi*8 + 0x14], ebx
inc edi
test edi, edi
jne 0x4f5202
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84
ret
mov edx, dword [esp + 0x9c]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x4f513c
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret

Function at 0x4f8310
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00502d90
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
push edx
call fcn.00507c10
add esp, 4
push 3
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.004f8270
mov eax, dword [0x586e68]
add esp, 8
test eax, eax
je 0x4f834f
mov esi, dword [esp + 8]
push esi
call eax
add esp, 4
push esi
call fcn.005072a0
mov eax, dword [esp + 8]
cmp eax, 0xdeaddead
jne 0x4f8360
pop esi
jmp fcn.0050be00
push eax
call fcn.005072a0
int3

Function at 0x4f83a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
push eax
call fcn.004ee420
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
push eax
call fcn.004eea80
add esp, 4
push 3
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.004f8270
mov eax, dword [0x586e68]
add esp, 8
test eax, eax
je 0x4f83e5
mov esi, dword [esp + 8]
push esi
call eax
add esp, 4
push esi
call fcn.005072a0
mov eax, dword [esp + 8]
cmp eax, 0xdeaddead
jne 0x4f83f6
pop esi
jmp fcn.0050be00
push eax
call fcn.005072a0
int3

Function at 0x4f8430
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
push eax
push 3
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.004f8270
mov eax, dword [0x586e68]
add esp, 8
test eax, eax
je 0x4f845f
mov esi, dword [esp + 8]
push esi
call eax
add esp, 4
push esi
call fcn.005072a0
mov eax, dword [esp + 8]
cmp eax, 0xdeaddead
jne 0x4f8470
pop esi
jmp fcn.0050be00
push eax
call fcn.005072a0
int3
Function at 0x4f8e00
Capabilities:
Create tcp socket

Disassembly:
sub esp, 0x3c
mov eax, dword [0x583f80]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, 0xddf3
mov word [esp + 0x24], si
xor ebx, ebx
mov esi, 0x4660
mov word [esp + 0x26], si
mov eax, 0xcbac
mov ecx, 0x11cf
push ebx
mov esi, 0xcbac
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
mov dl, 0x48
mov cl, 0xa1
mov al, 0x92
mov word [esp + 0x38], si
push 1
mov esi, 0x11cf
push 2
mov dword [esp + 0x1c], 0xb5367df1
mov byte [esp + 0x24], 0x95
mov byte [esp + 0x25], 0xca
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x80
mov byte [esp + 0x28], 0x5f
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], al
mov dword [esp + 0x2c], 0x25a207b9
mov byte [esp + 0x34], 0x8e
mov byte [esp + 0x35], 0xe9
mov byte [esp + 0x36], 0x76
mov byte [esp + 0x37], 0xe5
mov byte [esp + 0x38], 0x8c
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 6
mov byte [esp + 0x3b], 0x3e
mov dword [esp + 0x3c], 0xb5367df2
mov word [esp + 0x42], si
mov byte [esp + 0x44], 0x95
mov byte [esp + 0x45], 0xca
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], 0x80
mov byte [esp + 0x48], 0x5f
mov byte [esp + 0x49], dl
mov byte [esp + 0x4a], cl
mov byte [esp + 0x4b], al
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f8f8e
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_WSAIoctl]
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push 0x10
lea ecx, [esp + 0x2c]
push ecx
push 0xc8000006
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
mov edx, dword [esp + 0xc]
push ebx
push ebx
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0x10
mov dword [edi], edx
lea edx, [esp + 0x3c]
push edx
push 0xc8000006
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
mov eax, dword [esp + 0xc]
push ebx
push ebx
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push 0x10
mov dword [edi + 4], eax
lea eax, [esp + 0x4c]
push eax
push 0xc8000006
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
mov ecx, dword [esp + 0xc]
push esi
mov dword [edi + 8], ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x586e84], 1
pop ebp
mov ecx, dword [esp + 0x40]
pop esi
pop ebx
xor ecx, esp
call fcn.004fcf30
add esp, 0x3c
ret
Function at 0x4f8fb0
Capabilities:
Create thread

Disassembly:
cmp dword [0x586e84], 0
push esi
push edi
jne 0x4f8fc5
mov edi, 0x586e78
call fcn.004f8e00
push 0x30
push 1
call fcn.004ea4a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4f8fda
pop edi
pop esi
ret
mov edi, dword [esp + 0xc]
test edi, edi
jg 0x4f8fe7
mov edi, 2
lea eax, [edi + edi]
mov word [esi + 0x1c], ax
push ebp
cwde
push 4
push eax
call fcn.004ea4a0
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x4f907e
push edi
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi], eax
mov dword [esi + 0x20], 0xffffffff
test eax, eax
je 0x4f9087
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x4f907e
xor ecx, ecx
xor edi, edi
cmp cx, word [esi + 0x1c]
jge 0x4f9069
push esi
push 0
push 0x4f8c70
call fcn.0050dec0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f907e
mov edx, dword [esi + 0x24]
mov dword [edx + edi*4], eax
inc word [esi + 0x28]
movsx eax, word [esi + 0x1c]
inc edi
cmp edi, eax
jl 0x4f9041
push 0x3e8
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
pop ebp
pop edi
mov eax, esi
pop esi
ret
mov eax, dword [esi]
test eax, eax
je 0x4f9087
push eax
call ebp
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4f9097
push eax
call fcn.004ea540
add esp, 4
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4f90a1
push eax
call ebp
push esi
call fcn.004ea540
add esp, 4
pop ebp
pop edi
xor eax, eax
pop esi
ret
Function at 0x4fc940
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
cmp esi, ebp
je 0x4fc95a
test byte [esi + 0x1c], 0x10
je 0x4fc95a
mov ebx, esi
jmp 0x4fc95c
xor ebx, ebx
or eax, 0xffffffff
mov dword [esp + 0xc], eax
cmp esi, ebp
je 0x4fcae9
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x4fc97c
push eax
push ebp
call fcn.004f2250
add esp, 8
test byte [ebx + 0x50], 1
je 0x4fc9d7
push 0x583884
push 0x58389c
push 0xb9
push 0x5838b8
push 0x5838c8
push 0xdeaddead
call fcn.004f8430
add esp, 0x18
push str.evbuffer_launch_write
push str._buf_o__read_in_progress
push 0xb9
push 0x583920
push 0x583930
call fcn.00503f40
add eax, 0x40
push eax
call fcn.004fdc40
add esp, 0x18
call fcn.0050be00
test byte [esi + 0x1c], 2
jne 0x4fcad3
test byte [ebx + 0x50], 2
jne 0x4fcad3
mov eax, dword [esi + 0xc]
cmp eax, ebp
jne 0x4fc9fb
mov dword [esp + 0xc], ebp
jmp 0x4fcad3
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jl 0x4fca07
cmp ecx, eax
jbe 0x4fca0b
mov dword [esp + 0x1c], eax
push edi
push 1
push esi
call fcn.004f5b40
push 0x80
lea edi, [ebx + 0x5c]
push ebp
push edi
mov dword [ebx + 0x54], ebp
mov dword [ebx + 0x58], ebp
call fcn.00507b80
mov esi, dword [esi]
add esp, 0x14
mov dword [ebx + 0x54], esi
test esi, esi
je 0x4fca6d
mov eax, dword [esi + 0x14]
add eax, dword [esi + 8]
push 0x20
push esi
mov dword [edi + 4], eax
call fcn.004f28c0
mov eax, dword [esp + 0x28]
add esp, 8
inc ebp
cmp eax, dword [esi + 0xc]
jbe 0x4fca6b
mov ecx, dword [esi + 0xc]
mov dword [edi], ecx
sub eax, dword [esi + 0xc]
mov esi, dword [esi]
add edi, 8
cmp ebp, 0x10
mov dword [esp + 0x20], eax
jl 0x4fca31
jmp 0x4fca6d
mov dword [edi], eax
mov esi, dword [esp + 0x1c]
push esi
mov dword [ebx + 0x58], ebp
call fcn.004f2a90
mov edx, dword [esp + 0x28]
mov ecx, dword [ebx + 0x4c]
add esp, 4
push 0
push edx
push 0
lea eax, [esp + 0x20]
push eax
push ebp
lea eax, [ebx + 0x5c]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
pop edi
test eax, eax
je 0x4fcac7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4fcac7
push 0x20
push ebx
call fcn.004fc5e0
push 1
push esi
call fcn.004f5b80
push esi
call fcn.004f2f40
add esp, 0x14
jmp 0x4fcad3
or dword [ebx + 0x50], 2
mov dword [esp + 0xc], 0
mov esi, dword [esi + 0x18]
test esi, esi
je 0x4fcae5
push esi
push 0
call fcn.004f2260
add esp, 8
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4fcaf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x94
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
xor ebp, ebp
push edi
cmp ebx, ebp
je 0x4fcb10
test byte [ebx + 0x1c], 0x10
je 0x4fcb10
mov edi, ebx
jmp 0x4fcb12
xor edi, edi
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebp
cmp edi, ebp
je 0x4fcd1b
mov eax, dword [ebx + 0x18]
cmp eax, ebp
je 0x4fcb36
push eax
push ebp
call fcn.004f2250
add esp, 8
test byte [edi + 0x50], 2
je 0x4fcb91
push 0x583954
push 0x58396c
push 0x103
push 0x583988
push 0x583998
push 0xdeaddead
call fcn.004f8430
add esp, 0x18
push 0x5839bc
push str._buf_o__write_in_progress
push 0x103
push 0x5839f0
push 0x583a00
call fcn.00503f40
add eax, 0x40
push eax
call fcn.004fdc40
add esp, 0x18
call fcn.0050be00
test byte [ebx + 0x1c], 4
jne 0x4fcd05
test byte [edi + 0x50], 1
jne 0x4fcd05
push esi
push 0x80
lea esi, [edi + 0x5c]
push ebp
push esi
mov dword [edi + 0x54], ebp
mov dword [edi + 0x58], ebp
call fcn.00507b80
mov ebp, dword [esp + 0xb8]
push 0x10
push ebp
push ebx
call fcn.004f4950
add esp, 0x18
cmp eax, 0xffffffff
je 0x4fcd04
push 0
push ebx
call fcn.004f5b40
push 1
lea eax, [esp + 0x24]
push eax
push 0x10
lea ecx, [esp + 0x38]
push ecx
push ebp
push ebx
call fcn.004f4e30
mov ebp, eax
add esp, 0x20
xor eax, eax
test ebp, ebp
jle 0x4fcc16
mov ecx, esi
mov edx, dword [esp + eax*8 + 0x24]
mov dword [ecx + 4], edx
mov edx, dword [esp + eax*8 + 0x28]
mov dword [ecx], edx
inc eax
add ecx, 8
cmp eax, ebp
jl 0x4fcc01
mov eax, dword [esp + 0x18]
mov dword [edi + 0x58], ebp
mov esi, dword [eax]
mov dword [edi + 0x54], esi
mov dword [esp + 0x10], 0
test esi, esi
je 0x4fcc45
mov edi, edi
push 0x10
push esi
call fcn.004f28c0
mov esi, dword [esi]
inc dword [esp + 0x18]
add esp, 8
test esi, esi
jne 0x4fcc30
cmp dword [esp + 0x10], ebp
je 0x4fcca0
push 0x583a24
push 0x583a3c
push 0x11f
push 0x583a4c
push 0x583a5c
push 0xdeaddead
call fcn.004f8430
add esp, 0x18
push str.evbuffer_launch_read
push str.npin__nvecs
push 0x11f
push str.buffer_iocp.c
push str._s:_d:_Assertion__s_failed_in__s
call fcn.00503f40
add eax, 0x40
push eax
call fcn.004fdc40
add esp, 0x18
call fcn.0050be00
push ebx
call fcn.004f2a90
mov ecx, dword [esp + 0xb4]
add esp, 4
push 0
push ecx
mov ecx, dword [edi + 0x4c]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
push ebp
lea eax, [edi + 0x5c]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x4fccf8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4fccf8
push 0x10
push edi
call fcn.004fc5e0
push 0
push ebx
call fcn.004f5b80
push ebx
call fcn.004f2f40
add esp, 0x14
jmp 0x4fcd04
or dword [edi + 0x50], 1
mov dword [esp + 0x14], 0
pop esi
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4fcd17
push ebx
push 0
call fcn.004f2260
add esp, 8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x52ccd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 4
imul eax, eax, 0x17
mov ecx, dword [eax + 0x589e80]
xor ecx, dword [0x583f80]
mov dword [ebp - 4], ecx
je 0x52cd02
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
jmp 0x52cd21
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0052cc00
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x409c60
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x41947a
call fcn.0040f528
sub esp, 0x114
push ebx
push esi
push edi
push str.CMainFrame::UniChkDel
mov esi, ecx
call fcn.004028a7
pop ecx
lea eax, [ebp - 0x10]
lea edi, [esi + 0x118]
push eax
mov ecx, edi
call fcn.00407fa3
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00407c9a
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00407fe0
push eax
push str.PrinterName
call fcn.00402932
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00407659
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407659
xor eax, eax
inc eax
cmp dword [esi + 0x47c], eax
je 0x409e38
push str.enter_:_OpenPrinterW
mov dword [ebp - 0x1c], ebx
call fcn.004028a7
pop ecx
push ebx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00407f98
push eax
call fcn.0040eea6
push str.exit_:_OpenPrinterW
mov edi, eax
call fcn.004028a7
push edi
push str.result
call fcn.00402a6e
add esp, 0xc
cmp edi, 1
jne 0x409d2f
push dword [ebp - 0x1c]
call fcn.0040eeb2
xor eax, eax
inc eax
jmp 0x409e38
lea edi, [esi + 0x798]
mov eax, dword [edi]
cmp eax, ebx
je 0x409d4a
push eax
push dword [esi + 0x430]
call dword [0x41a238]
mov dword [edi], ebx
push str.Delete_Reg_HKCU_run
call fcn.004028a7
pop ecx
lea edi, [esi + 0x118]
mov ecx, edi
call fcn.00407f85
cmp word [eax], bx
mov ecx, edi
jne 0x409d6c
lea ecx, [esi + 8]
call fcn.00407f85
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.00407f85
push dword [ebp - 0x10]
xor ecx, ecx
cmp word [eax], bx
push str.software
sete cl
mov esi, 0x80000001
push esi
mov dword [ebp - 0x18], ecx
call fcn.00408c4f
mov edi, dword [0x41a014]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
push str.softwareMicrosoftWindowsCurrentVersionRun
push esi
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x409dd0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [0x41a02c]
push dword [ebp - 0x14]
call dword [0x41a00c]
push 0x104
lea eax, [ebp - 0x120]
push ebx
push eax
call fcn.0040eef0
push 0x104
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.004069ac
add esp, 0x1c
cmp dword [ebp - 0x18], ebx
mov eax, str.SoftwareEPSONSTM3STMDataEPNTarget
jne 0x409e0b
mov eax, str.SoftwareEPSONSTM3STMDataEPLTarget
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push ebx
push eax
push esi
call edi
test eax, eax
jne 0x409e36
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x14]
call dword [0x41a028]
push dword [ebp - 0x14]
call dword [0x41a00c]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret