joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497ef0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4dac78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5181f4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00496db0
test al, al
jne 0x4980a6
mov eax, dword [esi]
mov edi, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea ecx, [edi + 8]
push ecx
call ebx
mov edx, dword [edi]
test edx, edx
je 0x4980ea
mov eax, dword [edi]
mov eax, dword [eax]
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call ebp
mov ecx, dword [esi]
mov edi, dword [ecx]
push 0
lea edx, [edi + 0xc]
push edx
call ebx
mov eax, dword [edi]
test eax, eax
je 0x4980d3
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax]
push eax
call ebp
mov edx, dword [esi]
mov edi, dword [edx]
push 0
lea eax, [edi + 0x14]
push eax
call ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x4980bc
mov edx, dword [edi]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call ebp
push 4
call fcn.00441e44
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
je 0x497fb9
mov eax, dword [esi]
mov dword [edi], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x497fbb
mov eax, dword [edi]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x497fbb
xor edi, edi
lea edx, [esi + 8]
push edx
push ebx
push edi
push 0x497e30
push ebx
push ebx
call fcn.00443185
mov dword [esp + 0x30], eax
add esp, 0x18
lea eax, [esp + 0x18]
lea edi, [esi + 4]
push eax
mov ecx, edi
call fcn.00497430
push 0x4e20
push 1
mov ecx, esi
call fcn.00497040
test al, al
jne 0x498090
mov ecx, dword [edi]
test ecx, ecx
je 0x49807a
mov edx, dword [edi]
mov eax, dword [edx]
cmp dword [eax], ebx
setne al
test al, al
je 0x49807a
push 0x20
call fcn.00441e44
add esp, 4
cmp eax, ebx
je 0x498028
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
mov ecx, eax
call fcn.004979e0
jmp 0x49802a
xor eax, eax
push eax
lea ecx, [esp + 0x18]
call fcn.00477050
push ecx
mov eax, esp
mov dword [eax], ebx
mov edx, dword [esi]
mov eax, dword [edx]
lea ecx, [eax + 0x1c]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], esp
call fcn.00496c20
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00497ae0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
mov dword [esp + 0x20], ebx
call fcn.00497430
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.00497a60
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov edx, dword [esi + 0xc]
push edx
mov ecx, esi
call fcn.00497140
mov eax, dword [esi + 0x10]
push eax
mov ecx, esi
call fcn.00497190
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push 0x50e8bc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], str.uninitialized_holder_used
call fcn.0044661f
push 0x50e8bc
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], str.uninitialized_holder_used
call fcn.0044661f
push 0x50e8bc
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], str.uninitialized_holder_used
call fcn.0044661f
int3
Function at 0x498750
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x4dad78
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5181f4]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5181f4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
xor ebx, ebx
cmp edi, ebx
je 0x4987c5
push 0x34
push ebx
push edi
call fcn.004424d0
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00498620
add esp, 0x14
cmp dword [esp + 0x4c], ebx
mov dword [esp + 0x60], ebx
jne 0x4987cc
cmp dword [esp + 0x50], 8
jb 0x4987c5
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00441cca
add esp, 4
xor eax, eax
jmp 0x4988ab
mov eax, dword [esp + 0x3c]
mov ebp, 8
cmp dword [esp + 0x50], ebp
mov dword [esp + 0x20], ebx
jae 0x4987e3
lea eax, [esp + 0x3c]
lea edx, [esp + 0x20]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x49880e
cmp dword [esp + 0x50], ebp
jb 0x4987c5
mov eax, dword [esp + 0x3c]
push eax
call fcn.00441cca
add esp, 4
xor eax, eax
jmp 0x4988ab
lea ecx, [esp + 0x17]
push ecx
push esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1f], bl
call fcn.004144c6
mov ebp, dword [esp + 0x28]
cmp ebp, ebx
je 0x498831
mov edx, dword [esp + 0x2c]
sub edx, ebp
jne 0x498836
call fcn.00441e1b
cmp dword [esp + 0x50], 8
mov eax, dword [esp + 0x3c]
jae 0x498845
lea eax, [esp + 0x3c]
push ebp
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x498868
lea ecx, [esp + 0x24]
call fcn.00404bce
lea ecx, [esp + 0x38]
call fcn.00404364
xor eax, eax
jmp 0x4988ab
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x4fa6bc
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x498852
mov esi, dword [esp + 0x18]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
call fcn.00404bce
lea ecx, [esp + 0x38]
call fcn.00404364
mov eax, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00441cbb
add esp, 0x50
ret
Function at 0x499fd0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push ecx
push esi
call fcn.00499b30
lea edi, [eax*4]
add esp, 0xc
xor ebx, ebx
test edi, edi
mov dword [esp + 0xc], eax
jle 0x49a045
lea edx, [esi + edi*4 + 8]
lea ecx, [esi + 8]
push ebp
mov eax, dword [edx - 8]
mov ebp, dword [ecx - 8]
mov dword [ecx - 8], eax
mov dword [edx - 8], ebp
mov ebp, dword [edx - 4]
mov eax, dword [ecx - 4]
mov dword [ecx - 4], ebp
mov ebp, dword [edx]
mov dword [edx - 4], eax
mov eax, dword [ecx]
mov dword [ecx], ebp
mov ebp, dword [edx + 4]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 4], ebp
mov dword [edx + 4], eax
add ebx, 4
sub edi, 4
add ecx, 0x10
sub edx, 0x10
cmp ebx, edi
jl 0x49a004
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, 1
jle 0x49a200
lea edx, [eax - 1]
mov ecx, dword [esi + 0x10]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + str.ccccwwww]
add esi, 0x10
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4ed1d0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed9d0]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed5d0]
movzx ebx, byte [esi + 5]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x4eddd0]
mov ecx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4ed1d0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed9d0]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed5d0]
movzx ebx, byte [esi + 9]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x4eddd0]
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4ed1d0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed9d0]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed5d0]
movzx ebx, byte [esi + 0xd]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x4eddd0]
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4ed1d0]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed9d0]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4ed5d0]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x4eddd0]
sub edx, 1
mov dword [esi + 0xc], edi
jne 0x49a051
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x49ad10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
xor ecx, ecx
test edx, edx
not eax
jbe 0x49ad44
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
movzx edi, byte [ecx + esi]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x51a718]
add ecx, 1
cmp ecx, edx
jb 0x49ad27
pop edi
pop esi
pop ebx
not eax
ret

Function at 0x49b830
Capabilities:
Hash data with md5

Disassembly:
cmp ecx, 5
mov dword [eax], ecx
je 0x49b83d
mov eax, 0x402
ret
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
xor eax, eax
ret
Function at 0x49e2a0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 4]
xor ebp, ebp
cmp eax, ebp
push esi
push edi
mov dword [esp + 0x14], ebx
jne 0x49e2ba
xor esi, esi
jmp 0x49e2d0
mov ecx, dword [ebx + 8]
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edi, dword [esp + 0x34]
mov eax, dword [edi + 4]
cmp eax, ebp
jne 0x49e2df
xor eax, eax
jmp 0x49e2f5
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
je 0x49e305
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 4
push edi
lea ecx, [esp + 0x24]
call fcn.00409432
mov ecx, ebx
mov dword [esp + 0x34], ebp
call fcn.0049dc70
test eax, eax
mov ebx, dword [esp + 0x24]
jbe 0x49e43c
mov dword [esp + 0x10], ebp
lea ebx, [ebx]
xor edi, edi
lea ebp, [ebx + 0x24]
test ebx, ebx
je 0x49e41b
mov ecx, dword [esp + 0x28]
sub ecx, ebx
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x49e41b
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
test eax, eax
je 0x49e383
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x34], eax
jb 0x49e388
call fcn.00441e1b
mov esi, dword [esi + 4]
add esi, dword [esp + 0x10]
mov al, byte [esi]
cmp al, byte [ebp - 0x24]
jne 0x49e3c0
lea ecx, [ebp - 0x20]
push ecx
lea edx, [esi + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x49e3c0
mov eax, dword [esi + 0x24]
cmp eax, dword [ebp]
jne 0x49e3c0
lea ecx, [ebp + 4]
push ecx
lea ecx, [esi + 0x28]
call fcn.0049dab0
test al, al
jne 0x49e3cb
add edi, 1
add ebp, 0x48
jmp 0x49e335
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
jbe 0x49e3d8
call fcn.00441e1b
lea edx, [edi + edi*8]
lea esi, [ebx + edx*8]
cmp esi, ebp
ja 0x49e3e6
cmp esi, ebx
jae 0x49e3eb
call fcn.00441e1b
mov edx, dword [esp + 0x34]
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x18]
push eax
mov byte [esp + 0x20], 0
mov ecx, dword [esp + 0x20]
push ecx
push edx
push esi
push ebp
add esi, 0x48
push esi
call fcn.00409c70
mov ebx, dword [esp + 0x3c]
add esp, 0x18
sub dword [esp + 0x28], 0x48
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
add dword [esp + 0x10], 0x48
add esi, 1
mov dword [esp + 0x34], esi
call fcn.0049dc70
cmp esi, eax
jb 0x49e330
test ebx, ebx
jne 0x49e444
xor eax, eax
jmp 0x49e45d
mov eax, dword [esp + 0x28]
sub eax, ebx
mov ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
sete byte [esp + 0x34]
test ebx, ebx
je 0x49e471
push ebx
call fcn.00441cca
add esp, 4
mov al, byte [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x49f2d0
Capabilities:
Check if file exists

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
push 0x52213c
mov dword [esp + 0xc], esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x52216c], esi
je 0x49f371
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004a1330
add esp, 8
test eax, eax
jne 0x49f312
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x49f371
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.004a1330
add esp, 8
test eax, eax
jne 0x49f332
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x49f371
mov ecx, dword [esp + 8]
mov edx, dword [0x522170]
mov eax, dword [0x52216c]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
push edi
call fcn.0048d960
add esp, 0x1c
test eax, eax
jne 0x49f371
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jne 0x49f371
cmp dword [esp + 0x20], 0
jne 0x49f371
lea esi, [eax + 0xb]
push 0x52213c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 8]
test eax, eax
je 0x49f39c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret 0x14

Function at 0x49f8e0
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
xor esi, esi
push ecx
mov dword [esp + 0x10], esi
mov dword [edi], esi
call fcn.004a1330
add esp, 8
test eax, eax
jne 0x49f90f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x49f96b
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.004a1330
add esp, 8
test eax, eax
jne 0x49f92f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x49f96b
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
push edi
call fcn.0048d960
add esp, 0x1c
test eax, eax
jne 0x49f96b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jne 0x49f96b
cmp dword [esp + 0x28], 0
jne 0x49f96b
lea esi, [eax + 0xb]
mov eax, dword [esp + 8]
test eax, eax
je 0x49f98b
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret 0x1c
Function at 0x4a3a50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4db091
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5181f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esi + 4]
mov dword [esi], vtable.ADS::DirectorySearcherBase.0
call fcn.004a1550
mov edx, dword [esp + 0x30]
xor edi, edi
push 0xffffffffffffffff
lea ecx, [esi + 0xc]
push edi
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push edx
mov dword [esp + 0x30], edi
mov word [ecx + 4], di
call fcn.00404c75
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esi + 0x28]
mov byte [esp + 0x28], 1
call fcn.0043eb10
mov eax, dword [esp + 0x38]
cmp eax, 2
mov byte [esp + 0x24], 2
ja 0x4a3aeb
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0x10
push 0x50b128
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], vtable.ADS::ADSException.0
mov dword [esp + 0x20], 0x80005008
call fcn.0044661f
int3

Function at 0x4a4870
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x4a4914
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x4a48e5
cmp word [ecx + 0xa], 4
jne 0x4a48e5
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4a48e5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.004a4800
test eax, eax
mov dword [esi], eax
je 0x4a4908
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x4a48c0
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.00453470
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4a4924.11001
jmp dword [eax*4 + 0x4a4948]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18
Function at 0x4a5180
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x5181f4]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x522228], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x4a4bd0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x4a4ec0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.004a4b80
je 0x4a51f2
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x51acf8]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00441cbb
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4a52ef
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.004468bc
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.004533ff
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4a526d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4a52b4
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.004468bc
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.004533ff
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x4a52eb
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x4a531f
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x4a531f
add edi, 1
cmp edi, 3
jl 0x4a52b6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x51acf8], edx
mov dword [0x51ad00], eax
mov dword [fcn.004a4b80], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x51acf8]
xor ecx, esp
mov dword [0x522228], 1
call fcn.00441cbb
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x4a52eb
Function at 0x4a53f0
Capabilities:
Check for time delay via gettickcount
Connect socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db200
mov eax, dword fs:[0]
push eax
sub esp, 0x138
push ebx
push esi
push edi
mov eax, dword [0x5181f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x10624dd3
mul ecx
mov edi, dword [ebp + 8]
movzx eax, word [edi]
shr edx, 6
mov dword [ebp - 0x24], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
xor esi, esi
cmp ax, 2
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp + 0xc], 1
mov dword [ebp - 4], esi
je 0x4a5486
cmp ax, 0x17
je 0x4a5486
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
movzx eax, ax
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 8], ebx
je 0x4a5472
lea ecx, [ebp + 0xc]
push ecx
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4a54b6
mov dword [ebp + 0xc], esi
push 0x1c
push edi
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4a54ee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp dword [ebp + 0xc], esi
je 0x4a54d7
cmp eax, 0x2733
je 0x4a54ee
push eax
lea ecx, [ebp - 0x3c]
call fcn.0048a7e0
push 0x50e7a0
lea edx, [ebp - 0x3c]
push edx
call fcn.0044661f
xor ecx, ecx
mov dword [ebp - 0x140], ecx
xor eax, eax
cmp eax, ecx
jae 0x4a550c
cmp dword [ebp + eax*4 - 0x13c], ebx
je 0x4a550a
add eax, 1
jmp 0x4a54f8
cmp eax, ecx
jne 0x4a5521
cmp ecx, 0x40
jae 0x4a5521
mov dword [ebp + eax*4 - 0x13c], ebx
add dword [ebp - 0x140], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push esi
lea ecx, [ebp - 0x140]
push ecx
push esi
push esi
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
call edi
cmp esi, 0xffffffff
mov edi, eax
mov dword [ebp - 0x18], edi
jne 0x4a5579
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.0048a7e0
push 0x50e7a0
lea edx, [ebp - 0x30]
push edx
call fcn.0044661f
mov eax, 0x4a5571
ret
cmp esi, 1
jne 0x4a5582
mov byte [ebp - 0x11], 1
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp byte [ebp - 0x11], 0
je 0x4a55a6
sub edi, dword [ebp - 0x1c]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aa8a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x4aa8c6
push 0x57
lea ecx, [esp + 0x10]
call fcn.0048a7e0
push 0x50e7a0
lea eax, [esp + 0x10]
push eax
call fcn.0044661f
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.004a9f10
mov dword [esi + 0x20], 0
mov byte [esi + 0x94], 1
cmp dword [esi + 0x1c], 8
jb 0x4aa8f4
mov eax, dword [esi + 8]
jmp 0x4aa8f7
lea eax, [esi + 8]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push eax
call fcn.0048dad0
add esp, 0xc
test eax, eax
jne 0x4aa93e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4aa937
cmp eax, 3
je 0x4aa937
push eax
lea ecx, [esp + 0x10]
call fcn.0048a7e0
push 0x50e7a0
lea eax, [esp + 0x10]
push eax
call fcn.0044661f
xor al, al
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x4aa960
push 8
lea ecx, [esp + 0x10]
call fcn.0048a7e0
push 0x50e7a0
lea ecx, [esp + 0x10]
push ecx
call fcn.0044661f
mov edx, dword [esp + 8]
push edx
push eax
mov ecx, esi
call fcn.004aa3d0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push 0
push ecx
call fcn.004424d0
mov edx, dword [esp + 0x10]
add esp, 0xc
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
pop esi
add esp, 0x14
ret