joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c59c0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 8]
push dword [ebp + 0x10]
call fcn.004c9a00
add esp, 4
cmp dword [esp + 8], 0
je 0x4c59f2
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
jmp 0x4c5a2d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea edi, [esp + 0x30]
lea ebx, [esp + 0x20]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], edx
push 1
push edi
push ebx
call fcn.004bd460
add esp, 0xc
cmp dword [esp + 0x20], 0
je 0x4c5a43
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi], 1
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x1c], ecx
mov dword [esp + 4], eax
lea ecx, [esp + 8]
push dword [ebp + 0x18]
call fcn.004c9a00
add esp, 4
cmp dword [esp + 8], 0
je 0x4c5a76
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
jmp 0x4c5aa9
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], edx
push 1
push edi
push ebx
call fcn.004bd460
add esp, 0xc
cmp dword [esp + 0x20], 0
je 0x4c5ad7
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi], 1
test edi, edi
je 0x4c5a39
add edi, edi
push 2
push edi
push dword [esp + 0x24]
call fcn.0040dc90
add esp, 0xc
jmp 0x4c5a39
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0x4c5b90
push ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x4c5b45
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test edi, edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi], 0
je 0x4c5b32
add edi, edi
push 2
push edi
push ebx
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x4c5a39
add eax, eax
push 2
push eax
jmp 0x4c5ac6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi + 7], 0
mov word [esi + 5], 0
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov eax, edi
test edi, edi
mov edi, dword [esp + 4]
mov dword [esi], 1
je 0x4c5ab9
add eax, eax
push 2
push eax
push ebx
call fcn.0040dc90
add esp, 0xc
jmp 0x4c5ab9
Function at 0x4c9170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x24]
mov eax, esp
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push eax
call fcn.004c70b0
add esp, 0xc
cmp dword [esp], 0
je 0x4c91d0
cmp byte [esp + 4], 3
jne 0x4c91f6
mov edi, dword [esp + 8]
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 4]
test eax, eax
je 0x4c91c1
push dword [ecx + 8]
push eax
push dword [edi]
call fcn.0040dc90
add esp, 0xc
push 4
push 0xc
push edi
call fcn.0040dc90
add esp, 0xc
jmp 0x4c91f6
mov edi, dword [esp + 8]
test edi, edi
je 0x4c91f6
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c9207
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], ebp
jmp 0x4c91fd
mov dword [esi + 4], 0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi + 4], 0
je 0x4c91fd
add ebx, ebx
push 2
push ebx
push edi
call fcn.0040dc90
add esp, 0xc
jmp 0x4c91fd
Function at 0x4c9ba0
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x424
mov edi, 0x200
mov dword [esp + 8], 0
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 4], 2
cmp edi, 0x201
jae 0x4c9c00
jmp 0x4c9bee
jbe 0x4c9c80
cmp edi, 0x201
jae 0x4c9c00
lea esi, [esp + 0x24]
mov ebx, 0x200
mov ebp, edi
jmp 0x4c9c14
mov ebp, dword [esp]
sub edi, ebp
jne 0x4c9c63
mov esi, dword [esp + 4]
mov ebx, ebp
mov dword [esp + 0x10], ebp
mov dword [esp], ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test eax, eax
jne 0x4c9c38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4c9d24
cmp edi, ebp
jne 0x4c9be0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4c9d4b
lea edi, [ebp + ebp]
test ebp, ebp
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x4c9bee
jmp 0x4c9c00
push edi
push ebp
lea eax, [esp + 0x10]
push eax
call fcn.00505980
add esp, 0xc
mov ebp, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
jmp 0x4c9c07
cmp edi, ebx
ja 0x4c9d4b
mov eax, dword [esp + 0x43c]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
lea eax, [esp + 0x14]
push edi
push esi
mov esi, eax
push eax
call fcn.004c00c0
add esp, 0xc
push dword [ebx + 4]
push dword [ebx]
push esi
call fcn.004c3380
add esp, 0xc
cmp byte [ebp], 0
jne 0x4c9cc9
push 3
push 0x564414
push esi
call fcn.004c3d30
add esp, 0xc
mov esi, dword [esp + 0x438]
lea eax, [esi + 4]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call fcn.004c9170
add esp, 0xc
mov eax, dword [esp + 0x14]
mov edi, dword [esp]
test eax, eax
je 0x4c9cfe
push 1
push eax
push dword [esp + 0x20]
call fcn.0040dc90
add esp, 0xc
xor eax, eax
test edi, edi
mov dword [esi], eax
je 0x4c9d17
add edi, edi
push 2
push edi
push dword [esp + 0xc]
call fcn.0040dc90
add esp, 0xc
mov eax, esi
add esp, 0x424
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x438]
mov edi, dword [esp]
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
test edi, edi
mov dword [esi], eax
jne 0x4c9d06
jmp 0x4c9d17
ud2
Function at 0x4ca980
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x418
mov eax, dword [esp + 0x430]
mov edi, 0x200
mov dword [esp + 8], 0
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 4], 2
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
cmp edi, 0x201
jae 0x4ca9f0
jmp 0x4ca9de
jbe 0x4caa73
cmp edi, 0x201
jae 0x4ca9f0
lea ebp, [esp + 0x18]
mov ebx, 0x200
mov esi, edi
jmp 0x4caa04
mov esi, dword [esp]
sub edi, esi
jne 0x4caa56
mov ebp, dword [esp + 4]
mov ebx, esi
mov dword [esp + 0x10], esi
mov dword [esp], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x4caa2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4caaae
cmp edi, esi
jne 0x4ca9d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4caad1
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x4ca9de
jmp 0x4ca9f0
push edi
push esi
lea eax, [esp + 0x10]
push eax
call fcn.00505980
add esp, 0xc
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
jmp 0x4ca9f7
cmp edi, ebx
ja 0x4caad1
push edi
push ebp
mov esi, dword [esp + 0x434]
push esi
call fcn.004c00c0
add esp, 0xc
mov eax, dword [esp]
test eax, eax
je 0x4caaa1
add eax, eax
push 2
push eax
push dword [esp + 0xc]
call fcn.0040dc90
add esp, 0xc
mov eax, esi
add esp, 0x418
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x42c]
mov dword [esi + 4], eax
mov dword [esi], 0
mov byte [esi + 0xc], 2
mov eax, dword [esp]
test eax, eax
jne 0x4caa90
jmp 0x4caaa1
ud2
Function at 0x4caae0
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x424
mov edi, 0x200
mov dword [esp + 8], 0
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 4], 2
cmp edi, 0x201
jae 0x4cab40
jmp 0x4cab2e
jbe 0x4cabc0
cmp edi, 0x201
jae 0x4cab40
lea esi, [esp + 0x24]
mov ebx, 0x200
mov ebp, edi
jmp 0x4cab54
mov ebp, dword [esp]
sub edi, ebp
jne 0x4caba3
mov esi, dword [esp + 4]
mov ebx, ebp
mov dword [esp + 0x10], ebp
mov dword [esp], ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test eax, eax
jne 0x4cab78
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4cac64
cmp edi, ebp
jne 0x4cab20
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4cac8b
lea edi, [ebp + ebp]
test ebp, ebp
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x4cab2e
jmp 0x4cab40
push edi
push ebp
lea eax, [esp + 0x10]
push eax
call fcn.00505980
add esp, 0xc
mov ebp, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
jmp 0x4cab47
cmp edi, ebx
ja 0x4cac8b
mov eax, dword [esp + 0x43c]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
lea eax, [esp + 0x14]
push edi
push esi
mov esi, eax
push eax
call fcn.004c00c0
add esp, 0xc
push dword [ebx + 4]
push dword [ebx]
push esi
call fcn.004c3380
add esp, 0xc
cmp byte [ebp], 0
jne 0x4cac09
push 3
push 0x564414
push esi
call fcn.004c3d30
add esp, 0xc
mov esi, dword [esp + 0x438]
lea eax, [esi + 4]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call fcn.004c9170
add esp, 0xc
mov eax, dword [esp + 0x14]
mov edi, dword [esp]
test eax, eax
je 0x4cac3e
push 1
push eax
push dword [esp + 0x20]
call fcn.0040dc90
add esp, 0xc
xor eax, eax
test edi, edi
mov dword [esi], eax
je 0x4cac57
add edi, edi
push 2
push edi
push dword [esp + 0xc]
call fcn.0040dc90
add esp, 0xc
mov eax, esi
add esp, 0x424
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x438]
mov edi, dword [esp]
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
test edi, edi
mov dword [esi], eax
jne 0x4cac46
jmp 0x4cac57
ud2
Function at 0x4cd780
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
xor eax, eax
cmp edi, 0x3b9aca00
je 0x4cd816
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ebx, 0x3e8
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
setb al
or al, cl
je 0x4cd7cd
xor edx, edx
mov ebp, dword [esp + 0x18]
mov eax, 0xffffffff
test edx, edx
jne 0x4cd7f1
jmp 0x4cd816
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
setae al
movzx edx, al
mov ebp, dword [esp + 0x18]
mov eax, 0xffffffff
test edx, edx
je 0x4cd816
imul ecx, edi, 0x68c26139
xor edx, edx
ror ecx, 6
cmp ecx, 0x10c7
setae dl
add esi, edx
adc ebx, 0
jb 0x4cd816
xor eax, eax
neg ebx
sbb eax, eax
or eax, esi
je 0x4cd85d
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, esp
push 4
push eax
push 0x1006
push 0xffff
push dword [ecx]
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x4cd850
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [ebp + 3], 0
mov word [ebp + 1], 0
mov dword [ebp + 4], eax
mov byte [ebp], cl
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp], 2
mov dword [ebp + 4], 0x565128
jmp 0x4cd853

Function at 0x4cd870
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
xor eax, eax
cmp edi, 0x3b9aca00
je 0x4cd906
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ebx, 0x3e8
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
setb al
or al, cl
je 0x4cd8bd
xor edx, edx
mov ebp, dword [esp + 0x18]
mov eax, 0xffffffff
test edx, edx
jne 0x4cd8e1
jmp 0x4cd906
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
setae al
movzx edx, al
mov ebp, dword [esp + 0x18]
mov eax, 0xffffffff
test edx, edx
je 0x4cd906
imul ecx, edi, 0x68c26139
xor edx, edx
ror ecx, 6
cmp ecx, 0x10c7
setae dl
add esi, edx
adc ebx, 0
jb 0x4cd906
xor eax, eax
neg ebx
sbb eax, eax
or eax, esi
je 0x4cd94d
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, esp
push 4
push eax
push 0x1005
push 0xffff
push dword [ecx]
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x4cd940
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [ebp + 3], 0
mov word [ebp + 1], 0
mov dword [ebp + 4], eax
mov byte [ebp], cl
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp], 2
mov dword [ebp + 4], 0x565128
jmp 0x4cd943
Function at 0x4cd960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 2
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_recv]
mov ecx, eax
cmp eax, 0xffffffff
jne 0x4cd99f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
cmp eax, 0x274a
jne 0x4cd9a9
mov dword [esi + 4], ecx
mov byte [esi], 4
mov eax, esi
pop esi
ret
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
mov eax, esi
pop esi
ret

Function at 0x4cd9d0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, esp
push 4
push ecx
push 1
push 6
push dword [eax]
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x4cda0f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x4cda20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_recv]
mov ecx, eax
cmp eax, 0xffffffff
jne 0x4cda5f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
cmp eax, 0x274a
jne 0x4cda69
mov dword [esi + 4], ecx
mov byte [esi], 4
mov eax, esi
pop esi
ret
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
mov eax, esi
pop esi
ret

Function at 0x4cda90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
mov ebx, dword [edi + 8]
sub ecx, ebx
jb 0x4cdaff
cmp ecx, 0x7fffffff
mov edx, 0x7fffffff
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmovb edx, ecx
mov ecx, dword [edi]
add ecx, ebx
push 0
push edx
push ecx
push dword [eax]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4cdade
add eax, ebx
mov dword [edi + 8], eax
mov ecx, dword [edi + 0xc]
cmp ecx, eax
cmova eax, ecx
mov dword [edi + 0xc], eax
jmp 0x4cdaeb
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x4cdaf4
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x4cdaee
ud2
Function at 0x4cdb90
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp ecx, 0x7fffffff
cmovb edx, ecx
push 0
push edx
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x4cdbca
mov dword [esi + 4], eax
mov al, 4
mov byte [esi], al
mov eax, esi
pop esi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
mov eax, esi
pop esi
ret

Function at 0x4cdbf0
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esp], 0
mov edi, esp
push 0
push 0
push 0
push edi
push edx
push eax
push dword [ecx]
call dword [sym.imp.ws2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x4cdc2d
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4cdc3c
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
ret

Function at 0x4cdcd0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push dword [eax]
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x4cdd01
mov byte [esi], 4
mov eax, esi
add esp, 4
pop esi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x4ce540
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1020
call fcn.004f51b0
lea esi, [esp + 0x20]
push 0x1000
push 0
push esi
call fcn.004f7770
add esp, 0xc
xorps xmm0, xmm0
lea edi, [esp + 0xc]
mov eax, esp
mov dword [esp], 0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], eax
push 0x4bf270
push edi
push 0x1000
push esi
push dword [esp + 0x1044]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x4ce679
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [esp], 0
je 0x4ce5a2
cmp dword [esp + 4], 0
jne 0x4ce67f
mov esi, dword [esp + 8]
test esi, esi
je 0x4ce67f
cmp esi, 0x1000
ja 0x4ce6a2
xor ebp, ebp
nop word cs:[eax + eax]
nop dword [eax]
mov eax, esi
xorps xmm0, xmm0
mov edx, esp
lea ecx, [esp + ebp + 0x20]
mov dword [esp], 0
movups xmmword [esp + 0xc], xmm0
sub eax, ebp
mov dword [esp + 0x1c], edx
push 0x4bf270
push edi
push eax
push ecx
push dword [esp + 0x1048]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x4ce679
nop word cs:[eax + eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [esp], 0
je 0x4ce620
cmp dword [esp + 4], 0
jne 0x4ce67f
add ebp, dword [esp + 8]
cmp ebp, esi
je 0x4ce63f
jbe 0x4ce5e0
jmp 0x4ce6a2
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], eax
push 0x4bf270
push edi
push 0x1000
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1044]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x4ce5a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x1034]
call esi
push dword [esp + 0x1038]
call esi
add esp, 0x1020
pop esi
pop edi
pop ebx
pop ebp
ret
ud2

Function at 0x4ce6b0
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4ce6f0
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4ce767
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x4ce704
cmp eax, 0x2739
jne 0x4ce735
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4ce72f
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4ce740
mov dword [esi + 4], edi
jmp 0x4ce6eb
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x4ce767
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
mov byte [esi], 0
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4d09c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov edi, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov eax, dword [esp + 0xa8]
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov edi, dword [edi + 8]
test edx, edx
je 0x4d0aaf
nop
mov ecx, dword [ecx + edi*4 + 0x1ec]
dec edx
je 0x4d0a0b
movzx edi, word [ecx + 0x1ea]
mov ecx, dword [ecx + edi*4 + 0x1ec]
dec edx
jne 0x4d09fa
movzx edx, word [ecx + 0x1ea]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], ecx
mov ecx, esp
dec edx
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x44]
push eax
call fcn.004d0580
add esp, 4
movsd xmm2, qword [esp + 0x18]
movsd xmm1, qword [esp + 0x10]
mov eax, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
movsd qword [esp + 0x68], xmm2
movsd qword [esp + 0x60], xmm1
movsd xmm2, qword [esp]
movsd xmm1, qword [esp + 8]
mov dword [esp + 0x78], eax
movsd qword [esp + 0x70], xmm0
mov eax, dword [esp + 0x34]
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
movzx ecx, word [edi + 0x1ea]
cmp eax, ecx
jae 0x4d0a90
mov ecx, edi
jmp 0x4d0ad5
mov ecx, dword [edi + 0xb0]
test ecx, ecx
je 0x4d0ad3
movzx eax, word [edi + 0x1e8]
inc edx
mov edi, ecx
cmp ax, word [ecx + 0x1ea]
jae 0x4d0a90
jmp 0x4d0ad5
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edi
lea edx, [esp + 0x38]
mov ecx, esi
push eax
call fcn.004d0580
add esp, 4
jmp 0x4d0c05
mov ecx, edi
movsd xmm0, qword [esp + 0x74]
lea edi, [eax + eax*8]
movsd xmm2, qword [esp + 0x60]
lea ebx, [edi + edi*2]
mov edi, eax
add ebx, eax
shl edi, 4
test edx, edx
movsd qword [esp + 0x84], xmm0
movsd xmm0, qword [esp + 0x6c]
movsd qword [esp + 0x7c], xmm0
mov ebp, dword [ecx + ebx + 0xcc]
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x68]
movsd xmm0, qword [ecx + ebx + 0xc4]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [ecx + ebx + 0xb4]
movsd xmm1, qword [ecx + ebx + 0xbc]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x58]
mov dword [ecx + ebx + 0xcc], ebp
movsd qword [ecx + ebx + 0xc4], xmm2
movsd qword [ecx + ebx + 0xbc], xmm1
movsd qword [ecx + ebx + 0xb4], xmm0
movsd xmm0, qword [ecx + edi]
movsd xmm1, qword [ecx + edi + 8]
movsd xmm2, qword [esp + 0x84]
movsd qword [esp + 0x1c], xmm0
movsd xmm0, qword [esp + 0x7c]
movsd qword [esp + 0x24], xmm1
movsd qword [ecx + edi + 8], xmm2
movsd qword [ecx + edi], xmm0
je 0x4d0bbb
mov ecx, dword [ecx + eax*4 + 0x1f0]
xor eax, eax
dec edx
je 0x4d0bbc
nop dword [eax]
mov ecx, dword [ecx + 0x1ec]
dec edx
jne 0x4d0bb0
jmp 0x4d0bbc
inc eax
movsd xmm2, qword [esp + 0x18]
movsd xmm1, qword [esp + 0x10]
mov edx, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
movsd qword [esi + 0x18], xmm2
movsd qword [esi + 0x10], xmm1
movsd xmm2, qword [esp]
movsd xmm1, qword [esp + 8]
mov dword [esi + 0x28], edx
movsd qword [esi + 0x20], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm2
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov eax, esi
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret