joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aee5c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0xfffffffe
test esi, esi
je 0x4aefc8
mov ebx, esi
mov dword [ebp - 4], 0xfffffffc
cmp edi, dword [ebx + 0x18]
je 0x4aefc8
mov byte [ebx + 0x59], 0
mov word [ebx + 0x5a], 0
mov byte [ebx + 0x5c], 0
test edi, edi
jl 0x4aeea8
push esi
call fcn.004aed9c
cmp edi, eax
jl 0x4aeec1
test edi, edi
jge 0x4aefc8
mov dword [ebx + 0x18], 0xfffffffe
xor eax, eax
mov dword [ebx + 0x44], eax
jmp 0x4aefc8
cmp byte [ebx + 0x34], 0
je 0x4aef28
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x3e]
test eax, eax
je 0x4aeeef
cmp edi, dword [ebp - 8]
jne 0x4aeee5
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aeeef
inc dword [ebp - 8]
mov eax, dword [eax + 0x44]
test eax, eax
jne 0x4aeed3
cmp dword [ebp - 4], 0
jne 0x4aefc8
push 0
mov al, byte [ebx + 0x48]
push eax
push esi
call fcn.004aefd4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4aefc8
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx + 0x18]
push eax
push esi
call fcn.004afaf0
mov dword [ebp - 4], eax
jmp 0x4aefc8
cmp byte [ebx + 0xb8], 0
je 0x4aefc8
push 0
push 0
call sub.kernel32.dll_GetLogicalDriveStringsA
mov esi, eax
mov eax, esi
call fcn.0040a24c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4aefc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_GetLogicalDriveStringsA
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4aefa6
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4aef9b
cmp edi, dword [ebp - 8]
jne 0x4aef95
mov al, byte [esi]
call fcn.004029a4
mov byte [ebx + 0x1c], al
mov dword [ebx + 0x18], edi
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0040366c
jmp 0x4aefc8
inc dword [ebp - 8]
jmp 0x4aef9b
inc esi
cmp byte [esi], 0
jne 0x4aef9a
cmp byte [esi], 0
jne 0x4aefa6
inc esi
cmp byte [esi], 0
jne 0x4aef6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aefc8
mov eax, dword [ebp - 0xc]
call fcn.0040a298
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b045c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4b04b3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.00403fb4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4b0493
test al, 0x10
jne 0x4b0497
xor eax, eax
jmp 0x4b0499
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b04ba
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4b1a98
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, dword [ebp + 8]
mov edx, 0xfffffffe
test eax, eax
je 0x4b1ba4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d], 0
je 0x4b1ba2
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x4b1ba2
xor edx, edx
push ebp
push 0x4b1b9b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x60], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
push eax
call sub.kernel32.dll_SetEvent
push 0x3e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4b1b1b
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x70], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x5d], 0
jmp 0x4b1b57
push 0
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5e], 0
jne 0x4b1b50
xor ebx, ebx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 4]
lea esi, [edx + eax*4 + 0x80]
mov eax, dword [esi]
test eax, eax
je 0x4b1b7e
call fcn.00407e28
xor eax, eax
mov dword [esi], eax
inc ebx
cmp ebx, 2
jne 0x4b1b62
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1ba2
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor edx, edx
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4b4480
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4524
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x64
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403d18
lea eax, [ebp - 8]
mov edx, 0x4b453c
call fcn.00403df8
mov eax, dword [ebp - 8]
call fcn.00403fb4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4b4508
mov eax, 0xc
call fcn.00402734
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, 0xc
call fcn.00402bf4
mov eax, ebx
call fcn.004029a4
mov edx, eax
lea eax, [ebp - 8]
call fcn.00403d18
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0x38]
inc ebx
cmp ebx, 0x7b
jne 0x4b44a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b452b
lea eax, [ebp - 8]
call fcn.00403b74
ret

Function at 0x4e6e84
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4e6f25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x513188
push 0x101
call sub.wsock32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e6f0a
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040c394
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov eax, 0x4e6f38
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x1c]
push eax
push 2
lea edx, [ebp - 0x24]
mov eax, dword [0x50ff80]
call fcn.004060f8
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x4e6730]
call fcn.0040cbc8
call fcn.004035cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6f2c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403b98
ret

Function at 0x4e7314
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov al, byte [0x4e7390]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x28]
je 0x4e7346
mov dword [ebp - 8], 0x401
mov eax, dword [ebp - 4]
call fcn.004e7394
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov al, byte [0x4e7390]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x28]
jne 0x4e7389
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
mov esp, ebp
pop ebp
ret
Function at 0x4e73cc
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403fb4
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 4
call fcn.00402bf4
cmp dword [ebp - 0x10], 0
je 0x4e743b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 1]
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 2]
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 3]
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4e7580
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e76e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4e75cf
lea edx, [ebp - 0x20]
mov eax, dword [0x50fe68]
call fcn.004060f8
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4e6730]
call fcn.0040cb8c
call fcn.004035cc
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x4e760a
lea edx, [ebp - 0x20]
mov eax, dword [0x50fddc]
call fcn.004060f8
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4e6730]
call fcn.0040cb8c
call fcn.004035cc
xor eax, eax
push ebp
push 0x4e76af
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.004030d0
mov eax, dword [ebp + 0xc]
push eax
mov ax, word [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e7498
mov eax, dword [ebp - 4]
call fcn.004e7314
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.004030d0
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x4e76fc
call fcn.004e6da4
mov eax, dword [ebp - 4]
test byte [eax + 0x28], 0x10
jne 0x4e76a5
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.004030d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e76cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e76e9
lea eax, [ebp - 0x20]
call fcn.00403b74
ret
Function at 0x4e78e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004e713c
xor eax, eax
push ebp
push 0x4e7a4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4e7a39
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4e792a
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4e7934
call fcn.0040366c
jmp 0x4e7a56
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00414438
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1018]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4e7a2e
push 0
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1018]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4e79e7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2733
je 0x4e79d7
lea eax, [ebp - 0x18]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.004030d0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004e7898
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4e7a60]
cmp dl, byte [eax + 0x28]
je 0x4e7a35
call fcn.0040cb24
jmp 0x4e7a35
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00414448
jmp 0x4e7a35
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jle 0x4e7a05
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00414448
jmp 0x4e7934
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00414438
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00414454
cmp ebx, eax
jne 0x4e7934
push ebp
call fcn.004e7898
pop ecx
jmp 0x4e7a35
push ebp
call fcn.004e7898
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7a56
mov eax, dword [ebp - 4]
call fcn.004e7154
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7a64
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e7b9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004e713c
xor eax, eax
push ebp
push 0x4e7b7d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4e7ab8
call fcn.0040366c
jmp 0x4e7b84
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4e7b67
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
je 0x4e7b67
lea eax, [ebp - 0x14]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.004030d0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x14], 0
je 0x4e7b67
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040c394
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, 0x4e7bb8
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x2c]
push eax
push 2
lea edx, [ebp - 0x34]
mov eax, dword [0x50ff80]
call fcn.004060f8
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x4e6730]
call fcn.0040cbc8
call fcn.004035cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7b84
mov eax, dword [ebp - 4]
call fcn.004e7154
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7ba6
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00403b98
ret
Function at 0x4e7c30
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e7d94
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004e713c
xor eax, eax
push ebp
push 0x4e7d72
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4e7c9a
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4e7c9a
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4e7d5c
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4e7cad
call fcn.0040366c
jmp 0x4e7d79
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4e7d5c
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
je 0x4e7d5c
lea eax, [ebp - 0x14]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.004030d0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x14], 0
je 0x4e7d5c
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040c394
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, 0x4e7dac
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x2c]
push eax
push 2
lea edx, [ebp - 0x34]
mov eax, dword [0x50ff80]
call fcn.004060f8
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x4e6730]
call fcn.0040cbc8
call fcn.004035cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7d79
mov eax, dword [ebp - 4]
call fcn.004e7154
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7d9b
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00403b98
ret
Function at 0x4f00f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xb0], ecx
mov esi, edx
lea edi, [ebp - 0x28]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fa4
lea eax, [ebp - 0x28]
mov edx, dword [0x4efae8]
call fcn.004046f4
xor eax, eax
push ebp
push 0x4f032f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004096d4
test al, al
je 0x4f02fb
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00403fb4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4f02fb
xor eax, eax
push ebp
push 0x4f02f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0xffffffffffffff80
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f01a4
cmp eax, 0xffffffff
je 0x4f02dd
push 0
lea eax, [ebp - 0x10]
push eax
push 0x80
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f02dd
cmp dword [ebp - 0x10], 0x80
jne 0x4f02dd
lea eax, [ebp - 0xb0]
lea edx, [ebp - 0xa8]
mov ecx, 3
call fcn.00403da0
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.0045ce2c
mov eax, dword [ebp - 0xac]
mov edx, 0x4f0348
call fcn.00403f00
jne 0x4f0224
push 2
push 0
push 0xffffffffffffff80
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
jmp 0x4f0233
push 2
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0xa8]
mov edx, 0x80
call fcn.00407df0
mov edx, 0x4f034c
lea eax, [ebp - 0xa8]
call fcn.00409fc4
lea eax, [ebp - 0xa5]
mov ecx, 0x1e
mov edx, dword [ebp - 0x28]
call fcn.0040a070
lea eax, [ebp - 0x87]
mov ecx, 0x1e
mov edx, dword [ebp - 0x24]
call fcn.0040a070
lea eax, [ebp - 0x69]
mov ecx, 0x1e
mov edx, dword [ebp - 0x20]
call fcn.0040a070
lea eax, [ebp - 0x4b]
mov ecx, 4
mov edx, dword [ebp - 0x1c]
call fcn.0040a070
lea eax, [ebp - 0x47]
mov ecx, 0x1c
mov edx, dword [ebp - 0x18]
call fcn.0040a070
mov ax, word [ebp - 0x14]
xchg al, ah
mov word [ebp - 0x2b], ax
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x29], al
push 0
lea eax, [ebp - 0x10]
push eax
push 0x80
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f02fb
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0336
lea eax, [ebp - 0xb0]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x28]
mov edx, dword [0x4efae8]
call fcn.004045dc
lea eax, [ebp - 4]
call fcn.00403b74
ret
Function at 0x4f0350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x98], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fa4
xor eax, eax
push ebp
push 0x4f0504
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004096d4
test al, al
je 0x4f04de
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00403fb4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4f04de
xor eax, eax
push ebp
push 0x4f04d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0xffffffffffffff80
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f03eb
cmp eax, 0xffffffff
je 0x4f04c0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x80
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f04c0
cmp dword [ebp - 0x10], 0x80
jne 0x4f04c0
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x90]
mov ecx, 3
call fcn.00403da0
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.0045ce2c
mov eax, dword [ebp - 0x94]
mov edx, 0x4f051c
call fcn.00403f00
jne 0x4f04c0
push 2
push 0
push 0xffffffffffffff80
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f0473
cmp eax, 0xffffffff
je 0x4f04c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetEndOfFile_1
test eax, eax
je 0x4f04c0
mov byte [ebp - 5], 1
mov eax, ebx
xor ecx, ecx
mov edx, 0x18
call fcn.00402bf4
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 4]
call fcn.00409a30
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.0045ce2c
mov edx, dword [ebp - 0x94]
mov eax, ebx
call fcn.00403bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f04de
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f050b
lea eax, [ebp - 0x98]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 4]
call fcn.00403b74
ret

Function at 0x4f56f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fa4
xor eax, eax
push ebp
push 0x4f5775
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x513460]
mov eax, dword [eax + 0x4f0]
cmp byte [eax + 0x21c], 0
jne 0x4f5738
lea edx, [ebp - 4]
mov eax, dword [0x513460]
mov eax, dword [eax + 0x2e0]
call fcn.0047897c
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403fb4
push eax
push 0x4f5780
mov eax, dword [0x513460]
call fcn.00439b04
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f577c
lea eax, [ebp - 4]
call fcn.00403b74
ret