joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b70c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
push edi
test dword [esi + 0x2c], 0x1000000
lea edi, [esi + 0x44]
je 0x4b7100
push 0x10
push edi
push 0x4b6f20
mov dword [esi + 0x138], 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x4b71f2
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4b7198
lea ecx, [edi + 0x20]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
test dword [esi + 0x2c], 0x80000
je 0x4b7122
mov eax, dword [edi + 0x3c]
or eax, 1
mov dword [edi + 0x30], eax
push ecx
push 0
push 0
push 0x545c08
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b714b
call ebx
cmp eax, 0x3e5
jne 0x4b7198
test dword [esi + 0x2c], 0x80000
je 0x4b71f2
cmp dword [edi + 0x3c], 0
jne 0x4b7177
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x3c], eax
test eax, eax
je 0x4b7209
cmp dword [edi + 0x40], 0xffffffff
lea eax, [edi + 0x40]
jne 0x4b71f2
push 4
push 0xffffffffffffffff
push edi
push 0x4b4cb0
push dword [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x4b71f2
call ebx
test eax, eax
jg 0x4b71a2
call ebx
jmp 0x4b71ac
call ebx
movzx eax, ax
or eax, 0x80070000
mov dword [edi + 0x20], eax
mov dword [edi + 0x38], 0
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x4b71dc
mov eax, dword [eax + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 0x28]
mov dword [eax + 0x38], edi
mov dword [ebp + 0x28], edi
or dword [esi + 0x2c], 0x10000
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [edi + 0x38], edi
mov dword [ebp + 0x28], edi
or dword [esi + 0x2c], 0x10000
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, esi
call fcn.004b7990
or dword [esi + 0x2c], 0x10000
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call ebx
mov edx, str.CreateEvent
mov ecx, eax
call fcn.004b88e0
int3

Function at 0x4b7310
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push dword [esp + 0x1c]
mov esi, edx
mov dword [esp + 0x14], 0
push esi
mov eax, dword [esi + 0x34]
call eax
mov edx, dword [esp + 0x18]
add esp, 0xc
test edx, edx
je 0x4b73a5
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4b73a5
mov eax, dword [esp + 0x1c]
cmp eax, ecx
push 0
cmova eax, ecx
lea ecx, [esp + 8]
push ecx
push eax
push edx
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b738a
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, esi
call fcn.004b7270
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x10
ret
lea eax, [esp + 8]
push eax
push dword [esp + 8]
mov eax, dword [esi + 0x38]
push esi
call eax
mov eax, dword [esp + 0x10]
add esp, 0xc
pop esi
add esp, 0x10
ret
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 0x38]
push 0xfffff024
push esi
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x4b73c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x29c
mov eax, dword [0x53c074]
xor eax, esp
mov dword [esp + 0x294], eax
push ebx
mov ebx, edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x108]
test eax, eax
je 0x4b73f9
push eax
push eax
call fcn.004b7310
add esp, 8
sub dword [ebx + 0x108], eax
jmp 0x4b755a
mov edi, dword [ebx + 0x94]
xor esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, 0x10
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push eax
push edi
call ebp
test eax, eax
je 0x4b742f
add esi, dword [esp + 0x10]
cmp esi, 0x10
jb 0x4b7407
jmp 0x4b743d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b7541
mov ecx, dword [esp + 0x18]
test ecx, 0xfffffff8
jne 0x4b753c
cmp dword [esp + 0x24], 0
jne 0x4b753c
mov eax, ecx
and eax, 6
test al, 2
je 0x4b746f
and al, 4
movzx edi, al
neg edi
sbb edi, edi
add edi, 2
jmp 0x4b7479
test eax, eax
jne 0x4b753c
xor edi, edi
test cl, 1
je 0x4b748a
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x108], eax
jmp 0x4b7495
cmp dword [esp + 0x20], 0
jne 0x4b753c
test edi, edi
jne 0x4b74a1
lea eax, [edi + 0x10]
jmp 0x4b755a
mov ecx, dword [ebx + 0x94]
xor esi, esi
mov dword [esp + 0x14], ecx
nop dword [eax]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, 0x278
sub eax, esi
push eax
lea eax, [esp + 0x34]
add eax, esi
push eax
push ecx
call ebp
test eax, eax
je 0x4b74df
add esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp esi, 0x278
jb 0x4b74b0
jmp 0x4b74e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b7541
push 0x284
call dword [0x53d638]
mov edx, eax
add esp, 4
test edx, edx
je 0x4b7573
mov dword [edx], edi
lea esi, [esp + 0x28]
lea edi, [edx + 4]
mov ecx, 0x9e
rep movsd dword es:[edi], dword [esi]
lea ecx, [edx + 0x27c]
lea eax, [ebx + 0x110]
mov dword [ecx], eax
mov eax, dword [ebx + 0x114]
mov dword [edx + 0x280], eax
mov dword [eax], ecx
mov eax, 0x288
mov dword [ebx + 0x114], ecx
inc dword [ebx + 0x118]
jmp 0x4b755a
mov eax, 0x2745
push dword [0x531f10]
mov edx, ebx
push dword [0x531f0c]
push eax
call fcn.004b7270
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c3717
add esp, 0x29c
ret
mov edx, str.uv__malloc
mov ecx, 0xe
call fcn.004b88e0
int3
Function at 0x4b7590
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ecx
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 0x3c]
and eax, 0xffdeffff
dec edx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], edx
test al, 1
je 0x4b75c5
test edx, edx
jne 0x4b75c5
test al, 0x20
jne 0x4b75c5
or eax, 0x20
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x28], eax
mov dword [ebx + 0x2c], esi
mov edi, dword [esi + 0xa0]
test edi, edi
je 0x4b75fe
test byte [edi + 0x2c], 4
je 0x4b75fe
push ecx
mov ecx, dword [edi + 4]
lea edx, [edi + 0x30]
mov ecx, dword [ecx + 0x30]
call fcn.004af900
mov eax, dword [edi + 0x2c]
add esp, 4
test al, 4
je 0x4b75fe
and eax, 0xfffffffb
mov dword [edi + 0x2c], eax
test al, 8
je 0x4b75fe
mov eax, dword [edi + 4]
dec dword [eax + 4]
test dword [esi + 0x2c], 0x1000
je 0x4b76ea
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x20]
test eax, eax
jns 0x4b7644
push eax
call dword [0x545d44]
cmp eax, 0x3e3
je 0x4b76cc
push dword [0x531f10]
mov edx, esi
push dword [0x531f0c]
push eax
call fcn.004b7270
add esp, 0xc
jmp 0x4b76cc
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push 0
push 0
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x4b7686
push dword [0x531f10]
push dword [0x531f0c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, esi
call fcn.004b7270
add esp, 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4b76cc
nop
test dword [esi + 0x2c], 0x1000
je 0x4b76cc
cmp dword [esi + 0x90], 0
mov edx, esi
je 0x4b76ab
call fcn.004b73c0
jmp 0x4b76b6
push 0xffffffffffffffff
push eax
call fcn.004b7310
add esp, 8
mov ecx, eax
test ecx, ecx
je 0x4b76cc
mov eax, dword [esp + 0xc]
cmp ecx, eax
ja 0x4b76cc
sub eax, ecx
mov dword [esp + 0xc], eax
jne 0x4b7690
mov eax, dword [esi + 0x2c]
and eax, 0x11000
cmp eax, 0x1000
jne 0x4b76ea
mov edx, esi
mov ecx, ebx
pop edi
pop esi
pop ebx
add esp, 4
jmp fcn.004b70c0
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4b81b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x41c
mov eax, dword [0x53c074]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
lea eax, [esp + 0x288]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4b8338
xorps xmm0, xmm0
mov eax, 2
movups xmmword [0x545d50], xmm0
push 0
mov word [0x545d50], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, 0x545d54
mov word [0x545d52], ax
mov ecx, str.0.0.0.0
call fcn.004b64a0
test eax, eax
jne 0x4b83a0
push ecx
call fcn.004aab60
add esp, 4
test eax, eax
jne 0x4b83a0
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b829c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x274
push eax
lea eax, [esp + 0x14]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x4b8344
test dword [esp + 0x10], 0x20000
mov ecx, 1
mov eax, dword [0x545d80]
cmove eax, ecx
push edi
mov dword [0x545d80], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x4b8356
jmp 0x4b82ad
call esi
mov ecx, eax
call fcn.004b8180
test eax, eax
je 0x4b8368
push 0
push 1
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b8314
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x274
push eax
lea eax, [esp + 0x14]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x4b8376
test dword [esp + 0x10], 0x20000
mov ecx, 1
mov eax, dword [0x545d7c]
cmove eax, ecx
push edi
mov dword [0x545d7c], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x4b8384
jmp 0x4b8321
call esi
mov ecx, eax
call fcn.004b8180
test eax, eax
je 0x4b8392
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
xor ecx, esp
call fcn.004c3717
add esp, 0x41c
ret
mov edx, str.WSAStartup
mov ecx, eax
call fcn.004b88e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, str.getsockopt
mov ecx, eax
call fcn.004b88e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, str.closesocket
mov ecx, eax
call fcn.004b88e0
call esi
mov edx, str.socket
mov ecx, eax
call fcn.004b88e0
call esi
mov edx, str.getsockopt
mov ecx, eax
call fcn.004b88e0
call esi
mov edx, str.closesocket
mov ecx, eax
call fcn.004b88e0
call esi
mov edx, str.socket
mov ecx, eax
call fcn.004b88e0
call fcn.004cebb9
int3
Function at 0x4ba810
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebx + 0x10]
test dword [edi + 0xe4], 0x2000
jne 0x4ba841
push str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
push 0xa7b
push 0x53f938
push dword [0x545874]
call dword [0x545870]
add esp, 0x10
push esi
lea esi, [edi + 0x9c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebx + 0xe4], 1
push esi
mov byte [edi + 0xc7], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0xbc], 0xffffffff
pop esi
je 0x4ba8a2
push 0
push 1
push 0x53f22c
push dword [edi + 0xc0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x4ba8a2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4ba8a2
push str.Failed_to_signal_resume_via_inter_thread_communication_channel.
push edi
call fcn.004c1e90
add esp, 8
pop edi
pop ebx
ret
Function at 0x4bb1f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], edx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov byte [ebp + 0xc8], 0
mov eax, dword [ebp + 0xbc]
mov dword [esp + 0x18], ebp
cmp eax, 0xffffffff
je 0x4bb240
push edx
push eax
call edi
test eax, eax
je 0x4bb23c
mov esi, dword [sym.imp.WS2_32.dll_recv]
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push dword [ebp + 0xbc]
call esi
test eax, eax
jg 0x4bb227
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0xb4]
cmp eax, 0xffffffff
je 0x4bb263
cmp byte [ebp + 0xc5], 0
jne 0x4bb263
push edx
push eax
call edi
test eax, eax
je 0x4bb263
mov ecx, ebp
call fcn.004bac30
test dword [ebp + 0xe4], 4
jne 0x4bb2ec
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4bb2ec
mov ebp, dword [esp + 0x10]
nop word [eax + eax]
mov ebx, dword [esi + 0xa0]
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x4bb2e2
push dword [esp + 0x24]
push ebx
call edi
push dword [esp + 0x20]
mov edi, eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
push ebp
push dword [esp + 0x14]
mov ebx, eax
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test edi, edi
setne cl
test ebx, ebx
movzx ecx, cl
push ecx
setne cl
test eax, eax
movzx ecx, cl
push ecx
setne dl
mov ecx, esi
call fcn.004b9330
mov eax, dword [esp + 0x1c]
add esp, 8
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov esi, eax
test eax, eax
jne 0x4bb280
mov ebp, dword [esp + 0x18]
mov ecx, ebp
call fcn.004bae20
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4bd150
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xe4]
mov ecx, eax
mov ebx, eax
shr ecx, 2
shr ebx, 0xf
and ecx, 0xffffff01
and ebx, 0xffffff01
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
test eax, 0x2000
je 0x4bd192
mov ecx, esi
mov byte [esi + 0xc7], 1
call fcn.004ba8b0
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test bl, bl
je 0x4bd2d7
mov edi, dword [esi + 0x14]
test edi, edi
je 0x4bd1f1
nop
mov eax, dword [edi + 0xd8]
test eax, eax
je 0x4bd2b9
cmp byte [eax + 4], 0
jne 0x4bd1d2
push str.Initiated_daemon_shutdown_while__upgraded__connection_was_not_closed._n
push esi
call fcn.004c1e90
add esp, 8
mov eax, dword [edi + 0xd8]
mov byte [eax + 4], 1
mov byte [edi + 0xe4], 1
mov byte [esi + 0xc7], 1
mov edi, dword [edi + 4]
test edi, edi
jne 0x4bd1b0
mov edi, dword [esi + 0xc]
test edi, edi
je 0x4bd250
mov ebx, dword [sym.imp.WS2_32.dll_shutdown]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 2
push dword [edi + 0xa0]
call ebx
test dword [esi + 0xe4], 4
je 0x4bd249
cmp dword [esi + 0xbc], 0xffffffff
je 0x4bd249
push 0
push 1
push 0x53dd84
push dword [esi + 0xc0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x4bd249
call ebp
cmp eax, 0x2733
jne 0x4bd2ff
mov edi, dword [edi + 4]
test edi, edi
jne 0x4bd204
cmp byte [esp + 0x14], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
je 0x4bd330
mov edi, dword [esi + 0xc]
test edi, edi
je 0x4bd330
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0xa6], 0
jne 0x4bd31d
lea eax, [esi + 0x9c]
push eax
call ebx
push 0xffffffffffffffff
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4bd391
push dword [edi + 0x50]
call ebp
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 0xa6], 1
mov edi, dword [esi + 0xc]
jmp 0x4bd320
push str.MHD_stop_daemon___called_while_we_have_suspended_connections._n
push 0x181e
push 0x53de48
push dword [0x545874]
call dword [0x545870]
add esp, 0x10
cmp dword [esi + 0x10], 0
je 0x4bd1f1
push 0x53ddc0
push 0x183d
push 0x53dd88
push dword [0x545874]
call dword [0x545870]
add esp, 0x10
push str.Failed_to_signal_shutdown_via_inter_thread_communication_channel
push 0x1846
push 0x53dd08
push dword [0x545874]
call dword [0x545870]
add esp, 0x10
mov edi, dword [edi + 4]
test edi, edi
jne 0x4bd272
nop dword [eax + eax]
lea eax, [esi + 0x9c]
push eax
call ebx
cmp byte [esp + 0x18], 0
je 0x4bd34e
mov ecx, esi
mov byte [esi + 0xc7], 1
call fcn.004ba8b0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4bd383
nop word [eax + eax]
test dword [esi + 0xe4], 4
je 0x4bd375
cmp byte [eax + 0xa6], 0
je 0x4bd3af
mov ecx, eax
call fcn.004bbe20
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4bd360
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp fcn.004bae20
push 0x53dcec
push 0x1854
push 0x53dcb4
push dword [0x545874]
call dword [0x545870]
add esp, 0x10
push 0x53dc98
push 0x1872
push 0x53dc60
push dword [0x545874]
call dword [0x545870]
add esp, 0x10
int3
Function at 0x4bdb50
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov dword [esp], 1
test ecx, ecx
je 0x4bdb7a
push 4
lea eax, [esp + 4]
push eax
push 1
push 6
push dword [ecx + 0xa0]
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
inc eax
pop ecx
ret
push str.NULL___connection
push 0x234
push str.c:libx86libmicrohttpd_0.9.59_srcmicrohttpdconnection.c
push str._s:_u_Assertion_failed:__s_nProgram_aborted._n
push 2
call fcn.004cb8fa
add esp, 4
push eax
call fcn.004038b0
add esp, 0x14
push 2
call fcn.004cb8fa
add esp, 4
push eax
call fcn.004cd32e
add esp, 4
call fcn.004cebb9
int3

Function at 0x4bdbc0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov dword [esp], 0
test ecx, ecx
je 0x4bdbea
push 4
lea eax, [esp + 4]
push eax
push 1
push 6
push dword [ecx + 0xa0]
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
inc eax
pop ecx
ret
push 0x542fac
push 0x286
push 0x542f70
push 0x542f40
push 2
call fcn.004cb8fa
add esp, 4
push eax
call fcn.004038b0
add esp, 0x14
push 2
call fcn.004cb8fa
add esp, 4
push eax
call fcn.004cd32e
add esp, 4
call fcn.004cebb9
int3
Function at 0x4c1b20
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x4c
mov eax, dword [0x53c074]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x4c1b46
push 0x271e
jmp 0x4c1cd5
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4c1cbf
push 0x7f000001
mov dword [esp + 0x28], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x4c1cab
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x4c1cab
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4c1cab
push 6
push 1
push 2
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x4c1cab
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x4c1cf4
push 0x10
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4c1c29
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4c1cf4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4c1cf0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4c1ca1
mov ax, word [esp + 0x34]
cmp ax, word [esp + 0x44]
jne 0x4c1ca1
mov ax, word [esp + 0x36]
cmp ax, word [esp + 0x46]
jne 0x4c1ca1
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x48]
jne 0x4c1ca1
lea eax, [esp + 0x18]
push eax
push 0x8004667e
push ebp
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x4c1cfa
push ebp
call ebx
push edi
call ebx
mov ebp, dword [esp + 0x14]
push esi
call ebx
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, 0x320
jl 0x4c1b52
mov eax, dword [esp + 0x1c]
push 0x274d
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004c3717
add esp, 0x4c
ret
mov ebp, dword [esp + 0x14]
push esi
call ebx
push edi
jmp 0x4c1cac
push esi
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x54]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ebp
mov eax, 1
pop ebp
pop ebx
xor ecx, esp
call fcn.004c3717
add esp, 0x4c
ret
Function at 0x4c21c0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0xc
mov edi, edx
mov ebx, ecx
call fcn.004cc9da
mov esi, eax
add esp, 4
test esi, esi
je 0x4c220f
mov eax, dword [esp + 0x14]
push 0
push 0
push esi
push 0x4c2190
push dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
push 0
mov dword [esi + 4], eax
mov dword [esi + 8], edi
call fcn.004d0efb
add esp, 0x18
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4c2215
push esi
call fcn.004cc9e5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x4d9594
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d9411
Function at 0x4e6fc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b706
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x53c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 0
mov word [esi + 0x18], 0x101
mov byte [esi + 0x1a], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 1
push 0x14
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0x13
call fcn.004c378e
mov ecx, dword [esi + 0x2c]
inc ecx
mov dword [esi + 0x28], eax
push ecx
push str.donate_v2_xxxxx_com
push eax
call fcn.004c5650
add esp, 0x10
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edi, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x48], 0
test edi, edi
jne 0x4e70a9
xor ecx, ecx
jmp 0x4e70b9
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e70b0
sub ecx, edx
mov dword [esi + 0x4c], ecx
test ecx, ecx
je 0x4e70db
lea eax, [ecx + 1]
push eax
call fcn.004c378e
mov ecx, dword [esi + 0x4c]
inc ecx
mov dword [esi + 0x48], eax
push ecx
push edi
push eax
call fcn.004c5650
add esp, 0x10
mov byte [ebp - 4], 6
mov eax, 0xd05
mov ebx, dword [esi + 0x2c]
add ebx, 8
mov word [esi + 0x50], ax
push ebx
call fcn.004c378e
mov edi, eax
add esp, 4
test edi, edi
je 0x4e710b
push ebx
push 0
push edi
call fcn.004c6150
add esp, 0xc
jmp 0x4e710d
xor edi, edi
movzx eax, word [esi + 0x50]
push eax
push dword [esi + 0x28]
lea eax, [ebx - 1]
push str._s:_d
push eax
push edi
call fcn.00401160
push dword [esi + 0x40]
call fcn.004c3789
add esp, 0x18
test edi, edi
jne 0x4e7137
xor ecx, ecx
jmp 0x4e7149
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e7140
sub ecx, edx
mov dword [esi + 0x44], ecx
mov eax, esi
mov dword [esi + 0x40], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c