joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47512c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
jbe 0x475220
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_WSASend
inc eax
jne 0x475179
mov dword [ebp - 0x10], 0xffffffff
jmp 0x475220
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x475193
cmp eax, dword [esp]
seta al
jmp 0x475196
setg al
add esp, 8
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x14]
sub dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
cmp byte [ebp - 0x15], 0
je 0x475216
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x475234
call fcn.0042cfc8
jmp 0x4751d8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
sub dword [ebp - 0x14], eax
dec dword [ebp + 0xc]
add dword [ebp - 0xc], 8
cmp dword [ebp - 0x14], 0
jbe 0x4751ff
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4751fb
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4751c9
jmp 0x4751ff
pop edx
pop eax
jle 0x4751c9
cmp dword [ebp - 0x14], 0
jbe 0x475216
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add dword [edx + 4], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
sub dword [edx], eax
cmp dword [ebp - 8], 0
ja 0x47514a
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x475268
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 8]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_setsockopt
push 4
lea eax, [ebp - 8]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_setsockopt
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4756e8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
lea eax, [ebp - 0x190]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x47576c
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 4], eax
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
je 0x475880
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 0x20
push 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 8], 0x10000
push 4
lea eax, [ebp - 8]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.004034ac
mov word [ebp - 0x18], 2
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x475822
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
jmp 0x475827
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x475863
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00475048
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xffffffff
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x475880
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00475250
mov esp, ebp
pop ebp
ret

Function at 0x475884
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x47590c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov word [eax + 0x20], 2
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x475b1c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov dword [ebp - 0x108], eax
call fcn.0040d15c
fstp qword [ebp - 0x120]
wait
jmp 0x475c52
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0x186a0
push ebp
call fcn.00475a90
pop ecx
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x475b73
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x475c52
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x124]
push eax
call sub.wsock32.dll_select
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jge 0x475bac
push 0x64
call sub.kernel32.dll_Sleep_1
jmp 0x475c52
mov eax, dword [0x4e56e4]
cmp byte [eax], 0
jne 0x475c6c
mov eax, dword [ebp - 0x108]
cmp byte [eax + 0xd], 0
jne 0x475c6c
cmp dword [ebp - 0x114], 0
jle 0x475bff
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x108]
call fcn.00475c74
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx + 4]
call fcn.0040d15c
fsub qword [ebp - 0x120]
mov eax, dword [ebp - 0x108]
fild dword [eax + 0x48]
fdiv dword [0x475c70]
fcompp
fnstsw ax
sahf
jae 0x475c52
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx]
call fcn.0040d15c
fstp qword [ebp - 0x120]
wait
mov eax, dword [ebp - 0x108]
call fcn.00475ce0
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4e56e4]
cmp byte [eax], 0
jne 0x475c6c
mov eax, dword [ebp - 0x108]
cmp byte [eax + 0xd], 0
je 0x475b3c
mov esp, ebp
pop ebp
ret

Function at 0x4769d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004034ac
pop ecx
pop ebp
ret
Function at 0x476c9c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x476cbb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x476e2a
xor dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xc], 8
jb 0x476def
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
sub dword [ebp - 0xc], 8
cmp dword [ebp - 0xc], 8
jae 0x476cc9
cmp dword [ebp - 0xc], 0
je 0x476e21
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x4e4200]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
inc dword [ebp - 8]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x476df5
mov eax, dword [ebp - 4]
xor eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4771b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x48
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
je 0x477219
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x48
xor ecx, ecx
mov edx, 0x10
call fcn.004034ac
call fcn.0042d710
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, 0x477228
mov edx, 4
mov eax, 0x477244
call fcn.0042d5b0
mov esp, ebp
pop ebp
ret
Function at 0x47745c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4776be
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x477689
lea eax, [ebp - 0x11c]
call fcn.0042fcb4
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.0042fca4
push 0
lea eax, [ebp - 0x11c]
push eax
push 0
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
inc eax
push eax
call sub.wsock32.dll_select
mov dword [ebp - 8], eax
mov eax, dword [0x4e56e4]
cmp byte [eax], 0
jne 0x4776a0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
jne 0x4776a0
cmp dword [ebp - 8], 0
jge 0x47752f
call fcn.0042d710
cmp eax, 0x2714
je 0x477689
call fcn.0042d710
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0
lea eax, [ebp - 0x134]
push eax
push 0
mov ecx, 0x4776d4
mov edx, 6
mov eax, 0x4776e0
call fcn.0042d5b0
jmp 0x4776a0
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.wsock32.dll_accept
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x47758a
call fcn.0042d710
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0
lea eax, [ebp - 0x134]
push eax
push 0
mov eax, 0x4776e0
mov ecx, 0x4776d4
mov edx, 7
call fcn.0042d5b0
jmp 0x477689
mov eax, dword [ebp - 4]
cmp dword [eax + 0x50], 0
je 0x4775aa
lea ecx, [ebp - 0x12c]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call dword [ebx + 0x50]
jmp 0x477689
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 4]
call fcn.00477b18
test al, al
jne 0x4775d1
mov eax, dword [ebp - 0x10]
call fcn.00475048
jmp 0x477689
xor eax, eax
push ebp
push 0x477611
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 4]
mov dl, 1
call dword [eax + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0042b0cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x477689
mov eax, dword [0x4e56e4]
cmp byte [eax], 0
jne 0x4776a0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
je 0x47748c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4776c5
lea eax, [ebp - 0x13c]
mov edx, 2
call fcn.00404b90
ret
Function at 0x47a540
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x28]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0047a710
mov dword [ebp - 0x10], eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x47a5ee
mov word [ebp - 0x24], 2
mov eax, dword [ebp - 8]
call fcn.00474d24
mov dword [ebp - 0x20], eax
mov ax, word [ebp - 0xa]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x22], ax
push 0x10
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x47a5c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00475048
jmp 0x47a5ee
mov dword [ebp - 0x14], 1
push 4
lea eax, [ebp - 0x14]
push eax
push 1
push 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_setsockopt
mov eax, dword [ebp - 4]
call fcn.00479fcc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4a2950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405048
xor eax, eax
push ebp
push 0x4a2a22
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x4a2a34
lea edi, [ebp - 0x2c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.00405058
mov esi, eax
inc esi
mov dword [ebp - 0xc], 1
xor edi, edi
jmp 0x4a2a03
mov dl, byte [esi]
cmp dl, 0x27
je 0x4a29a8
cmp dl, byte [ebp - 5]
jne 0x4a29ad
xor bl, 1
jmp 0x4a29ff
test bl, bl
jne 0x4a29ff
mov al, byte [esi]
and eax, 0xff
bt dword [ebp - 0x2c], eax
jae 0x4a29ff
cmp byte [ebp + 8], 0
je 0x4a29d6
mov al, byte [esi]
sub al, 0x3a
je 0x4a29ff
add al, 0xfe
sub al, 3
jb 0x4a29ff
mov edi, dword [ebp - 0xc]
inc edi
jmp 0x4a29ff
cmp byte [esi], 0x3a
jne 0x4a29f5
mov al, byte [esi - 1]
sub al, 0x20
je 0x4a29f0
add al, 0xf8
sub al, 2
jb 0x4a29f0
sub al, 2
je 0x4a29f0
sub al, 0x11
jne 0x4a29ff
mov edi, dword [ebp - 0xc]
jmp 0x4a29ff
cmp byte [esi + 1], 0x3a
jne 0x4a29ff
mov edi, dword [ebp - 0xc]
inc edi
inc esi
inc dword [ebp - 0xc]
test edi, edi
jne 0x4a2a0c
cmp byte [esi], 0
jne 0x4a299c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2a29
lea eax, [ebp - 4]
call fcn.00404b6c
ret
Function at 0x4ac990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4acb11
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e5038], 0
jne 0x4acaee
push 0x4ea26c
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x4acae7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e5038], 0
jne 0x4acacf
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004051e4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00405058
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0040a654
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4acb28
call fcn.0040bfbc
mov eax, dword [ebp - 0xc]
call fcn.00405058
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4aca50
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004051e4
jmp 0x4aca87
lea eax, [ebp - 8]
mov edx, 0x4acb48
call fcn.00404c04
xor eax, eax
push ebp
push 0x4aca7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0048584c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aca87
mov eax, dword [ebp - 8]
call fcn.00405058
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e5038], eax
cmp dword [0x4e5038], 0
jne 0x4acaba
mov ecx, dword [0x4e5a80]
mov dl, 1
mov eax, dword [0x4099d8]
call fcn.0040f05c
call fcn.00404524
push 0x4acb54
mov eax, dword [0x4e5038]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ea284], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acaee
push 0x4ea26c
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acb18
lea eax, [ebp - 0x18]
call fcn.00404b6c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404b90
ret
Function at 0x4b78c4
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x4b78ff
cmp dword [ebx + 0x5c], 0
je 0x4b78ff
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.004afde8
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x4b7a4a
cmp dword [ebx + 0x7c], 0
jne 0x4b7925
mov dl, 1
mov eax, dword [0x41d7dc]
call fcn.00403c7c
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x4b7a23
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x4b7a50]
push eax
mov al, byte [0x4b7a54]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x4e5ab4]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x49c75c]
call fcn.0049eed8
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4b7a1c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004afde8
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.004afde8
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x4ad6a4]
call fcn.004060b4
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x4b79ef
mov edx, dword [0x4e5d98]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x4b7a00
cmp eax, 0x1007
jne 0x4b79fc
mov byte [ebx + 0x74], 0x18
jmp 0x4b7a00
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7a4a
mov eax, dword [ebp - 4]
call fcn.00403cac
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004afde8
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c5d94
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c5ee5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00404b6c
xor eax, eax
push ebp
push 0x4c5e8c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0040a94c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4c5efc
call fcn.0040bfbc
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004c7538
test al, al
je 0x4c5e82
xor eax, eax
push ebp
push 0x4c5e7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x200]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004cad7c
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xa1], 0
jne 0x4c5e62
mov edx, 0x4c5f30
mov eax, dword [ebp - 0x10]
call fcn.00499c18
lea edx, [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0xc]
call fcn.0040a8c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5e82
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004c7680
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5ec2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5eec
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404b90
lea eax, [ebp - 0x14]
call fcn.00404b6c
ret