joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49efa0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1070
call fcn.005d9990
push esi
mov esi, dword [ebp + 8]
fld qword [esi + 0x1070]
push edi
fcomp qword [0x5f56a0]
fnstsw ax
test ah, 0x44
jnp 0x49f0e8
mov eax, dword [esi + 0x10d4]
cmp eax, 1
jne 0x49f09a
lea eax, [esi + 0x7cc]
push eax
lea ecx, [esi + 0x39a]
push ecx
lea edx, [esp + 0x18]
push 0x5f4a5c
push edx
mov dword [esi + 0x10d4], 2
call fcn.005d9929
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
xor edi, edi
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.00423730
add esp, 0x18
test eax, eax
je 0x49f088
fild qword [esp + 8]
fstp qword [esp + 8]
fld qword [esp + 8]
fcomp qword [esp + 8]
fnstsw ax
test ah, 0x44
jp 0x49f088
fld qword [esi + 0x1068]
fcomp qword [0x5f56a0]
fnstsw ax
test ah, 1
jne 0x49f05d
fld qword [esi + 0x1068]
fcomp qword [esp + 8]
fnstsw ax
test ah, 5
jnp 0x49f088
fld qword [esi + 0x1070]
fcomp qword [0x5f8d50]
fnstsw ax
test ah, 1
jne 0x49f088
fld qword [esi + 0x1070]
fsub qword [0x5f8d50]
fstp qword [esi + 0x1070]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x1070], edi
mov dword [esi + 0x1074], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x49f0de
fld qword [esi + 0x1070]
xor edi, edi
mov dword [esi + 0x10d4], edi
push edi
call fcn.005d98b4
push edx
mov edx, dword [esi + 0x1030]
push eax
push edx
call fcn.0049d260
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x49f0e8
mov eax, dword [esi + 0x1030]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10d4], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49f5f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x20d0
call fcn.005d9990
mov eax, dword [0x6696c8]
test eax, eax
push esi
je 0x49f61e
mov esi, dword [esp + 0x20d8]
jmp 0x49f610
cmp eax, esi
je 0x49f628
mov eax, dword [eax + 0x1128]
test eax, eax
jne 0x49f610
xor eax, eax
pop esi
add esp, 0x20d0
ret
mov eax, dword [esi + 0x1124]
push eax
call fcn.00508aa0
add esp, 4
test eax, eax
je 0x49f61e
mov ecx, dword [0x6a0f40]
push edi
push 0
push 0x477360
push 0xfa
push ecx
mov dword [0x63dd8c], esi
call fcn.004762c0
push esi
mov edi, eax
mov dword [0x63dd8c], 0
call fcn.0049ee50
add esp, 0x14
test eax, eax
je 0x49f6d9
mov edx, dword [esi + 0x1124]
push edx
call fcn.00508aa0
add esp, 4
test eax, eax
je 0x49f6ce
test edi, edi
jg 0x49f6e4
mov eax, dword [esi + 0x10e0]
test eax, eax
je 0x49f6ce
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call fcn.005d9929
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49f6b0
push 0
sub eax, edx
mov edx, dword [esi + 0x111c]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
push 0
push esi
call fcn.0049f510
add esp, 8
pop edi
xor eax, eax
pop esi
add esp, 0x20d0
ret
cmp edi, 2
jne 0x49f863
mov eax, dword [esi + 0x10e0]
test eax, eax
je 0x49f770
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call fcn.005d9929
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49f710
push 0
sub eax, edx
mov edx, dword [esi + 0x111c]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
lea eax, [esi + 0x136]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x1078]
push str._s_id__s
push edx
call fcn.005d9929
mov eax, dword [esi + 0x1124]
push eax
lea ecx, [esp + 0x1084]
push 2
push ecx
call fcn.004ef7c0
lea edx, [esp + 0x108c]
push edx
push str.__ignore__wdu__s
jmp 0x49f7b0
lea eax, [esi + 0x136]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x1078]
push 0x5f64d4
push edx
call fcn.005d9929
mov eax, dword [esi + 0x1124]
push eax
lea ecx, [esp + 0x1084]
push 2
push ecx
call fcn.004ef7c0
lea edx, [esp + 0x108c]
push edx
push str.__ignore__du__s
lea eax, [esp + 0x2c]
push eax
call fcn.005d9929
mov eax, dword [esi + 0x1124]
mov edx, dword [eax]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push 0
push ecx
push edx
call fcn.00448030
add esp, 0x44
push 0
push esi
call fcn.0049f510
mov esi, dword [0x6696c8]
add esp, 8
test esi, esi
je 0x49f858
mov edi, edi
mov eax, dword [esi + 0x10e0]
test eax, eax
lea eax, [esi + 0x136]
lea ecx, [esi + 4]
push eax
lea edx, [esp + 0xc]
push ecx
je 0x49f810
push str._s_id__s
jmp 0x49f815
push 0x5f64d4
push edx
call fcn.005d9929
add esp, 0x10
push 1
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x107c]
push ecx
call fcn.0058df80
add esp, 0x10
test eax, eax
je 0x49f84e
push 0
push esi
call fcn.0049f510
mov esi, dword [0x6696c8]
add esp, 8
jmp 0x49f854
mov esi, dword [esi + 0x1128]
test esi, esi
jne 0x49f7f0
pop edi
xor eax, eax
pop esi
add esp, 0x20d0
ret
mov eax, edi
pop edi
pop esi
add esp, 0x20d0
ret
Function at 0x4a0f80
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4a10a4
fld qword [esi + 0x1058]
mov dword [esi + 0x1118], 0
fcomp qword [0x5f56a0]
fnstsw ax
test ah, 0x41
jnp 0x4a10a4
fld qword [esi + 0x1068]
fcomp qword [0x5f56a0]
fnstsw ax
test ah, 1
jne 0x4a104a
fld qword [esi + 0x1068]
fcomp qword [0x5f5808]
fnstsw ax
test ah, 0x41
jne 0x4a104a
fld qword [esi + 0x1058]
push ebp
push edi
call fcn.005d98b4
mov edi, dword [sym.imp.WSOCK32.dll_ntohl]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call edi
mov ecx, dword [esp + 0xc]
mov ebp, eax
xor eax, eax
push ecx
mov dword [esp + 0x1c], eax
call edi
mov ecx, dword [esp + 0x18]
xor edx, edx
push edx
or ecx, eax
push 8
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x111c]
push eax
or ebp, edx
push ecx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 8
pop edi
pop ebp
je 0x4a10ab
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4a108c
xor eax, eax
pop esi
add esp, 8
ret
fld qword [esi + 0x1058]
call fcn.005d98b4
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.WSOCK32.dll_htonl]
push 0
push 4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x111c]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 4
je 0x4a10ab
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4a10a4
push 0
push 0xb67
call fcn.00424130
push eax
push 0
push esi
call fcn.0049fd30
add esp, 0x14
xor eax, eax
pop esi
add esp, 8
ret
mov dword [esi + 0x1058], 0
mov dword [esi + 0x105c], 0
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x4a1680
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1000c
call fcn.005d9990
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x4a18dd
cmp dword [esi + 0x10d4], ebx
je 0x4a16b1
push esi
call fcn.0049efa0
add esp, 4
mov eax, dword [esi + 0x111c]
push 1
push 1
push eax
push 0x8012
mov dword [esi + 0x1118], ebx
call fcn.00599d90
add esp, 0x10
test eax, eax
jne 0x4a18dd
mov ecx, dword [esi + 0x1120]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x1120], ecx
jl 0x4a1710
mov ecx, dword [esi + 0x111c]
push ebx
push 1
push ecx
push 0x8012
mov dword [esi + 0x1120], ebx
call fcn.00599d90
add esp, 0x10
test eax, eax
jne 0x4a18dd
push ebx
lea edx, [esp + 0x1c]
push 0x10000
push edx
call fcn.00423310
mov ecx, dword [esi + 0x111c]
add esp, 8
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp dword [esi + 0x1034], 4
mov dword [esp + 0x10], edi
jne 0x4a18dd
cmp edi, 0xffffffff
je 0x4a1882
cmp edi, ebx
jle 0x4a18af
fild dword [esp + 0x10]
mov eax, dword [esi + 0x10d0]
add eax, edi
mov dword [esi + 0x10d0], eax
fstp qword [esp + 0x10]
fld qword [esp + 0x10]
fadd qword [esi + 0x1050]
fstp qword [esi + 0x1050]
fld qword [esi + 0x1070]
fcomp qword [0x5f56a0]
fnstsw ax
test ah, 0x41
jne 0x4a17a6
mov edx, dword [esi + 0x1030]
push 2
push ebx
push ebx
push edx
call fcn.0049d260
add esp, 0x10
mov edx, dword [esi + 0x1030]
push ebx
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a18c7
cmp edi, dword [esp + 0xc]
jne 0x4a18c7
mov eax, dword [esi + 0x1050]
mov ecx, dword [esi + 0x1054]
push esi
mov dword [esi + 0x1058], eax
mov dword [esi + 0x105c], ecx
call fcn.0049f220
push esi
call fcn.004a0f80
add esp, 8
test eax, eax
je 0x4a18dd
mov eax, dword [0x6696c8]
cmp eax, ebx
je 0x4a18dd
cmp eax, esi
je 0x4a1828
mov eax, dword [eax + 0x1128]
cmp eax, ebx
jne 0x4a1811
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
fld qword [esi + 0x1068]
fcomp qword [0x5f56a0]
fnstsw ax
test ah, 1
jne 0x4a184e
fld qword [esi + 0x1050]
fcomp qword [esi + 0x1068]
fnstsw ax
test ah, 1
je 0x4a1897
cmp dword [0x6696cc], ebx
je 0x4a16d7
cmp dword [esi + 0x10d0], 0x7d000
jl 0x4a16d7
mov edx, dword [esi + 0x1030]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esi + 0x10d0], ebx
jmp 0x4a16d7
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4a18dd
push ebx
push 0xb67
jmp 0x4a18cd
mov eax, dword [esi + 0x1068]
mov ecx, dword [esi + 0x106c]
mov dword [esi + 0x1050], eax
mov dword [esi + 0x1054], ecx
push 0x5f4c90
push ebx
push esi
call fcn.0049fd30
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0xb65
call fcn.00424130
push eax
push ebx
push esi
call fcn.0049fd30
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a29e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1068
call fcn.005d9990
mov edx, dword [esp + 0x106c]
mov al, byte [edx]
push esi
xor esi, esi
test al, al
push edi
lea ecx, [esp + 8]
je 0x4a2a0b
nop
inc edx
mov byte [ecx], al
mov al, byte [edx]
inc ecx
inc esi
test al, al
jne 0x4a2a00
test esi, esi
mov byte [ecx], 0
lea edi, [esp + 8]
ja 0x4a2a21
pop edi
xor eax, eax
pop esi
add esp, 0x1068
ret
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
mov cl, byte [esp + 8]
xor eax, eax
test cl, cl
je 0x4a2a47
movzx ecx, cl
xor ecx, eax
shl ecx, 1
inc edi
mov eax, ecx
mov cl, byte [edi]
test cl, cl
jne 0x4a2a37
pop edi
pop esi
add esp, 0x1068
ret
Function at 0x4a8aa0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ecx
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
cmp edi, dword [0x66982c]
je 0x4a8b0b
push ebx
xor eax, eax
mov bl, 0x20
push esi
mov esi, dword [sym.imp.USER32.dll_VkKeyScanA]
mov dword [0x669828], eax
mov byte [esp + 0xc], bl
lea esp, [esp]
test bl, bl
je 0x4a8b00
test eax, eax
jne 0x4a8b00
mov eax, dword [esp + 0xc]
push eax
call esi
cmp ah, 6
jne 0x4a8af0
mov eax, 1
mov dword [0x669828], eax
jmp 0x4a8af5
mov eax, dword [0x669828]
inc bl
cmp bl, 0xff
mov byte [esp + 0xc], bl
jbe 0x4a8ad0
pop esi
pop ebx
mov dword [0x66982c], edi
pop edi
pop ecx
ret
mov eax, dword [0x669828]
pop edi
pop ecx
ret
Function at 0x4ae590
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword [0x66ada8]
test eax, eax
je 0x4ae5cd
mov eax, dword [0x61a1c8]
test eax, eax
je 0x4ae5b0
push 0
call fcn.0050b5e0
add esp, 4
test eax, eax
je 0x4ae5cd
mov eax, dword [esp + 4]
push 0
push eax
push 0x66adb0
call fcn.00517290
add esp, 0xc
test eax, eax
jne 0x4ae5da
mov dword [0x66ada8], eax
mov dword [esp + 4], 0
jmp fcn.004ae500
cmp dword [0x61a1d0], 0xffffffff
jne 0x4ae647
push 0
push 1
push 2
mov dword [0x61a1d4], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x61a1d0], eax
je 0x4ae5cd
xor ecx, ecx
mov cx, word [0x61a1cc]
push ecx
push eax
call fcn.0052f7d0
add esp, 8
test eax, eax
je 0x4ae5cd
mov edx, dword [0x61a1d0]
push 5
push edx
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
jne 0x4ae5cd
mov eax, dword [0x6a0f40]
mov ecx, dword [0x61a1d0]
push 8
push 0x802a
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x4ae650
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x61a1d4]
sub esp, 0x57c
cmp eax, 0xffffffff
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
push esi
jne 0x4ae740
mov eax, dword [0x6a0f40]
mov ecx, dword [0x61a1d0]
push 0
push 0
push eax
push ecx
call ebp
mov ecx, dword [0x61a1d0]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
cmp eax, 0xffffffff
mov dword [0x61a1d4], eax
je 0x4ae740
lea edx, [esp + 0x1c]
push 0x132
push edx
call fcn.004232e0
mov eax, dword [esp + 0x10]
add esp, 8
test eax, eax
mov dword [0x61a1d8], 0xffffffff
je 0x4ae70f
cmp eax, 6
jl 0x4ae70f
movzx eax, byte [esp + 0x13]
movzx ecx, byte [esp + 0x12]
movzx edx, byte [esp + 0x11]
push eax
movzx eax, byte [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push str._d._d._d._d
push ecx
call fcn.005d9929
add esp, 0x18
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [0x61a1d8], eax
push 1
call fcn.0050b5e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4ae7cf
mov eax, dword [0x61a1c8]
test eax, eax
jne 0x4ae74a
call fcn.00508b70
mov esi, eax
test esi, esi
jne 0x4ae7d9
mov eax, dword [0x61a1d4]
mov ecx, dword [0x61a1c8]
test ecx, ecx
je 0x4ae76f
push 0
call fcn.0050b5e0
add esp, 4
test eax, eax
jne 0x4ae76a
push eax
call fcn.004ae500
add esp, 4
pop esi
pop ebp
add esp, 0x57c
ret
mov eax, dword [0x61a1d4]
cmp eax, 0xffffffff
je 0x4ae793
push 1
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov eax, dword [0x61a1d4]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [0x61a1d4], 0xffffffff
mov eax, dword [0x61a1d0]
cmp eax, 0xffffffff
mov dword [0x66b01c], 0
mov dword [0x61a1d8], 0xffffffff
je 0x4ae884
mov ecx, dword [0x6a0f40]
push 8
push 0x802a
push ecx
push eax
call ebp
pop esi
pop ebp
add esp, 0x57c
ret
mov dword [esi + 0x14b4], 2
mov eax, dword [0x61a1c4]
test eax, eax
je 0x4ae85a
mov edx, dword [0x63ca9c]
mov eax, dword [esi]
push edx
push eax
call fcn.0052dc60
mov al, byte [esp + 0x24]
add esp, 8
test al, al
je 0x4ae839
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0xc1d
call fcn.00424130
add esp, 8
push eax
lea edx, [esp + 0x158]
push edx
call fcn.005d9929
mov eax, dword [0x63caac]
mov edx, dword [esi]
push eax
lea ecx, [esp + 0x160]
push ecx
push edx
call fcn.0052ddc0
add esp, 0x18
jmp 0x4ae85a
mov eax, dword [0x63caac]
push eax
push 0
push 0xc1e
call fcn.00424130
mov ecx, dword [esi]
add esp, 8
push eax
push ecx
call fcn.0052ddc0
add esp, 0xc
mov edx, dword [0x6a0f40]
mov eax, dword [0x61a1d4]
push 0x21
push 0x802b
push edx
push eax
mov dword [0x66b01c], 0x1e
mov dword [0x66b020], 0
call ebp
pop esi
pop ebp
add esp, 0x57c
ret
Function at 0x4c0c20
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4c0c4f
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
push 1
push eax
mov eax, dword [edx]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push eax
push ecx
call fcn.0051c6f0
add esp, 0x18
pop ebx
ret
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x4c0d9d
cmp dword [eax + 0x1c], 1
je 0x4c0c67
mov eax, 1
pop ebx
ret
mov ecx, dword [eax + 0xc]
test ecx, ecx
push esi
jne 0x4c0d6c
mov edx, dword [eax]
movzx eax, byte [edx]
push eax
call fcn.005daff5
add esp, 4
test eax, eax
je 0x4c0d6c
mov ecx, dword [ebx + 0x40]
mov esi, dword [ecx]
mov al, byte [esi]
test al, al
je 0x4c0cf9
push edi
cmp al, 0x30
mov edi, esi
jne 0x4c0cd7
jmp 0x4c0ca0
movzx edx, byte [edi + 1]
push edx
call fcn.005daff5
add esp, 4
test eax, eax
je 0x4c0cb9
mov al, byte [edi + 1]
inc edi
cmp al, 0x30
je 0x4c0ca0
cmp edi, esi
je 0x4c0cd7
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c0cc2
sub eax, edx
inc eax
push eax
push edi
push esi
call fcn.005daa60
add esp, 0xc
mov al, byte [esi]
test al, al
je 0x4c0cec
lea ecx, [ecx]
cmp al, 0x2e
je 0x4c0cf1
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4c0ce0
cmp byte [esi], 0x2e
jne 0x4c0cf2
inc esi
mov al, byte [esi]
test al, al
jne 0x4c0c95
pop edi
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax]
push 0x2e
push ecx
call fcn.005d9b20
mov edx, dword [ebx + 0x40]
add esp, 8
test eax, eax
mov eax, dword [edx]
je 0x4c0d53
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c0d37
mov ecx, dword [ebx + 0x40]
mov edx, dword [ecx]
push str.255.255.255.255
push edx
call fcn.005f1860
add esp, 8
test eax, eax
jne 0x4c0d6c
push esi
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
mov eax, dword [esp + 0x1c]
push 0x5f4a20
push eax
call fcn.005d9929
add esp, 0xc
jmp 0x4c0d6c
mov ecx, dword [esp + 0x18]
push 0
push ecx
push eax
call fcn.005da144
push ecx
fstp qword [esp]
call fcn.00423590
add esp, 0x10
mov eax, dword [ebx + 8]
test eax, eax
jle 0x4c0d95
mov esi, dword [esp + 0x10]
mov ecx, dword [ebx + 0x40]
mov edx, dword [esi]
push ecx
push edx
call fcn.004e8a00
mov dword [esi], eax
mov ecx, dword [ebx + 8]
add esp, 8
dec ecx
mov eax, ecx
test eax, eax
mov dword [ebx + 8], ecx
jg 0x4c0d77
mov dword [ebx + 8], 0
pop esi
mov eax, 2
pop ebx
ret
Function at 0x4cdd00
Capabilities:
Get common file path

Disassembly:
push ebx
mov bl, byte [esp + 0xc]
test bl, 1
push esi
mov esi, dword [esp + 0xc]
push edi
mov byte [esi], 0
je 0x4cdd1c
lea eax, [esp + 0x10]
push eax
push 0x1a
jmp 0x4cdd2c
test bl, 2
je 0x4cddaa
lea ecx, [esp + 0x10]
push ecx
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x4cddaa
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4cddaa
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov edx, dword [esp + 0x10]
push edx
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jl 0x4cddaa
push esi
call fcn.00423370
push 2
push esi
call fcn.00424420
add esp, 0xc
test eax, eax
je 0x4cddaa
push esi
call fcn.004256e0
add esp, 4
test bl, 4
je 0x4cdda1
mov edi, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4cdd80
mov eax, dword [0x5f48c0]
mov dword [edi], eax
mov cl, byte [0x5f48c4]
push esi
mov byte [edi + 4], cl
call fcn.004256e0
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x4cde60
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4cde94
cmp byte [esi], 0
je 0x4cde94
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4cde94
test al, 0x50
jne 0x4cde94
test ah, 0x11
jne 0x4cde94
mov ecx, eax
and ecx, 0xfffffff8
cmp ecx, eax
je 0x4cde94
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret
Function at 0x4cf010
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, 0x136c
call fcn.005d9990
push 0x432
push 0x66c330
call fcn.004232e0
push 0x432
push 0x66c768
call fcn.004232e0
push 0x432
push 0x66cba0
call fcn.004232e0
lea eax, [esp + 0x31c]
push 0x1068
push eax
mov dword [0x66cfd4], 0
mov dword [0x66cfd8], 0
mov dword [0x66cfdc], 0
call fcn.004232e0
lea ecx, [esp + 0x324]
push ecx
push 0
call fcn.00439390
add esp, 0x28
test eax, eax
lea edx, [esp + 0x304]
je 0x4cf0d2
push edx
call fcn.004256e0
lea eax, [esp + 0x308]
push eax
push 0x66c330
call fcn.005d9929
lea ecx, [esp + 0x310]
push ecx
push str._smirc.ini
push 0x66c768
call fcn.005d9929
add esp, 0x18
mov eax, 1
add esp, 0x136c
ret
push 0x1068
push edx
call fcn.004232e0
mov ecx, dword [0x6a0f3c]
add esp, 8
push 0x400
lea eax, [esp + 0x308]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4cf208
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0x208]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x314]
push eax
call fcn.005da53c
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x5f4a5c
push 0x66c330
call fcn.005d9929
push 0x66c330
call fcn.004256e0
push 0x66c330
push str._smirc.ini
push 0x66c768
call fcn.005d9929
lea eax, [esp + 0x338]
push 0x1068
push eax
call fcn.004232e0
lea ecx, [esp + 0x340]
push 5
push ecx
call fcn.004cdd00
add esp, 0x44
test eax, eax
je 0x4cf1af
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x304]
mov byte [eax + 0x66cba0], cl
inc eax
test cl, cl
jne 0x4cf190
push 0x66cba0
call fcn.004256e0
add esp, 4
call fcn.004236f0
push eax
push 0x66c330
lea edx, [esp + 0x30c]
push 0x5f4a5c
push edx
call fcn.005d9929
add esp, 0x10
push 0
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4cf1ff
lea ecx, [esp + 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x4cf1ff
mov dword [0x66cfdc], 1
call fcn.0058d390
test eax, eax
jne 0x4cf211
xor eax, eax
add esp, 0x136c
ret
mov eax, dword [0x66cfdc]
test eax, eax
je 0x4cf22d
push 1
push 0x66c768
call fcn.00424420
add esp, 8
test eax, eax
jne 0x4cf241
mov dword [0x66cfd4], 1
mov dword [0x66cfd8], 1
mov eax, 1
add esp, 0x136c
ret
Function at 0x4cf250
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x1298
call fcn.005d9990
mov al, byte [0x66cba0]
test al, al
je 0x4cf305
mov eax, dword [0x66cfd4]
test eax, eax
jne 0x4cf27d
mov eax, dword [0x66cfd8]
test eax, eax
je 0x4cf305
push 0x66cba0
lea eax, [esp + 0x234]
push 0x1068
push eax
call fcn.00425550
lea ecx, [esp + 0x23c]
push ecx
call fcn.00426100
add esp, 0x10
test eax, eax
je 0x4cf305
lea edx, [esp + 0x230]
push edx
call fcn.004256e0
mov eax, dword [0x66cfd4]
add esp, 4
test eax, eax
je 0x4cf2e2
xor eax, eax
jmp 0x4cf2d0
mov cl, byte [esp + eax + 0x230]
mov byte [eax + 0x66c330], cl
inc eax
test cl, cl
jne 0x4cf2d0
mov eax, dword [0x66cfd8]
test eax, eax
je 0x4cf305
lea eax, [esp + 0x230]
push eax
push str._smirc.ini
push 0x66c768
call fcn.005d9929
add esp, 0xc
push 1
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x5f59c4
push 0x66c330
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00425e00
mov eax, dword [esp + 0x18]
add esp, 0x18
test eax, eax
jne 0x4cf436
mov eax, dword [esp + 4]
test eax, eax
jne 0x4cf436
mov eax, dword [str.defaults]
mov ecx, dword [0x5fa860]
mov dl, byte [0x5fa864]
mov dword [esp + 0x230], eax
lea eax, [esp + 0x230]
push eax
mov dword [esp + 0x238], ecx
mov byte [esp + 0x23c], dl
call fcn.00422040
lea ecx, [esp + 0x234]
push ecx
call fcn.004256e0
lea edx, [esp + 0x238]
push 2
push edx
call fcn.00424420
add esp, 0x10
test eax, eax
je 0x4cf44d
push edi
xor eax, eax
mov ecx, 7
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x130]
push 0x104
push eax
call fcn.004232e0
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x13c]
push str._s.
push edx
call fcn.005d9929
lea ecx, [esp + 0x40]
lea eax, [esp + 0x144]
push 0x104
push ecx
mov dword [esp + 0x30], eax
call fcn.004232e0
add esp, 0x1c
xor eax, eax
pop edi
mov cl, byte [eax + 0x66c330]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x4cf403
lea eax, [esp + 8]
lea edx, [esp + 0x28]
push eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 2
mov word [esp + 0x1c], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x4cf44d
lea ecx, [esp]
push ecx
call fcn.004e8c50
lea edx, [esp + 8]
push edx
call fcn.004e8c50
add esp, 8
mov al, byte [0x66c768]
test al, al
je 0x4cf484
push 0x66c768
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4cf484
test al, 0x50
jne 0x4cf484
test ah, 0x11
jne 0x4cf484
mov ecx, eax
and ecx, 0xfffffff8
cmp ecx, eax
je 0x4cf484
push ecx
push 0x66c768
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
add esp, 0x1298
ret