joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4877fd
Capabilities:
Create directory

Disassembly:
mov eax, 0x67421a
call fcn.0062921c
sub esp, 0x20
push ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.0047e8bf
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], ebx
jae 0x487825
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00423207
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x771bbc
call fcn.00425c17
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004832bd
push 0x7719d4
call fcn.00489133
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f261
Capabilities:
Get disk information

Disassembly:
mov eax, 0x67474d
call fcn.0062921c
sub esp, 0x174
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
add esi, 4
xor ebx, ebx
mov edi, esi
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48f291
mov byte [eax], bl
push 0x69827c
push 0x6a2e78
call fcn.0045f0a1
mov ecx, eax
or eax, 0xffffffff
test ecx, ecx
je 0x48f2c2
lea eax, [ebp - 0x24]
push eax
call ecx
test eax, eax
jne 0x48f2c2
mov eax, dword [ebp - 0x1a]
mov dword [esi], eax
mov ax, word [ebp - 0x16]
mov word [esi + 4], ax
jmp 0x48f2cf
push eax
push str.Cant_create_UUID____d
call fcn.004771df
pop ecx
pop ecx
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push ebx
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0xa]
push eax
push ebx
push ebx
push 0x6a2e9c
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
lea ecx, [ebp - 0x180]
call fcn.004651cd
push 0xe
push esi
lea ecx, [ebp - 0x180]
mov dword [ebp - 4], ebx
call fcn.00465169
lea ecx, [ebp - 0x10c]
mov esi, eax
call fcn.004651cd
push 0xa
push esi
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 1
call fcn.00465169
mov edi, dword [ebp - 0x10]
cmp edi, eax
je 0x48f339
push 5
pop ecx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x98]
call fcn.004651cd
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x98]
push 4
push eax
mov byte [ebp - 4], 2
call fcn.00465169
mov ecx, dword [ebx + eax]
add dword [edi + ebx], ecx
add ebx, 4
cmp ebx, 0x14
jne 0x48f359
lea ecx, [ebp - 0x98]
call fcn.00409944
lea ecx, [ebp - 0x10c]
call fcn.00409944
lea ecx, [ebp - 0x180]
call fcn.00409944
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x495213
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push 0x6c078965
push dword [esp + 0xc]
or dword [esi + 0x1384], 0xffffffff
call fcn.004b4bf7
mov eax, esi
pop esi
ret 4
Function at 0x495921
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x674a97
call fcn.0062921c
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.00423207
and dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00423207
mov eax, dword [esi + 0x30]
lea ecx, [edi + 0x5c]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov al, byte [esi + 0x58]
mov byte [edi + 0x58], al
mov al, byte [esi + 0x59]
mov byte [edi + 0x59], al
mov al, byte [esi + 0x5a]
mov byte [edi + 0x5a], al
lea eax, [esi + 0x5c]
push eax
mov byte [ebp - 4], 1
call fcn.00423207
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov al, byte [edi + 0x88]
xor al, byte [esi + 0x88]
and al, 1
mov byte [ebp - 4], 2
xor byte [edi + 0x88], al
mov al, byte [edi + 0x88]
mov cl, byte [esi + 0x88]
xor cl, al
and cl, 2
xor cl, al
mov byte [edi + 0x88], cl
mov al, byte [esi + 0x88]
xor al, cl
and al, 4
xor al, cl
mov byte [edi + 0x88], al
mov cl, byte [esi + 0x88]
xor cl, al
and cl, 8
xor cl, al
mov byte [edi + 0x88], cl
mov al, byte [esi + 0x88]
xor al, cl
and al, 0x10
xor al, cl
mov byte [edi + 0x88], al
lea ecx, [edi + 0xa0]
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
lea eax, [esi + 0xa0]
push eax
call fcn.0040ab3b
lea eax, [esi + 0xb8]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0xb8]
call fcn.0040ab3b
mov al, byte [esi + 0xd0]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0xd0], al
mov eax, dword [esi + 0xd4]
mov dword [edi + 0xd4], eax
mov eax, dword [esi + 0xd8]
mov dword [edi + 0xd8], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x49edcf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.0049ea37
push eax
push esi
push dword [ebp + 8]
call fcn.0049e9ec
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0049ea37
push eax
push esi
push dword [ebp + 8]
call fcn.0049e9ec
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0049ea37
push eax
push esi
push dword [ebp + 8]
call fcn.0049e9ec
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0049ea27
jnp 0x49ef14
cmc
mov cl, byte [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x49f92f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0049ea05
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0049ea37
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0049e9ec
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0049ea27
inc dword [ecx]
rcr byte [edi], 0xc6

Function at 0x49fe92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
invalid
movsd dword es:[edi], dword [esi]
xlatb
clc
Function at 0x4af94c
Capabilities:
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x28
push esi
push 0x80
push 5
push dword [esp + 0x38]
mov esi, ecx
call fcn.0045c90d
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x4af972
xor al, al
jmp 0x4afa9c
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.0045c8d3
test eax, eax
je 0x4af98d
lea eax, [esp + 8]
push eax
call fcn.0045c89d
jmp 0x4af96b
push ebp
push edi
push dword [esp + 0x18]
mov ecx, esi
push dword [esp + 0x18]
call fcn.004aef49
mov eax, dword [esi + 0x238]
xor ebp, ebp
sub eax, dword [esi + 0x234]
mov edi, ebp
sar eax, 3
test eax, eax
je 0x4af9d1
push edi
mov ecx, esi
call fcn.004ac2c1
mov eax, dword [esi + 0x238]
inc edi
sub eax, dword [esi + 0x234]
sar eax, 3
cmp edi, eax
jb 0x4af9b5
mov ecx, dword [esi + 0x6dc]
mov eax, dword [esi + 0x6e0]
add ecx, 0x3fff
adc eax, ebp
shrd ecx, eax, 0xe
shr eax, 0xe
lea eax, [esp + 0x10]
mov dword [esi + 0xf0], ecx
push eax
call fcn.0045c89d
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.004a0e33
cmp dword [eax + 0x14], 8
jb 0x4afa10
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebp
push 1
lea ecx, [esp + 0x28]
call fcn.0042386b
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.004a0e33
cmp byte [esp + 0x40], 0
je 0x4afa4c
cmp dword [eax + 0x14], 8
jb 0x4afa3f
mov eax, dword [eax]
push eax
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x4afa61
cmp dword [eax + 0x14], 8
jb 0x4afa54
mov eax, dword [eax]
push 1
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ebx, eax
lea ecx, [esp + 0x20]
push ebp
neg ebx
push 1
sbb bl, bl
call fcn.0042386b
add bl, 1
je 0x4afa7c
xor al, al
jmp 0x4afa99
mov ecx, esi
mov byte [esp + 0x13], 1
call fcn.0049fb44
lea ecx, [esp + 0x13]
push dword [eax + 0x20]
push ecx
mov ecx, eax
call fcn.004fadd8
mov al, 1
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x28
ret 8

Function at 0x4b1f6a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
mov ebp, SysReAllocString
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, ebp
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x4b1f80
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, ebp
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x4b1fbc
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, ebp
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebp
pop ebx
ret
Function at 0x4b2025
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4b202e
pop esi
ret

Function at 0x4b4bf7
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [esp + 0x14]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x4b4c0c
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
ret 8

Function at 0x4b5959
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [0x771002], 0
je 0x4b59ff
push dword [ebp + 8]
lea eax, [ebp - 0x30]
push 0x6a53d8
push eax
call fcn.004607f4
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4b5988
mov eax, dword [eax]
push esi
push eax
call fcn.00643980
pop ecx
xor esi, esi
lea ecx, [ebp - 0x30]
push esi
push 1
call fcn.0042386b
push dword [ebp + 8]
lea eax, [ebp - 0x30]
push str.TEMP_s
push eax
call fcn.004607f4
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4b59b9
mov eax, dword [eax]
push eax
call fcn.00643980
pop ecx
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.0042386b
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x6a53f8
push eax
call fcn.004607f4
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp dword [ebp - 4], 8
jae 0x4b59eb
lea eax, [ebp - 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push esi
push 1
lea ecx, [ebp - 0x18]
call fcn.0042386b
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4be666
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
lea ecx, [esp + 4]
mov dword [0x773954], eax
push ecx
push esi
push eax
push 0x4be190
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ecx
ret
Function at 0x4bf244
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x676940
call fcn.0062921c
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 8], 0x6a6520
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
mov dword [esi], 0x6a6540
mov dword [esi + 8], 0x6a655c
mov dword [esi + 0xc], ebx
call fcn.004c3f2d
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov byte [esi + 0x54], bl
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], 0xf
mov byte [esi + 0x58], bl
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4c5430
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x676edb
call fcn.0062921c
sub esp, 0x2c
push ebx
push edi
xor edx, edx
mov byte [ebp - 0x38], 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
mov bl, dl
push 0x10
pop edi
mov byte [ebp - 4], 1
cmp dword [ebp + 0x1c], edi
jae 0x4c5471
lea eax, [ebp + 8]
push edx
lea ecx, [ebp - 0x18]
push ecx
push edx
push edx
push edi
push eax
call sub.DNSAPI.dll_DnsQuery_UTF8
test eax, eax
jne 0x4c54f1
push esi
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4c54e4
cmp word [esi + 8], di
jne 0x4c54de
xor edi, edi
test bl, bl
jne 0x4c54db
lea eax, [esi + 0x1c]
mov dword [ebp - 0x14], eax
cmp edi, dword [esi + 0x18]
jae 0x4c54db
mov edx, dword [eax]
push edx
push str.DEBUG:_Processing_TXT:__s_n
call fcn.00409944
mov ecx, edx
add esp, 8
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c54b7
lea eax, [ebp - 0x38]
sub ecx, ebx
push eax
push ecx
push edx
call fcn.004d2e3d
mov bl, al
inc edi
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
test bl, bl
je 0x4c549d
push 0x10
pop edi
mov esi, dword [esi]
test bl, bl
je 0x4c5487
push 1
push dword [ebp - 0x18]
call sub.DNSAPI.dll_DnsFree
pop esi
jmp 0x4c54fb
cmp eax, 0x251d
je 0x4c5522
mov dword [ebp - 0x1c], eax
test bl, bl
je 0x4c5522
mov byte [ebp - 0xd], 1
call fcn.00472fb7
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 8]
push eax
call fcn.004d435c
mov byte [ebp - 4], 3
call fcn.00472ff8
lea ecx, [ebp - 0x28]
call fcn.005507c8
lea ecx, [ebp - 0x34]
call fcn.005507c8
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040abbf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4c67d4
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
push 0x2cc
mov dword [ebp - 8], edi
call fcn.0045b411
mov ebx, eax
push 0x6a5fcc
push 0x68e74c
mov dword [ebp - 4], ebx
mov dword [ebx], 0x10007
call fcn.0045f0a1
test eax, eax
je 0x4c684c
push esi
push dword [ebp + 8]
push edi
push 0x1f03ff
call eax
mov esi, eax
test esi, esi
je 0x4c684b
push esi
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
cmp eax, 0xffffffff
je 0x4c683d
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
test eax, eax
je 0x4c683d
lea eax, [ebp - 8]
push eax
call fcn.004c6472
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4cabd8
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x677393
call fcn.0062921c
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x94], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa0], ebx
and byte [esi + 0xc0], 0xf8
lea edi, [esi + 0x64]
push 0xa
pop ecx
xor eax, eax
mov byte [ebp - 4], 1
push 0x58
rep stosd dword es:[edi], eax
lea eax, [esi + 4]
push ebx
push eax
call fcn.0062e010
push 4
mov dword [esi + 0xac], 0x186a0
call fcn.006291e1
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 2
test edi, edi
je 0x4cac80
push 0x4cad17
push 0x4cad2a
push 0xf
push 0x20
push 0x18
push 0x4f
call fcn.0052dbcf
mov dword [edi], eax
jmp 0x4cac82
mov edi, ebx
mov ecx, dword [ebp - 0xc]
mov eax, 0x100000
mov dword [esi + 0xa8], edi
mov dword [esi + 0x28], 0x52e2e0
mov dword [esi + 0x2c], 0x52e300
mov dword [esi + 0x30], 0x52e2cc
mov dword [esi + 0x34], 0x52e26a
mov dword [esi + 0x38], 0x52e2d7
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov eax, esi
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4d8d32
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, ebp
push edi
lea edi, [ebx + 0xac]
push edi
call fcn.004c3f61
xor edx, edx
test al, al
je 0x4d8d59
cmp word [ebp + 0x10], dx
jne 0x4d8e5e
cmp dword [ebx + 4], 0xffffffff
push esi
push 5
pop ecx
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
je 0x4d8d71
push edx
mov ecx, ebx
call fcn.00473762
xor edx, edx
push edx
push edx
push 2
lea eax, [ebx + 0xac]
push eax
call fcn.00461474
movzx eax, al
mov ecx, ebx
neg eax
sbb eax, eax
and eax, 0xffffffeb
add eax, 0x17
push eax
call fcn.00474d8c
cmp dword [ebx + 4], 0xffffffff
je 0x4d8e5d
push ebp
mov ecx, ebx
call fcn.00473312
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x4d8dcf
call edi
mov esi, eax
push esi
call fcn.0047188e
push eax
push esi
push ebp
push str.UDP_port_bind_failed__A:___d___s
call fcn.00477256
add esp, 0x10
jmp 0x4d8de5
xor eax, eax
cmp word [ebp + 0x10], ax
jne 0x4d8de5
mov ecx, ebx
call fcn.00474b05
mov word [ebx + 0xbc], ax
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x14]
push 4
push eax
push 0x1002
push 0xffff
push dword [ebx + 4]
mov ebp, 0x200000
mov dword [esp + 0x28], ebp
call esi
cmp eax, 0xffffffff
jne 0x4d8e23
call edi
push eax
push dword [esp + 0x18]
push str.UDP_setsockopt_SO_RCVBUF___d__failed:__d
call fcn.004771df
add esp, 0xc
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebp
push eax
push 0x1001
push 0xffff
push dword [ebx + 4]
call esi
cmp eax, 0xffffffff
jne 0x4d8e56
call edi
push eax
push dword [esp + 0x18]
push str.UDP_setsockopt_SO_SNDBUF___d__failed:__d
call fcn.004771df
add esp, 0xc
mov ecx, ebx
call fcn.00474500
pop esi
pop edi
pop ebp
pop ebx
ret 4

Function at 0x4d9209
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x98]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4d925c
push esi
push edi
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.004c3e73
mov edi, dword [ebp + 0x18]
lea esi, [ebp - 0x18]
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d9619
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1bc]
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], ebx
movzx eax, word [esi + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c0]
movzx ebp, ax
test ecx, ecx
je 0x4d967b
mov ebx, ecx
mov byte [esp + 0x27], 3
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4d9656
sub ebx, edx
lea eax, [esp + 0x29]
push ebx
push ecx
push eax
mov byte [esp + 0x34], bl
call fcn.0062bfc0
add esp, 0xc
mov word [esp + ebx + 0x29], bp
xor ebx, ebx
jmp 0x4d96ac
push esi
call fcn.00461474
test al, al
je 0x4d9698
mov eax, dword [esi + 0xc]
mov byte [esp + 0x27], 1
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], bp
jmp 0x4d96ac
push edi
mov byte [esp + 0x2b], 4
lea edi, [esp + 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [esp + 0x3c], bp
pop edi
lea eax, [esp + 0x24]
mov ecx, eax
mov dword [esp + 0x18], eax
call fcn.004d974f
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
add ecx, 0x118
mov eax, dword [esp + 0x1b8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1b4]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.00474a16
push ebx
push ebx
push dword [esp + 0x18]
lea eax, [esp + 0x138]
mov dword [esp + 0x18], ebx
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 2
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1d0]
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov esi, eax
test esi, esi
jne 0x4d9727
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
cmp esi, eax
je 0x4d9743
lea ecx, [esp + 0x24]
call fcn.004d974f
cmp esi, eax
jg 0x4d973f
xor eax, eax
jmp 0x4d9743
sub esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1a0
ret 0x14

Function at 0x4d9917
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp byte [0x774678], 0
je 0x4d992d
mov al, 1
jmp 0x4d9965
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4d9963
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x4d995d
shr eax, 8
cmp al, 2
jne 0x4d995d
mov byte [0x774678], 1
jmp 0x4d9929
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
mov esp, ebp
pop ebp
ret