joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a01f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fc390
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x70b744]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ecx]
xor edx, edx
push 1
push 0x70fa0c
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
mov edx, dword [esi + 0x80]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0051d721
mov esp, ebp
pop ebp
ret 8

Function at 0x4a0680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fc360
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x70b744]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x70fa0c
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x20], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0051d721
mov esp, ebp
pop ebp
ret 8

Function at 0x4a0c40
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x5fb648
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
call fcn.004a0ef0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov eax, dword [eax]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4a0cc5
push 0xe
push 0x6b28e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.00410a89
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x5c], 0
call fcn.004a09f0
push 0x6de224
lea edx, [esp + 0x24]
push edx
call fcn.0052365b
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x54
ret 8
Function at 0x4a0d30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5fcc78
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x30]
push 0
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], esi
call fcn.0047e030
mov edi, eax
mov dword [esp + 0x18], edi
push esi
mov ecx, edi
mov dword [esp + 0x28], 0
call fcn.004a0ce0
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
add esp, 4
push esi
push edi
mov ecx, ebx
call edx
push esi
push 0
push edi
call fcn.00522720
push edi
call fcn.0051e45a
add esp, 0x10
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x4a2050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f69b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x32
push str.PK_Signer:_key_too_short_for_this_signature_scheme
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00410a89
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0047bb40
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::PK_SignatureScheme::InvalidKeyLength.0
jb 0x4a20c8
mov ecx, dword [esp + 8]
push ecx
call fcn.0051d492
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::PK_SignatureScheme::KeyTooShort.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret
Function at 0x4a7ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5fd8cb
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov si, cx
mov ebx, dword [esp + 0x90]
test si, si
mov dword [esp + 0x1c], 0
je 0x4a7ce4
movzx ebp, word [esp + 0x8c]
mov edi, dword [esp + 0x88]
mov eax, dword [edi]
push ebp
push ebx
mov dword [esp + 0x2c], eax
call fcn.004986f0
mov ecx, eax
movzx edx, si
mov eax, ebp
sub eax, ecx
imul eax, edx
xor edx, edx
div ebp
mov eax, dword [ebx + 8]
test eax, eax
mov ecx, dword [ebx + 0xc]
mov esi, edx
mov dword [esp + 0x20], esi
je 0x4a7b51
lea ecx, [ecx + eax*4 - 4]
cmp dword [ecx], 0
jne 0x4a7b51
sub eax, 1
sub ecx, 4
test eax, eax
jne 0x4a7b42
cmp eax, 1
ja 0x4a7be7
push ebp
lea ecx, [esp + 0x40]
call fcn.004960c0
mov dword [esp + 0x80], 0
mov edi, 1
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], edi
call fcn.004960c0
mov eax, dword [esp + 0x94]
mov dword [esp + 0x80], edi
lea edi, [esp + 0x28]
lea esi, [esp + 0x64]
mov dword [esp + 0x1c], 3
call fcn.0047f540
mov dword [esp + 0x80], 2
mov edi, ebx
lea esi, [esp + 0x50]
mov dword [esp + 0x1c], 7
call fcn.0047f500
lea edx, [esp + 0x3c]
mov ebx, 0xf
call fcn.0047f370
test al, al
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x88]
je 0x4a7beb
mov byte [esp + 0x1b], 1
jmp 0x4a7bf0
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x1b], 0
test bl, 8
je 0x4a7c01
lea ecx, [esp + 0x50]
and ebx, 0xfffffff7
call fcn.0047f330
test bl, 4
je 0x4a7c12
lea ecx, [esp + 0x64]
and ebx, 0xfffffffb
call fcn.0047f330
test bl, 2
je 0x4a7c23
lea ecx, [esp + 0x28]
and ebx, 0xfffffffd
call fcn.0047f330
test bl, 1
je 0x4a7c31
lea ecx, [esp + 0x3c]
call fcn.0047f330
cmp byte [esp + 0x1b], 0
je 0x4a7c3a
add esi, ebp
cmp esi, dword [esp + 0x24]
jae 0x4a7ce4
jmp 0x4a7c57
mov edi, dword [esp + 0x88]
mov ebx, dword [edi + 8]
cmp ebx, dword [edi + 0xc]
jbe 0x4a7c64
call fcn.0051e314
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0
mov dword [esp + 0x2c], edi
call fcn.00406f07
mov edi, dword [esp + 0x28]
test edi, edi
mov ebx, dword [esp + 0x2c]
jne 0x4a7c96
call fcn.0051e314
call fcn.0051e314
jmp 0x4a7c9a
test ebx, ebx
jne 0x4a7c9f
call fcn.0051e314
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
mov dword [esp + 0x20], eax
jbe 0x4a7cb4
call fcn.0051e314
mov eax, dword [esp + 0x20]
mov ecx, ebx
sub ecx, eax
sar ecx, 2
shl ecx, 5
add ecx, dword [esp + 0x30]
cmp ecx, dword [edi]
jb 0x4a7ccb
call fcn.0051e314
mov ecx, dword [esp + 0x30]
mov edx, 1
shl edx, cl
add esi, ebp
or dword [ebx], edx
cmp esi, dword [esp + 0x24]
jb 0x4a7c50
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x4b263f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x70b744]
mov dword [ebp - 4], eax
mov eax, dword [0x76abd8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4b266e
call eax
cmp eax, ebx
mov dword [ebp - 0x528], eax
jne 0x4b27fb
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x528], eax
je 0x4b27fb
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4b26a6
mov byte [ebp - 0x41c], bl
push esi
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4b26be
mov byte [ebp - 0x524], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x528]
call edi
test eax, eax
jne 0x4b26df
mov byte [ebp - 0x10c], bl
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
test eax, eax
pop edi
jne 0x4b26fc
mov byte [ebp - 0x214], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.004b25a2
lea eax, [ebp - 0x52c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4b271f
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x314]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4b2733
sub eax, esi
add eax, ecx
mov byte [ebp + eax - 0x213], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004b25a2
lea eax, [ebp - 0x52c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4b2768
sub eax, ecx
lea ecx, [ebp - 0x314]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4b277a
sub ecx, esi
add ecx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x524]
push eax
mov byte [ebp + ecx - 0x10b], bl
call fcn.004b24d3
test eax, eax
pop esi
jne 0x4b27bb
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.004b24d3
test eax, eax
jne 0x4b27e9
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.004b24d3
test eax, eax
jne 0x4b27fb
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.004b24d3
test eax, eax
je 0x4b27fb
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x528], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x528]
pop ebx
call fcn.0051d721
leave
ret
Function at 0x4b6bb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x70b744]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
cmp eax, 3
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
jne 0x4b6c3a
movzx eax, word [esi + 0x118]
test ax, ax
jne 0x4b6be6
test byte [esi + 0x230], 1
jne 0x4b6c0e
movzx cx, byte [edi]
cmp cx, ax
jbe 0x4b6c0e
push str.Invalid_background_palette_index
push esi
call fcn.004b81a0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0051d721
add esp, 0xc
ret
mov dl, byte [edi]
push 1
lea eax, [esp + 0xc]
push eax
push str.bKGD
push esi
mov byte [esp + 0x18], dl
call fcn.004b5d50
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0051d721
add esp, 0xc
ret
test al, 2
je 0x4b6cce
movzx ecx, word [edi + 2]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.004b4de0
movzx eax, word [edi + 4]
push eax
lea ecx, [esp + 0x16]
push ecx
call fcn.004b4de0
movzx edx, word [edi + 6]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.004b4de0
add esp, 0x18
cmp byte [esi + 0x127], 8
jne 0x4b6ca8
mov cl, byte [esp + 0xc]
or cl, byte [esp + 0xa]
or cl, byte [esp + 8]
je 0x4b6ca8
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push esi
call fcn.004b81a0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0051d721
add esp, 0xc
ret
push 6
lea edx, [esp + 0xc]
push edx
push str.bKGD
push esi
call fcn.004b5d50
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0051d721
add esp, 0xc
ret
mov cl, byte [esi + 0x127]
movzx eax, word [edi + 8]
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x4b6d02
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push esi
call fcn.004b81a0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0051d721
add esp, 0xc
ret
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004b4de0
push 2
lea ecx, [esp + 0x14]
push ecx
push str.bKGD
push esi
call fcn.004b5d50
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
pop esi
xor ecx, esp
call fcn.0051d721
add esp, 0xc
ret
Function at 0x4bde87
Capabilities:
Create http request

Disassembly:
push 0x30
mov eax, 0x5d0e66
call fcn.005234b0
mov esi, ecx
movsx eax, word [esi + 0x2a0]
xor edi, edi
sub eax, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
je 0x4bdef4
dec eax
je 0x4bdec7
dec eax
jne 0x4bded9
lea eax, [esi + 0x2a4]
cmp dword [eax], edi
je 0x4bdef4
cmp dword [eax + 4], edi
je 0x4bdef4
mov eax, dword [eax]
push 3
pop ebx
mov dword [ebp - 0x10], eax
jmp 0x4bdef7
movzx eax, word [esi + 0x2a2]
cmp ax, di
je 0x4bdef4
cmp ax, 1
jne 0x4bdedd
xor ebx, ebx
jmp 0x4bdef7
mov eax, dword [esi + 0x2a4]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x2c8]
push 3
pop ebx
mov dword [ebp - 0x14], eax
jmp 0x4bdef7
xor ebx, ebx
inc ebx
mov eax, dword [esi + 0x5e8]
cmp eax, edi
je 0x4bdf08
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Mozilla_4.0__compatible__MSIE_6.0__DynGate_
call fcn.00410b44
mov dword [ebp - 4], edi
lea eax, [ebp - 0x3c]
push eax
or dword [ebp - 4], 0xffffffff
call fcn.004ae022
add esp, 0x20
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x18], 8
jb 0x4bdf46
mov eax, dword [eax + 4]
jmp 0x4bdf49
add eax, 4
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x5e8], eax
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp - 0x3c]
call fcn.00410779
push 4
pop ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x49
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
mov dword [ebp - 0x18], 0x14
call edi
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x4a
push 0
call edi
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
push dword [esi + 0x5e8]
mov dword [ebp - 0x1c], 0x2328
mov dword [ebp - 0x20], 0x1d4c0
call edi
push ebx
lea eax, [ebp - 0x1c]
push eax
push 5
push dword [esi + 0x5e8]
call edi
push ebx
lea eax, [ebp - 0x20]
push eax
push 6
push dword [esi + 0x5e8]
call edi
mov byte [esi + 0x358], 0
call fcn.00523588
ret
Function at 0x4c1647
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 0x30
pop esi
push esi
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.00522720
mov edi, dword [0x71f744]
add esp, 0xc
push 0x40
pop ebx
lea ecx, [ebp - 0x34]
push ecx
mov dword [ebp - 0x34], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
push 0
push dword [esi + 8]
mov dword [ebp - 0x30], ebx
push eax
mov dword [ebp + 8], eax
call edi
test eax, eax
je 0x4c181e
cmp dword [ebp - 0xc], 0
jbe 0x4c1799
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
mov dword [ebp - 0x30], ebx
neg ecx
or ecx, eax
push ecx
call fcn.004fed14
pop ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push eax
xor ebx, ebx
push ebx
push dword [esi + 8]
push dword [ebp + 8]
call edi
test byte [esi + 0x10], 0x41
je 0x4c16e7
push dword [0x723970]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xf7a300
jmp 0x4c16fb
push dword [0x72396c]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xf17900
push 1
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
mov ebx, eax
test ebx, ebx
je 0x4c1714
push ebx
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
test byte [esi + 0x10], 0x84
je 0x4c1721
push 0xc0c0c0
jmp 0x4c1726
push 0xffffff
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [esi + 0x28]
lea edi, [esi + 0x1c]
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [edi]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_Rectangle]
add dword [edi], 0xe
add dword [esi + 0x20], 2
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
neg ax
sbb eax, eax
and eax, 0xfff00000
add eax, 0x100000
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [esi + 0x18]
call dword [0x71f718]
test ebx, ebx
je 0x4c178b
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 4]
call fcn.0051d89c
pop ecx
jmp 0x4c181e
push 0xf17900
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
test eax, eax
mov dword [ebp + 8], eax
je 0x4c17b9
push eax
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [sym.imp.GDI32.dll_MoveToEx]
push 0
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call edi
push dword [esi + 0x20]
mov ebx, dword [sym.imp.GDI32.dll_LineTo]
push dword [esi + 0x24]
push dword [esi + 0x18]
call ebx
push 6
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esi + 0x1c]
push 0
push dword [esi + 0x20]
add eax, 5
push eax
push dword [esi + 0x18]
call edi
push dword [esi + 0x20]
mov eax, dword [esi + 0x24]
sub eax, 5
push eax
push dword [esi + 0x18]
call ebx
cmp dword [ebp + 8], 0
je 0x4c181e
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c24f9
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x5d1c1c
call fcn.005234b0
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], esi
call fcn.0041214e
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
mov dword [ebp - 0x20], 1
je 0x4c2646
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
dec dword [ebp + 0x10]
mov byte [ebp + esi - 0x10], al
mov bl, byte [ebp - 0xf]
inc esi
inc edi
cmp esi, 3
jne 0x4c25a2
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor esi, esi
movzx eax, byte [ebp + esi - 0x14]
push eax
mov ecx, 0x723974
call fcn.004014bb
mov al, byte [eax]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.00410989
inc esi
cmp esi, 4
jl 0x4c2578
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x4c252e
xor edi, edi
cmp esi, edi
je 0x4c2646
cmp esi, 3
jge 0x4c25ce
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x10]
push edi
push eax
call fcn.00522720
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [esi + 1]
test ebx, ebx
mov byte [ebp - 0x11], al
jle 0x4c262e
movzx eax, byte [ebp + edi - 0x14]
push eax
mov ecx, 0x723974
call fcn.004014bb
mov al, byte [eax]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.00410989
inc edi
cmp edi, ebx
jl 0x4c2607
push 3
pop edi
cmp esi, edi
jge 0x4c2646
sub edi, esi
mov ecx, dword [ebp - 0x18]
push 0x3d
push 1
call fcn.00410989
dec edi
jne 0x4c2637
mov eax, dword [ebp - 0x18]
call fcn.00523588
ret
Function at 0x4c2940
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push 0x84
mov eax, 0x5d1d66
call fcn.00523519
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
sub esp, 0x24
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov ecx, esp
mov dword [ebp - 0x48], esp
push edi
mov dword [ebp - 0x40], eax
call fcn.004ac698
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], bl
call fcn.004ae117
mov dword [ebp - 4], 2
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00522720
mov eax, dword [ebp - 0x28]
add esp, 0x34
cmp dword [ebp - 0x14], 0x10
jae 0x4c299f
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0x38], eax
jne 0x4c2a43
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4c29be
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
jne 0x4c2a31
push ebx
push 0x675018
lea ecx, [ebp - 0x6c]
call fcn.004ac9bc
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x90]
call fcn.004ac698
mov byte [ebp - 4], 4
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x48], esp
push eax
lea eax, [ebp - 0x6c]
push eax
push ecx
call fcn.004adc57
add esp, 0xc
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
mov ecx, 0x721f18
call fcn.0041122b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x90]
call fcn.004ac66a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.004ac66a
jmp 0x4c2a3b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
je 0x4c2a6d
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x48], esp
push eax
call fcn.00410b44
mov byte [ebp - 4], 6
push dword [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004ae0cb
add esp, 0x20
jmp 0x4c2a75
mov ecx, dword [ebp - 0x40]
call fcn.004ac634
mov dword [ebp - 0x44], esi
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.004108b7
mov eax, dword [ebp - 0x40]
call fcn.0052359c
ret
Function at 0x4c3339
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x70b744]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 0x50
mov eax, 0x5d2087
call fcn.005234b0
mov edi, dword [ebp + 0x10c]
push 0xff
lea eax, [ebp]
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.WSOCK32.dll_gethostname]
lea eax, [ebp]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x4c338f
or eax, 0xffffffff
jmp 0x4c3455
lea ecx, [ebp - 0x38]
call fcn.004ac634
mov dword [ebp - 4], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [esi]
call fcn.00410b44
mov byte [ebp - 4], 1
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], bl
call fcn.004ae0cb
add esp, 0x20
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x38]
call fcn.004acaa2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5c]
call fcn.004ac66a
cmp byte [ebp + 0x110], bl
je 0x4c33e7
lea eax, [ebp - 0x38]
push eax
mov ecx, edi
call fcn.004ae468
mov eax, dword [esi + 0xc]
xor edi, edi
jmp 0x4c3439
mov eax, dword [eax]
mov eax, dword [eax]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00410b44
mov byte [ebp - 4], 3
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], bl
call fcn.004ae0cb
add esp, 0x20
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
push eax
call fcn.004ae468
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5c]
call fcn.004ac66a
mov eax, dword [esi + 0xc]
inc edi
lea eax, [eax + edi*4]
cmp dword [eax], ebx
ja 0x4c33ee
mov ecx, dword [ebp - 0x10]
call fcn.00436f6a
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004ac66a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.0051d721
add ebp, 0x104
leave
ret