joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8560
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4d857a
mov byte [esi + 8], 1
mov ecx, dword [esi + 4]
push 0
call fcn.0040a560
mov ecx, dword [ebp + 8]
xor eax, eax
mov esi, dword [esi + 4]
test ecx, ecx
je 0x4d85b6
mov dword [ebp + 8], eax
cmp byte [esi + 0x58], al
jne 0x4d85b6
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x4d85b6
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp + 8]
add dword [esi + 0x50], eax
adc dword [esi + 0x54], 0
test eax, eax
jne 0x4d85b6
mov byte [esi + 0x58], 1
pop esi
pop ebp
ret 8

Function at 0x4d85c0
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4d85dd
mov byte [esi + 8], 1
mov ecx, dword [esi + 4]
push 0
call fcn.0040a560
mov eax, dword [esi + 4]
pop esi
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x4d8622
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4d8622
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
or edx, eax
mov esp, ebp
pop ebp
ret

Function at 0x4dd2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dde4c
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x41c], esi
xor eax, eax
mov dword [ebp - 0x41c], esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x418]
push eax
push 0x204
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x41c]
call fcn.00410740
add esp, 4
lea edx, [ebp - 0x41c]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004fe8e0
mov edx, dword [ebp - 0x41c]
add edx, 0xfffffff8
mov eax, dword [edx]
test eax, 0x30000000
jne 0x4dd364
or ecx, 0xffffffff
lock xadd dword [edx], ecx
test ecx, ecx
jne 0x4dd364
push edx
call fcn.00494c04
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret
Function at 0x4dd4c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddeb2
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.00495f30
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1028], ecx
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.004acec0
add esp, 0xc
lea eax, [ebp - 0x1010]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
lea esi, [ebp - 0x1010]
xor edi, edi
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1018], ebx
mov dword [ebp - 0x1014], edi
mov dword [ebp - 4], edi
cmp word [ebp - 0x1010], di
je 0x4dd5f6
nop dword [eax]
push esi
lea ecx, [ebp - 0x1020]
call fcn.00410740
lea ecx, [edi + 1]
add esp, 4
cmp ecx, dword [ebp - 0x1018]
jle 0x4dd595
mov eax, ecx
test eax, eax
jns 0x4dd573
add eax, 1
sar eax, 1
add ecx, 8
add eax, ecx
lea ecx, [ebp - 0x101c]
and eax, 0xfffffff8
push eax
call fcn.0040e370
mov edi, dword [ebp - 0x1014]
mov ebx, dword [ebp - 0x101c]
lea eax, [edi + 1]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1020]
mov dword [ebx + edi*4], eax
mov eax, dword [0x612d94]
mov dword [ebp - 0x1020], 0x612d9c
test eax, 0x30000000
jne 0x4dd5d6
or eax, 0xffffffff
mov ecx, 0x612d94
lock xadd dword [ecx], eax
test eax, eax
jne 0x4dd5d6
push ecx
call fcn.00494c04
add esp, 4
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x4dd5d6
mov edi, dword [ebp - 0x1014]
mov ebx, dword [ebp - 0x101c]
cmp word [esi], ax
jne 0x4dd550
push dword [ebp - 0x1028]
lea edx, [ebx + edi*4]
mov ecx, ebx
mov eax, edx
sub eax, ebx
sar eax, 2
push eax
call fcn.004125c0
add esp, 8
xor esi, esi
test edi, edi
jle 0x4dd6cd
cmp esi, edi
jae 0x4dd623
mov edx, ebx
jmp 0x4dd641
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x667148]
cmp eax, dword [ecx + 4]
jg 0x4dd702
mov edx, 0x65abb8
lea ecx, [ebp - 0x1024]
call fcn.004fe8e0
mov edi, dword [ebp - 0x1028]
mov edx, dword [edi + 8]
lea ecx, [edx + 1]
cmp ecx, dword [edi + 4]
jle 0x4dd67b
mov eax, ecx
test eax, eax
jns 0x4dd666
add eax, 1
sar eax, 1
add ecx, 8
add eax, ecx
mov ecx, edi
and eax, 0xfffffff8
push eax
call fcn.0040e370
mov edx, dword [edi + 8]
lea eax, [edx + 1]
mov dword [edi + 8], eax
mov ecx, dword [edi]
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x1024], 0x612d9c
mov dword [ecx + edx*4], eax
mov eax, dword [0x612d94]
test eax, 0x30000000
jne 0x4dd6bb
or eax, 0xffffffff
mov ecx, 0x612d94
lock xadd dword [ecx], eax
test eax, eax
jne 0x4dd6bb
push ecx
call fcn.00494c04
add esp, 4
mov edi, dword [ebp - 0x1014]
inc esi
add ebx, 4
cmp esi, edi
jl 0x4dd61d
lea ecx, [ebp - 0x101c]
call fcn.00402e60
push dword [ebp - 0x101c]
call fcn.004af8b3
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret
push 0x667148
call fcn.00494dc6
add esp, 4
cmp dword [0x667148], 0xffffffff
jne 0x4dd63c
push 0x5eaf90
mov dword [0x65abb8], 0x612d9c
call fcn.0049541b
push 0x667148
call fcn.00494d7c
add esp, 8
jmp 0x4dd63c
Function at 0x4dd8b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4dd91d
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4dd913
lea ecx, [ebp + 0xc]
call fcn.004ddd00
mov edx, eax
mov eax, dword [esi + 0x10]
mov ecx, dword [edx]
mov dword [esi + 0x10], ecx
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff8
mov eax, dword [ecx]
test eax, 0x30000000
jne 0x4dd913
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x4dd913
push ecx
call fcn.00494c04
add esp, 4
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4e3a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov esi, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, edx
cmp dword [edi + 0x6c], eax
jb 0x4e3aba
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004ac3c0
mov eax, dword [edi + 0x4c]
add esp, 0xc
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x44]
mov edi, dword [ebp - 4]
lea edx, [eax + edi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x4e3a64
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x40]
mov edi, esi
lea edx, [eax + esi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x4e3a92
mov edi, dword [ebp - 8]
add ebx, esi
mov ecx, dword [edi]
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x4e3b82
mov ecx, dword [edi + 0x6c]
mov edx, dword [edi + 0x74]
add ecx, edx
add ecx, dword [edi + 0x38]
cmp eax, ebx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
cmovbe ebx, eax
test ebx, ebx
jne 0x4e3ae8
xor ebx, ebx
jmp 0x4e3b41
sub eax, ebx
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4e3b05
mov edx, dword [ecx]
mov ecx, dword [ecx + 0x30]
push ebx
call fcn.004e52a0
jmp 0x4e3b1f
cmp eax, 2
jne 0x4e3b28
mov edx, dword [ecx]
mov eax, dword [ecx + 0x30]
test edx, edx
jne 0x4e3b17
xor eax, eax
jmp 0x4e3b25
push ebx
mov ecx, eax
call fcn.004e4fc0
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ecx + 0x30], eax
push ebx
push dword [ecx]
push dword [ebp - 0xc]
call fcn.004ac3c0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], ebx
add dword [eax + 8], ebx
mov edx, dword [edi + 0x74]
add edx, ebx
mov dword [ebp - 0xc], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x4e3b6e
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 0xc]
cmp edx, 0x106
jae 0x4e3b82
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4e3a24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e4940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
test ecx, ecx
je 0x4e4ac4
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x4e4ac4
cmp dword [ecx + 0x20], 0
je 0x4e4ac4
cmp dword [ecx + 0x24], 0
je 0x4e4ac4
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test edx, edx
jns 0x4e499d
neg edx
mov dword [esi + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [esi + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x94]
mov dword [esi + 0xb18], eax
mov ecx, esi
lea eax, [esi + 0x988]
mov dword [esi + 0x28], 0
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0xb20], 0x65abe8
mov dword [esi + 0xb2c], 0x65abc0
mov dword [esi + 0xb38], 0x65abd4
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
mov dword [esi + 0x16b4], 8
call fcn.004e0bb0
mov eax, dword [esi + 0x2c]
xor edx, edx
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004acec0
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x614f3a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x614f38]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x614f3c]
mov dword [esi + 0x90], eax
movzx eax, word [ecx*4 + 0x614f3e]
mov dword [esi + 0x7c], eax
xor eax, eax
pop edi
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x4e5280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4e528b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004e4fc0
Function at 0x4ea330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de570
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], esi
call fcn.00408d10
mov ecx, dword [edi]
mov ebx, eax
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [ebx], ecx
mov eax, dword [ebx + 8]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push eax
mov ecx, dword [ecx + 0x30]
call ecx
add esp, 4
mov dword [esi], 0x612d9c
mov eax, esi
jmp 0x4ea3d7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret

Function at 0x4eaac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de6e2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp + 8]
push 0x14
mov dword [ebp - 0x20], 0x61c548
call fcn.00494bd4
mov ebx, eax
add esp, 4
mov dword [ebp - 0x28], ebx
lea esi, [ebx + 4]
mov dword [ebp - 4], 0
mov dword [esi], 0
mov byte [ebp - 4], 1
lea ecx, [ebx + 8]
push edi
mov dword [ebx], vtable.juce::var::VariantType::RefCountedArray.0
call fcn.0040c910
mov eax, 1
lock xadd dword [esi], eax
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov esi, dword [edi]
mov dword [edi], eax
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x30]
push eax
call ecx
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret 4
Function at 0x4ed1e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de9ff
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x65a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x18]
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
lea eax, [esi + 0x100]
xor edx, edx
xchg dword [eax], edx
mov eax, dword [esi + 0xc]
lea ebx, [esi + 0xc]
test eax, eax
jne 0x4ed26d
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x4db960
push dword [esi + 0xf4]
push 0
call fcn.004b070f
add esp, 0x18
xchg dword [ebx], eax
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x10]
xchg dword [eax], ecx
mov edx, dword [esi + 0xf0]
mov ecx, dword [ebx]
call fcn.004db850
lea ecx, [esi + 0x30]
call fcn.004db2e0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4edbc0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 8], ecx
cmp byte [esi], 0
je 0x4edce2
xor ebx, ebx
nop word [eax + eax]
mov cl, byte [esi]
inc esi
movzx eax, cl
test cl, cl
jns 0x4edc2b
mov edx, 0x7f
xor edi, edi
lea ecx, [edx - 0x3f]
test cl, al
je 0x4edc06
cmp ecx, 8
jbe 0x4edc06
shr ecx, 1
inc edi
shr edx, 1
test eax, ecx
jne 0x4edbf8
and eax, edx
sub edi, 1
js 0x4edc2b
nop dword [eax]
movzx edx, byte [esi]
mov ecx, edx
and cl, 0xc0
cmp cl, 0x80
jne 0x4edc2b
and edx, 0x3f
shl eax, 6
inc esi
or eax, edx
sub edi, 1
jns 0x4edc10
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x4edc37
mov eax, ecx
jmp 0x4edc78
lea ecx, [eax - 0x61]
cmp ecx, 0x19
ja 0x4edc44
sub eax, 0x47
jmp 0x4edc78
lea ecx, [eax - 0x30]
cmp ecx, 9
ja 0x4edc51
add eax, 4
jmp 0x4edc78
cmp eax, 0x2b
jne 0x4edc5d
mov eax, 0x3e
jmp 0x4edc78
cmp eax, 0x2f
jne 0x4edc69
mov eax, 0x3f
jmp 0x4edc78
cmp eax, 0x3d
jne 0x4edceb
mov eax, 0x40
cmp ebx, 1
jle 0x4edceb
mov byte [ebp + ebx - 4], al
inc ebx
cmp ebx, 4
jl 0x4edbe0
mov eax, dword [ebp - 4]
mov cl, ah
mov edi, dword [ebp - 8]
shr cl, 4
shl al, 2
or cl, al
mov edx, dword [edi]
movzx eax, cl
mov ecx, edi
push eax
call dword [edx + 0x14]
mov bl, byte [ebp - 2]
cmp bl, 0x40
jae 0x4edcd9
movzx eax, byte [ebp - 3]
mov cl, bl
mov edx, dword [edi]
shr cl, 2
shl al, 4
or cl, al
movzx eax, cl
mov ecx, edi
push eax
call dword [edx + 0x14]
mov al, byte [ebp - 1]
cmp al, 0x40
jae 0x4edcd9
mov edx, dword [edi]
mov ecx, edi
shl bl, 6
or bl, al
movzx eax, bl
push eax
call dword [edx + 0x14]
cmp byte [esi], 0
jne 0x4edbd8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f82e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
mov edi, edx
movlpd qword [ebp - 0x20], xmm0
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 8
mov dword [ebp - 8], 0
call fcn.004d7e10
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [edi]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov eax, dword [esi - 8]
sete bl
add esi, 0xfffffff8
test eax, 0x30000000
jne 0x4f8360
or eax, 0xffffffff
lock xadd dword [esi], eax
test eax, eax
jne 0x4f8360
push esi
call fcn.00494c04
add esp, 4
xor eax, eax
test bl, bl
pop edi
cmovne eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f8370
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x4f847b
mov ebx, dword [esi]
mov ecx, dword [ebp + 0xc]
mov eax, 0x10624dd3
imul ecx
mov dword [ebp - 0x10c], ebx
sar edx, 6
mov eax, edx
mov dword [ebp - 0x110], 1
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x228], eax
imul eax, eax, 0x3e8
mov dword [ebp - 0x218], 1
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x4f8474
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4f8474
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 4
push ecx
lea ecx, [ebp - 0x220]
push ecx
push 0x1007
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x4f8474
cmp dword [ebp - 0x220], 0
jne 0x4f8474
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
neg eax
push edi
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00494b92
mov esp, ebp
pop ebp
ret
Function at 0x4f8490
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df24f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp + 0x10]
xor eax, 1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
xor esi, esi
test ebx, ebx
jle 0x4f8550
push dword [ebp - 0x10]
mov edi, ebx
sub edi, esi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x4f8542
mov eax, dword [ebp - 0x14]
push 0
push edi
add eax, esi
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jle 0x4f8542
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
test cl, cl
je 0x4f8542
add esi, edi
cmp byte [ebp + 0x10], 0
je 0x4f8550
cmp esi, ebx
jl 0x4f84e7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x4f8550
or eax, 0xffffffff
cmp byte [ebp + 0x10], 0
cmovne esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f86f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x65a06c]
xor eax, esp
mov dword [esp + 0x194], eax
cmp byte [0x667054], 0
jne 0x4f872b
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete byte [0x667054]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00494b92
mov esp, ebp
pop ebp
ret

Function at 0x4fc4d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x4fc542
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4fc531
lea ecx, [ebp + 0xc]
call fcn.004ddd00
mov ecx, dword [esi + 0x18]
mov edx, dword [eax]
mov dword [esi + 0x18], edx
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff8
mov eax, dword [ecx]
test eax, 0x30000000
jne 0x4fc531
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x4fc531
push ecx
call fcn.00494c04
add esp, 4
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
add dword [esi + 0x10], eax
adc dword [esi + 0x14], eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x500960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dfd3c
mov eax, dword fs:[0]
push eax
mov eax, 0x2418
call fcn.00495f30
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x241c], esi
mov dword [ebp - 0x241c], esi
cmp edx, 0x11
ja case.default.0x5009a7
jmp dword [edx*4 + 0x500b50]
mov eax, 0x28
jmp 0x5009fd
mov eax, 5
jmp 0x5009fd
xor eax, eax
jmp 0x5009fd
mov eax, 0x1a
jmp 0x5009fd
mov eax, 0x23
jmp 0x5009fd
mov eax, 0x2e
jmp 0x5009fd
mov eax, 0x26
jmp 0x5009fd
mov eax, 0x2a
jmp 0x5009fd
mov eax, 0x1c
jmp 0x5009fd
mov eax, 0xd
jmp 0x5009fd
mov eax, 0xe
jmp 0x5009fd
mov eax, 0x27
push 0
push eax
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x5009a7
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x2420]
call fcn.00410740
add esp, 4
lea edx, [ebp - 0x2420]
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.004fe8e0
mov ecx, dword [ebp - 0x2420]
mov eax, dword [ecx - 8]
add ecx, 0xfffffff8
test eax, 0x30000000
jne 0x500b34
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x500b34
push ecx
call fcn.00494c04
add esp, 4
jmp 0x500b34
xor eax, eax
mov word [ebp - 0x1418], ax
lea eax, [ebp - 0x1418]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x1418]
push eax
lea ecx, [ebp - 0x2424]
call fcn.00410740
add esp, 4
lea edx, [ebp - 0x2424]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004fe8e0
mov ecx, dword [ebp - 0x2424]
jmp 0x500a46
xor eax, eax
mov word [ebp - 0x2418], ax
lea eax, [ebp - 0x2418]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x2418]
push eax
lea ecx, [ebp - 0x241c]
call fcn.00410740
add esp, 4
lea edx, [ebp - 0x241c]
mov dword [ebp - 4], 1
mov ecx, esi
call fcn.004fe8e0
mov ecx, dword [ebp - 0x241c]
jmp 0x500a46
call fcn.004db7c0
mov edx, eax
mov ecx, esi
call fcn.004dddc0
jmp 0x500b34
xor edx, edx
call fcn.004dddc0
jmp 0x500b34
mov dword [esi], 0
mov dword [esi], 0x612d9c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret