joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e68d4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x4e68e6
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
cmp edx, dword [eax]
jne 0x4e68e2
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4e693d
xor eax, eax
push ebp
push 0x4e6936
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e693d
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4ec3c4
Capabilities:
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
jne 0x4ec3d1
xor eax, eax
pop esi
pop ebx
ret
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx], esi
inc esi
jne 0x4ec3ef
mov eax, ebx
call fcn.004ec384
xor eax, eax
pop esi
pop ebx
ret
mov eax, 1
pop esi
pop ebx
ret

Function at 0x4ec42c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, 0x10
xor edx, edx
call fcn.004e79f0
mov word [ebp - 0x10], 2
mov ax, word [ebp + 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0xc]
call fcn.00404190
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push ebx
mov eax, dword [esi]
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
test ebx, ebx
jge 0x4ec48e
mov eax, esi
call fcn.004ec384
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ec49c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.00403d3c
xor eax, eax
mov dword [esi], eax
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_recvfrom
mov edi, eax
test edi, edi
jge 0x4ec4e8
mov eax, ebx
call fcn.004ec384
jmp 0x4ec50f
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
test ebx, ebx
je 0x4ec500
mov eax, dword [ebp + 0xc]
mov edx, ebx
call fcn.00403f04
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
movzx eax, ax
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ec51c
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00404190
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x4ec53f
mov eax, esi
call fcn.00403d3c
pop esi
pop ebx
ret
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00403f04
pop esi
pop ebx
ret

Function at 0x4ed2b8
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, 0x55efe0
mov eax, dword [0x55efec]
call fcn.00472f38
call fcn.004ed210
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ed2e2
or ebx, 0xffffffff
jmp 0x4ed455
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov ebp, eax
imul esi, ebx, 0x3c3a
mov eax, dword [edi]
mov dword [eax + esi*8], ebp
imul eax, ebx, 0x3c3a
mov edx, dword [edi]
inc ebp
jne 0x4ed30d
or ebx, 0xffffffff
jmp 0x4ed455
mov dword [esp + 4], 0x14000
push 4
lea eax, [esp + 8]
push eax
push 0x1002
push 0xffff
mov eax, dword [edi]
mov eax, dword [eax + esi*8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp + 4], 0x8000
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
mov eax, dword [edi]
mov eax, dword [eax + esi*8]
push eax
call sub.wsock32.dll_setsockopt
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 4], edx
mov eax, dword [edi]
mov word [eax + esi*8 + 8], 0
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x20], edx
mov eax, dword [edi]
mov byte [eax + esi*8 + 0x24], 1
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1e18c], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1e190], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1d4e4], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1d4e8], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1c], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1c828], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1c82c], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1c830], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1c834], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1c840], edx
mov eax, dword [edi]
mov dword [eax + esi*8 + 0x1e1a0], 0xc800
mov eax, dword [edi]
mov dword [eax + esi*8 + 0x1e1a4], 0x1f40
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1e1b4], edx
mov eax, dword [edi]
xor edx, edx
mov dword [eax + esi*8 + 0x1e1b8], edx
mov eax, dword [edi]
mov byte [eax + esi*8 + 0x1e1bc], 0
mov eax, dword [edi]
mov byte [eax + esi*8 + 0x1e1c4], 0
mov eax, dword [edi]
mov byte [eax + esi*8 + 0x1e1ce], 0
mov eax, dword [edi]
mov byte [eax + esi*8 + 0x1e1cf], 0
mov dword [esp], 1
push esp
push 0x8004667e
mov eax, dword [edi]
mov eax, dword [eax + esi*8]
push eax
call sub.wsock32.dll_ioctlsocket
mov eax, dword [edi]
mov ebx, dword [eax + esi*8]
mov eax, dword [0x55efec]
call fcn.00472f40
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4eea58
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x55efec]
call fcn.00472f38
or esi, 0xffffffff
mov ecx, dword [0x55efe4]
dec ecx
test ecx, ecx
jl 0x4eeac1
inc ecx
xor eax, eax
imul edx, eax, 0x3c3a
mov ebx, dword [0x55efe0]
mov ebx, dword [ebx + edx*8]
cmp ebx, dword [ebp - 4]
jne 0x4eeabd
mov ebx, dword [0x55efe0]
mov ebx, dword [ebx + edx*8 + 4]
cmp ebx, dword [ebp - 8]
jne 0x4eeabd
mov ebx, dword [0x55efe0]
mov dx, word [ebx + edx*8 + 8]
cmp dx, word [ebp - 0xa]
jne 0x4eeabd
mov esi, eax
jmp 0x4eeac1
inc eax
dec ecx
jne 0x4eea85
cmp esi, 0xffffffff
je 0x4eeb68
imul eax, esi, 0x3c3a
mov edx, dword [0x55efe0]
lea ebx, [edx + eax*8]
mov ax, word [ebp + 8]
mov word [ebp - 0x2a], ax
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x14
mov byte [ebp - 0x1c], 1
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov word [ebp - 0x14], 0
lea edx, [ebp - 0x41]
lea eax, [ebp - 0x2c]
call fcn.004ee534
mov word [ebp - 0x54], 2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov ax, word [ebp + 8]
mov word [ebp - 0x52], ax
push 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0x14
lea eax, [ebp - 0x41]
push eax
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_sendto
test eax, eax
jge 0x4eeb68
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0
lea edx, [ebp - 0x5c]
xor ecx, ecx
mov eax, 0x4eeb84
call fcn.004ea1b4
mov eax, dword [0x55efec]
call fcn.00472f40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f11ec
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
call fcn.004ed114
add esp, 0x190
ret
Function at 0x4f1438
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
jne 0x4f150b
test ebx, ebx
jne 0x4f145a
xor eax, eax
jmp 0x4f15c7
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebp, eax
mov dword [ebx + 4], ebp
inc ebp
jne 0x4f147b
mov eax, ebx
call fcn.004f1218
xor eax, eax
jmp 0x4f15c7
mov word [esp], 2
test esi, esi
jne 0x4f148d
xor eax, eax
mov dword [esp + 4], eax
jmp 0x4f1497
push esi
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push edi
call sub.wsock32.dll_htons
mov word [esp + 2], ax
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_bind
test eax, eax
jge 0x4f14cd
mov eax, ebx
call fcn.004f1218
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
jmp 0x4f15c7
mov esi, 0xc8
push esi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_listen
test eax, eax
jge 0x4f14f7
mov eax, ebx
call fcn.004f1218
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
jmp 0x4f15c7
xor edx, edx
mov eax, dword [ebx + 4]
call fcn.004f1414
mov eax, 1
jmp 0x4f15c7
dec eax
jne 0x4f15c5
test ebx, ebx
jne 0x4f151d
xor eax, eax
jmp 0x4f15c7
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004ed2b8
mov ebp, eax
mov dword [ebx + 4], ebp
inc ebp
jne 0x4f153e
mov eax, ebx
call fcn.004f1218
xor eax, eax
jmp 0x4f15c7
mov word [esp], 2
test esi, esi
jne 0x4f1550
xor eax, eax
mov dword [esp + 4], eax
jmp 0x4f155a
push esi
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push edi
call sub.wsock32.dll_htons
mov word [esp + 2], ax
push 0
push 0
mov ecx, 0x10
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
call fcn.004ed968
test eax, eax
jge 0x4f1595
mov eax, ebx
call fcn.004f1218
xor ecx, ecx
xor edx, edx
mov eax, dword [ebx + 4]
call fcn.004ee1c8
xor eax, eax
jmp 0x4f15c7
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebx + 4]
call fcn.004eda5c
test eax, eax
jge 0x4f15be
mov eax, ebx
call fcn.004f1218
xor ecx, ecx
xor edx, edx
mov eax, dword [ebx + 4]
call fcn.004ee1c8
xor eax, eax
jmp 0x4f15c7
mov eax, 1
jmp 0x4f15c7
xor eax, eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f167c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
jne 0x4f16a5
push 0
push ecx
push edx
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
jge 0x4f16a0
mov eax, ebx
call fcn.004f1218
mov eax, esi
pop esi
pop ebx
ret
dec eax
jne 0x4f16cc
push 0
mov eax, dword [ebx + 8]
push eax
mov ax, word [ebx + 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.004ed514
mov esi, eax
test esi, esi
jge 0x4f16c8
mov eax, ebx
call fcn.004f1218
mov eax, esi
jmp 0x4f16cf
or eax, 0xffffffff
pop esi
pop ebx
ret
Function at 0x4f16d4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
jne 0x4f16fd
push 0
push ecx
push edx
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_send
mov esi, eax
test esi, esi
jge 0x4f16f8
mov eax, ebx
call fcn.004f1218
mov eax, esi
pop esi
pop ebx
ret
dec eax
jne 0x4f1724
push 0
mov eax, dword [ebx + 8]
push eax
mov ax, word [ebx + 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.004ed730
mov esi, eax
test esi, esi
jge 0x4f1720
mov eax, ebx
call fcn.004f1218
mov eax, esi
jmp 0x4f1727
or eax, 0xffffffff
pop esi
pop ebx
ret
Function at 0x4f1bc4
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffc30
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4f1c2c
lea eax, [esp + 8]
call fcn.004ec284
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
call fcn.004ec274
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0x40
call sub.wsock32.dll_select
test eax, eax
jle 0x4f1c28
mov eax, 1
jmp 0x4f1c7e
xor eax, eax
jmp 0x4f1c7e
dec eax
jne 0x4f1c7b
lea eax, [esp + 0x10c]
call fcn.004ee394
mov ax, word [ebx + 0xc]
push eax
lea edx, [esp + 0x110]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
call fcn.004ee39c
push 0
lea eax, [esp + 4]
push eax
lea edx, [esp + 0x114]
xor ecx, ecx
mov eax, 0x40
call fcn.004edeb0
test eax, eax
jle 0x4f1c77
mov eax, 1
jmp 0x4f1c7e
xor eax, eax
jmp 0x4f1c7e
or eax, 0xffffffff
add esp, 0x3d0
pop esi
pop ebx
ret

Function at 0x4f1c88
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffc30
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4f1cf0
lea eax, [esp + 8]
call fcn.004ec284
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
call fcn.004ec274
push esp
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0x40
call sub.wsock32.dll_select
test eax, eax
jle 0x4f1cec
mov eax, 1
jmp 0x4f1d42
xor eax, eax
jmp 0x4f1d42
dec eax
jne 0x4f1d3f
lea eax, [esp + 0x10c]
call fcn.004ee394
mov ax, word [ebx + 0xc]
push eax
lea edx, [esp + 0x110]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
call fcn.004ee39c
push 0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x114]
xor edx, edx
mov eax, 0x40
call fcn.004edeb0
test eax, eax
jle 0x4f1d3b
mov eax, 1
jmp 0x4f1d42
xor eax, eax
jmp 0x4f1d42
or eax, 0xffffffff
add esp, 0x3d0
pop esi
pop ebx
ret
Function at 0x4f1d4c
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffff868
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4f1e04
lea eax, [esp + 8]
call fcn.004ec284
lea eax, [esp + 0x10c]
call fcn.004ec284
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
call fcn.004ec274
lea edx, [esp + 0x10c]
mov eax, dword [ebx + 4]
call fcn.004ec274
push esp
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x40
call sub.wsock32.dll_select
test eax, eax
jle 0x4f1dfd
lea edx, [esp + 0x10c]
mov eax, dword [ebx + 4]
call fcn.004ec25c
test al, al
je 0x4f1df3
or eax, 0xffffffff
mov dword [ebx + 0x4040], 0x274d
jmp 0x4f1ead
mov eax, 1
jmp 0x4f1ead
xor eax, eax
jmp 0x4f1ead
dec eax
jne 0x4f1eaa
lea eax, [esp + 0x210]
call fcn.004ee394
lea eax, [esp + 0x4d4]
call fcn.004ee394
mov ax, word [ebx + 0xc]
push eax
lea edx, [esp + 0x214]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
call fcn.004ee39c
mov ax, word [ebx + 0xc]
push eax
lea edx, [esp + 0x4d8]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
call fcn.004ee39c
lea eax, [esp + 0x4d4]
push eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x218]
xor edx, edx
mov eax, 0x40
call fcn.004edeb0
test eax, eax
jle 0x4f1ea6
mov ax, word [ebx + 0xc]
push eax
lea edx, [esp + 0x4d8]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
call fcn.004ee3d4
test al, al
je 0x4f1e9f
or eax, 0xffffffff
mov dword [ebx + 0x4040], 0x274d
jmp 0x4f1ead
mov eax, 1
jmp 0x4f1ead
xor eax, eax
jmp 0x4f1ead
or eax, 0xffffffff
add esp, 0x798
pop esi
pop ebx
ret
Function at 0x4f2b10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f2c16
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4f2b3f
mov eax, esi
call fcn.00403d3c
jmp 0x4f2c00
cmp dword [ebx + 4], 0xffffffff
jne 0x4f2b51
mov eax, esi
call fcn.00403d3c
jmp 0x4f2c00
mov eax, dword [ebx]
test eax, eax
jne 0x4f2ba4
mov dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x14]
mov edx, 0x4f2c2c
call fcn.00403dd4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x4f2b98
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00403f04
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.00403d90
jmp 0x4f2c00
dec eax
jne 0x4f2bf4
mov dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x14]
mov edx, 0x4f2c2c
call fcn.00403dd4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x4f2be8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00403f04
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.00403d90
jmp 0x4f2c00
mov eax, esi
mov edx, 0x4f2c2c
call fcn.00403d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2c1d
lea eax, [ebp - 0x14]
call fcn.00403d3c
ret
Function at 0x4f71a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov ebx, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov esi, eax
push 0x100
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0xc8
call sub.kernel32.dll_Sleep
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
fild qword [ebp - 0x10]
fdiv dword [0x4f7240]
call fcn.00402a8c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f74d0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffff94
mov ebx, eax
mov dword [esp], 0x64
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4f7503
mov byte [esp + 0x68], 0
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x65
call fcn.00403f7c
jmp 0x4f750a
mov eax, ebx
call fcn.00403d3c
add esp, 0x6c
pop ebx
ret

Function at 0x4f8204
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4f821a
mov eax, 0x10000
add esp, 0x24
ret
Function at 0x4f8220
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], edx
mov ebx, eax
cmp dword [ebx + 0x18], 0
jne 0x4f825b
mov eax, dword [ebx + 4]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0xb
lea eax, [esp + 8]
push eax
push 0
mov ecx, 0x4f8324
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040c8b8
call fcn.00403788
mov eax, dword [ebx + 0x14]
mov edi, dword [ebx + 0x10]
cmp eax, edi
ja 0x4f826c
xor eax, eax
jmp 0x4f8312
mov edx, edi
add edx, ecx
cmp eax, edx
ja 0x4f827a
mov esi, eax
sub esi, edi
jmp 0x4f827c
mov esi, ecx
mov eax, edi
xor edx, edx
div dword [ebx + 0x1c]
mov dword [esp + 4], edx
sub edi, dword [esp + 4]
mov eax, dword [esp + 4]
add eax, esi
push eax
push edi
push 0
push 4
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebp, eax
test ebp, ebp
jne 0x4f82df
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], 0xb
mov dword [esp + 0x18], esi
mov byte [esp + 0x1c], 0
lea eax, [esp + 0x10]
push eax
push 1
mov ecx, 0x4f834c
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040c8b8
call fcn.00403788
mov edx, dword [esp + 4]
add edx, ebp
mov ecx, dword [esp]
mov eax, ecx
mov edi, dword [esp]
mov edi, ecx
add edi, esi
cmp edi, eax
jbe 0x4f82ff
mov cl, byte [edx]
mov byte [eax], cl
inc eax
inc edx
cmp edi, eax
ja 0x4f82f5
push ebp
call sub.kernel32.dll_UnmapViewOfFile
neg eax
sbb eax, eax
neg eax
test al, al
add dword [ebx + 0x10], esi
mov eax, esi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f85b4
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, eax
push esp
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4f860a
call sub.kernel32.dll_GetLastError_1
mov edi, eax
test edi, edi
je 0x4f860a
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov byte [esp + 8], 0xb
mov dword [esp + 0xc], edi
mov byte [esp + 0x10], 0
lea eax, [esp + 4]
push eax
push 1
mov ecx, 0x4f861c
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040c8b8
call fcn.00403788
mov eax, ebx
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4f8950
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
test dl, dl
je 0x4f8965
add esp, 0xfffffff0
call fcn.00403330
mov byte [ebp - 1], dl
mov ebx, eax
mov edx, ecx
mov eax, ebx
call fcn.004f9264
lea eax, [ebx + 8]
call fcn.004f88a0
lea eax, [ebx + 0x30]
call fcn.004f88a0
push 0x4f8b38
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateMutexA
mov esi, eax
mov dword [ebx + 0x60], esi
test esi, esi
jne 0x4f89b3
mov byte [ebx + 0x64], 0
lea edx, [ebp - 4]
or ecx, 0xffffffff
mov eax, 0x4f8b74
call fcn.004ea1b4
jmp 0x4f8b17
mov eax, dword [ebx + 0x60]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, ebx
call fcn.004f8ce4
test al, al
jne 0x4f89e0
mov byte [ebx + 0x64], 0
lea edx, [ebp - 4]
or ecx, 0xffffffff
mov eax, 0x4f8b9c
call fcn.004ea1b4
jmp 0x4f8b17
push 0x4f8bbc
push 0x2338
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0x58], esi
test esi, esi
jne 0x4f8a23
mov byte [ebx + 0x64], 0
mov eax, ebx
call fcn.004f8d28
lea edx, [ebp - 4]
or ecx, 0xffffffff
mov eax, 0x4f8bf0
call fcn.004ea1b4
jmp 0x4f8b17
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push 0
push 0
push 0
push 2
mov eax, dword [ebx + 0x58]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov dword [ebx + 0x5c], edi
test edi, edi
jne 0x4f8a72
mov eax, dword [ebx + 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebx + 0x58], eax
mov byte [ebx + 0x64], 0
mov eax, ebx
call fcn.004f8d28
lea edx, [ebp - 4]
or ecx, 0xffffffff
mov eax, 0x4f8c18
call fcn.004ea1b4
jmp 0x4f8b17
cmp esi, 0xb7
je 0x4f8a81
mov eax, ebx
call fcn.004f8d44
mov eax, dword [ebx + 0x5c]
mov eax, dword [eax]
cmp eax, 1
je 0x4f8abc
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4f8c40
call fcn.004ea1b4
mov eax, dword [ebx + 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebx + 0x58], eax
mov byte [ebx + 0x64], 0
mov eax, ebx
call fcn.004f8d28
jmp 0x4f8b17
mov eax, ebx
call fcn.004f8d60
test al, al
jne 0x4f8af2
mov eax, dword [ebx + 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebx + 0x58], eax
mov byte [ebx + 0x64], 0
mov eax, ebx
call fcn.004f8d28
lea edx, [ebp - 4]
or ecx, 0xffffffff
mov eax, 0x4f8c7c
call fcn.004ea1b4
jmp 0x4f8b17
mov eax, ebx
call fcn.004f8d28
mov byte [ebx + 0x64], 1
mov byte [ebx + 0x6c], 0
mov byte [ebx + 0x74], 0
mov byte [ebx + 0x7c], 0
mov byte [ebx + 0x84], 0
mov byte [ebx + 0x8c], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4f8b2e
call fcn.00403388
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret