joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481160
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
push ebx
push esi
push edi
push str.Switching_server_
push 3
push 0
call fcn.004c4a70
add esp, 0xc
push str.Switching_Server__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
mov dword [0xcc516c], edx
mov eax, dword [ebx]
mov edx, dword [0xcc535c]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x2c]
mov dword [0xcc5058], eax
mov dword [edx + 0x7c], eax
mov eax, dword [ebx]
mov ecx, dword [0xcc535c]
mov esi, dword [eax + 8]
lea edi, [ecx + 0x21c]
add esi, 0x48
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x38]
mov dword [0x506210], ecx
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov cl, byte [eax + 0x36]
mov byte [0xcc5184], cl
mov edx, dword [ebx]
mov eax, dword [edx + 8]
movsx ecx, word [eax + 0x34]
movsx edx, word [eax + 0x32]
movsx eax, word [eax + 0x30]
push ecx
push edx
push eax
push str.tp___d__d__d_
lea ecx, [esp + 0x1c]
push 0xff
push ecx
call fcn.004de716
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.004c41f0
mov eax, dword [ebx]
add esp, 0x24
mov ecx, dword [eax + 8]
lea eax, [esp + 0xc]
mov edx, dword [ecx]
push edx
push 0xcc2d98
push str._s___s_
push 0x3f
push eax
call fcn.004de716
lea ecx, [esp + 0x20]
push ecx
call fcn.004d5170
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x40
ret
Function at 0x481e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4edebb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
push eax
call fcn.0040f640
mov esi, dword [0xcc5204]
xor ebx, ebx
add esp, 4
cmp esi, ebx
mov dword [esp + 0x20], eax
je 0x481ea4
mov ecx, dword [esi + 0x44]
mov dword [0xcc5204], ecx
jmp 0x481f5e
push 0xf804
mov dword [0xcc51f8], 1
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x481ee9
push fcn.004826a0
push fcn.004825c0
lea esi, [eax + 4]
push 0x200
push 0x7c
push esi
mov dword [eax], 0x200
call fcn.004de47c
jmp 0x481eeb
xor esi, esi
mov eax, dword [0xcc5200]
push ebp
add eax, 0x200
mov dword [esp + 0x1c], 0xffffffff
mov dword [0xcc5200], eax
mov dword [0xcc51f8], ebx
lea edi, [esi + 0xf784]
mov ebp, 0x1ff
cmp edi, ebx
je 0x481f1d
mov eax, dword [edi + 4]
jmp 0x481f22
mov eax, 0xfeedbeef
push 0x3e
push str.C:projectsuobuildpub007client_src_shared_baseobj_mem.cxx
push eax
push edi
call fcn.00479690
add esp, 0x10
test al, al
jne 0x481f44
push str.NewStaticObj:_either_pointer__p_i___is_not_valid__or_the_data_it_points_to_is_not_valid._the_program_may_crash__n
call fcn.004ceaa0
add esp, 4
mov edx, dword [0xcc5204]
mov dword [edi + 0x44], edx
mov dword [0xcc5204], edi
sub edi, 0x7c
dec ebp
jne 0x481f14
mov eax, dword [esp + 0x24]
pop ebp
mov edi, dword [0xcc51fc]
or ecx, 0xffffffff
inc edi
mov dword [0xcc51fc], edi
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov byte [esi + 0x71], bl
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
mov word [esi + 0x3c], bx
mov word [esi + 0x42], bx
mov byte [esi + 0x72], bl
mov byte [esi + 0x70], 1
mov byte [esi + 0x73], 1
mov word [esi + 0x24], cx
mov word [esi + 0x26], cx
mov ecx, eax
mov word [esi + 0x28], bx
and ecx, 0x3fff
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x78], bl
mov byte [esi + 0x3e], bl
mov word [esi + 0x40], bx
mov dword [esi + 0x74], ebx
lea eax, [eax + eax*4]
mov word [esi + 0x3c], cx
mov edx, dword [0xcc53c0]
shl eax, 3
pop edi
mov cx, word [eax + edx + 8]
mov word [esi + 0x40], cx
mov edx, dword [0xcc53c0]
mov ecx, dword [esp + 0xc]
mov ax, word [eax + edx + 0xe]
mov word [esi + 0x42], ax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x485f40
Capabilities:
Check http status code

Disassembly:
mov ax, word [esp + 4]
cmp ax, 0xc8
jae 0x485fa6
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x485f95
cmp ax, 4
je 0x485f9c
cmp ax, 5
je 0x485f9c
cmp ax, 6
je 0x485f9c
cmp ax, 9
je 0x485f9c
cmp ax, 0xa
je 0x485f9c
cmp ax, 0xc
je 0x485f9c
cmp ax, 0x1e
je 0x485f9c
cmp ax, 0x27
je 0x485f9c
cmp ax, 0x3b
je 0x485f9c
cmp ax, 0x3c
je 0x485f9c
cmp ax, 0x3d
je 0x485f9c
xor eax, eax
jmp 0x48602b
mov eax, 0x13
jmp 0x48602b
cmp ax, 0x190
jae 0x485fc9
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x485fc0
mov eax, 1
mov ecx, 5
jmp 0x486030
xor eax, eax
mov ecx, 5
jmp 0x486030
mov eax, dword [esp + 0x24]
test eax, eax
mov eax, dword [esp + 0x20]
je 0x485fe5
test eax, eax
jne 0x485fe9
mov eax, 7
mov ecx, 1
jmp 0x486030
test eax, eax
je 0x486009
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x485ffd
mov eax, 0x17
mov ecx, 5
jmp 0x486030
mov eax, 0x18
mov ecx, 5
jmp 0x486030
mov eax, dword [esp + 0x1c]
test eax, eax
mov eax, dword [esp + 0x28]
je 0x486021
dec eax
neg eax
sbb eax, eax
and al, 0xfe
add eax, 6
jmp 0x48602b
dec eax
neg eax
sbb eax, eax
and al, 0xfe
add eax, 2
mov ecx, 0xa
mov edx, dword [esp + 0x10]
cmp edx, 0xffffffff
jne 0x48605e
mov edx, dword [esp + 0x2c]
cmp ecx, 1
mov dword [edx], eax
jne 0x48604f
mov eax, dword [esp + 0x30]
mov dword [eax], 0
ret
mov eax, dword [esp + 0xc]
dec ecx
cdq
idiv ecx
mov ecx, dword [esp + 0x30]
mov dword [ecx], edx
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
and eax, 0x7f
mov dword [ecx], eax
mov eax, dword [esp + 0x30]
mov dword [eax], edx
ret
Function at 0x489c80
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x258]
test eax, eax
je 0x489cbb
mov edx, dword [eax + 4]
lea ecx, [esp + 0xc]
push 0x14
and edx, 0xbfffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov edx, dword [ebp + 0x26c]
lea edi, [esp + 0xc]
add edx, 0xf8
jmp 0x489ccc
mov edx, dword [ebp + 0x26c]
mov edi, 0x74166c
add edx, 0xf8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x26c]
mov edx, dword [ecx]
call dword [edx + 0x178]
mov eax, dword [ebp + 0x258]
test eax, eax
je 0x489d17
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x489d17
mov eax, dword [ebp + 0x260]
mov byte [eax + 0xb8], 1
jmp 0x489d24
mov ecx, dword [ebp + 0x260]
mov byte [ecx + 0xb8], 0
mov ecx, dword [ebp + 0x260]
call fcn.00423a30
mov eax, dword [ebp + 0x258]
test eax, eax
je 0x489d4f
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x489d4f
mov edx, dword [ebp + 0x264]
mov byte [edx + 0xb8], 1
jmp 0x489d5c
mov eax, dword [ebp + 0x264]
mov byte [eax + 0xb8], 0
mov ecx, dword [ebp + 0x264]
call fcn.00423a30
mov eax, dword [ebp + 0x258]
test eax, eax
je 0x489d87
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x489d87
mov ecx, dword [ebp + 0x268]
mov byte [ecx + 0xb8], 1
jmp 0x489d94
mov edx, dword [ebp + 0x268]
mov byte [edx + 0xb8], 0
mov ecx, dword [ebp + 0x268]
call fcn.00423a30
mov eax, dword [ebp + 0x25c]
mov esi, dword [eax + 0x48]
test esi, esi
je 0x489dcf
mov edx, dword [esi]
mov edi, dword [esi + 0x40]
mov ecx, esi
call dword [edx + 0x120]
test eax, eax
je 0x489dc9
test esi, esi
je 0x489dc9
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
test edi, edi
mov esi, edi
jne 0x489dac
mov eax, dword [ebp + 0x258]
test eax, eax
je 0x489e11
mov ecx, dword [eax + 0x14]
xor edi, edi
test ecx, ecx
jle 0x489e11
xor esi, esi
mov ecx, dword [esi + eax + 0x20]
mov edx, dword [esi + eax + 0x1c]
mov eax, dword [esi + eax + 0x18]
push 0xe
push 4
push ecx
mov ecx, dword [ebp + 0x25c]
push edx
push eax
call fcn.00425ab0
mov eax, dword [ebp + 0x258]
inc edi
add esi, 0x14
cmp edi, dword [eax + 0x14]
jl 0x489de4
mov ecx, dword [ebp + 0x25c]
push 0xe
push 4
push 0
push 0
push 0
call fcn.00425ab0
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x48cab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ee7a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.004cec40
lea edi, [esi + 0x18]
mov dword [esp + 0x18], 0
mov ecx, edi
call fcn.004cec40
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], 1
mov dword [esi], 0x4f930c
mov dword [esi + 4], eax
call fcn.004cefd0
mov edx, dword [esp + 0x28]
mov ecx, edi
push edx
call fcn.004cefd0
mov eax, dword [esp + 0x34]
mov ecx, edi
mov dword [esi + 0x28], eax
call fcn.004cef40
push eax
call fcn.0048e420
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
add esp, 4
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x34], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x48d2e0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4ee84c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebp, [esi + 8]
mov ecx, ebp
call fcn.004cec40
lea edi, [esi + 0x18]
mov dword [esp + 0x28], 0
mov ecx, edi
call fcn.004cec40
mov dword [esi], 0x4f92c4
lea ecx, [esi + 0x2c]
mov dword [esp + 0x28], 1
call fcn.004cec40
push fcn.004cece0
push fcn.004cec40
lea eax, [esi + 0x3c]
push 0xc
push 0x10
push eax
mov byte [esp + 0x3c], 2
call fcn.004de47c
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, ebp
mov byte [esp + 0x2c], 3
mov dword [esi], 0x4f933c
mov dword [esi + 4], eax
call fcn.004cefd0
mov edx, dword [esp + 0x38]
mov ecx, edi
push edx
call fcn.004cefd0
mov eax, dword [esp + 0x40]
mov ecx, edi
mov dword [esi + 0x28], eax
call fcn.004cef40
push eax
call fcn.0048e900
add esp, 4
lea ecx, [esp + 0x10]
push eax
call fcn.004cee20
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
push ecx
lea ecx, [esi + 0x2c]
call fcn.004cefd0
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.004cece0
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xfc], 0
call fcn.004cef40
mov edi, eax
mov ax, word [edi]
test ax, ax
je 0x48d3e9
cmp ax, 0x5b
je 0x48d3e9
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x48d3d7
cmp word [edi], 0
je 0x48d3f2
add edi, 2
mov ax, word [edi]
test ax, ax
je 0x48d455
cmp ax, 0x5d
je 0x48d455
test ax, ax
je 0x48d42f
cmp ax, 0x5d
je 0x48d42f
cmp ax, 0x7c
je 0x48d42f
mov edx, dword [esi + 0xfc]
push eax
shl edx, 4
add edi, 2
lea ecx, [edx + esi + 0x3c]
call fcn.004cf0e0
mov ax, word [edi]
test ax, ax
jne 0x48d405
mov edx, dword [esi + 0xfc]
inc edx
mov dword [esi + 0xfc], edx
mov ax, word [edi]
test ax, ax
je 0x48d44d
cmp ax, 0x5d
je 0x48d44d
add edi, 2
mov ax, word [edi]
test ax, ax
jne 0x48d3fa
mov eax, dword [esi + 0xfc]
xor edi, edi
test eax, eax
jle 0x48d47f
lea ebp, [esi + 0x3c]
push ebp
lea ecx, [esi + 0x2c]
call fcn.004cf170
test eax, eax
jne 0x48d47f
mov eax, dword [esi + 0xfc]
inc edi
add ebp, 0x10
cmp edi, eax
jl 0x48d464
cmp edi, dword [esi + 0xfc]
jne 0x48d493
lea eax, [esi + 0x3c]
lea ecx, [esi + 0x2c]
push eax
call fcn.004cefd0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x48fd40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4eebd9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045ae70
xor ebx, ebx
mov ebp, 1
push str.OptScrollBar_framedata
push 8
mov dword [esp + 0x28], ebx
mov dword [esi], 0x4f935c
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.OptScrollBar_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
push 0xec
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xac], bl
call fcn.004ddf8e
add esp, 0x14
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 1
je 0x48fe61
push ebx
push 0xfb
push 0xfa
push fcn.00421c30
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.00422990
jmp 0x48fe63
xor eax, eax
mov dword [esi + 0x9c], eax
mov dword [eax + 0xa4], ebx
mov eax, dword [esi + 0x9c]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [eax + 0xc0], ebp
mov ecx, dword [esi + 0x9c]
call fcn.0045a530
push 0xec
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 2
je 0x48fec5
push ebx
push 0xfd
push 0xfc
push fcn.00421c30
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.00422990
jmp 0x48fec7
xor eax, eax
mov dword [esi + 0xa0], eax
mov dword [eax + 0xa4], ebp
mov ecx, dword [esi + 0xa0]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [ecx + 0xc0], ebp
mov ecx, dword [esi + 0xa0]
call fcn.0045a530
push 0xbc
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 3
je 0x48ff1d
push 0xfe
push esi
push ebx
push ebp
push ebx
push ebx
mov ecx, eax
call fcn.004231c0
jmp 0x48ff1f
xor eax, eax
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x28], bl
mov dword [esi + 0xa8], eax
call fcn.0045a530
mov edx, dword [esp + 0x28]
push ebp
push edx
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x492e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4eecbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor eax, eax
push edi
mov al, byte [esi]
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov eax, dword [eax + esi]
push eax
call sub.WSOCK32.dll_ntohl
xor ecx, ecx
mov ebx, eax
mov cl, byte [esi]
mov ax, word [ecx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 4]
push eax
call sub.WSOCK32.dll_ntohs
xor edx, edx
mov edi, eax
mov dl, byte [esi]
mov ax, word [edx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 6]
push eax
call sub.WSOCK32.dll_ntohs
mov ebp, eax
xor eax, eax
mov al, byte [esi]
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 8]
push eax
call sub.WSOCK32.dll_ntohs
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov cl, byte [esi]
mov ax, word [ecx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xa]
push eax
call sub.WSOCK32.dll_ntohs
xor edx, edx
mov dword [esp + 0x18], eax
mov dl, byte [esi]
mov ax, word [edx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xc]
push eax
call sub.WSOCK32.dll_ntohs
mov dword [esp + 0x14], eax
xor eax, eax
mov al, byte [esi]
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xe]
push eax
call sub.WSOCK32.dll_ntohs
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cl, byte [esi]
mov ax, word [ecx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0x10]
push eax
call sub.WSOCK32.dll_ntohs
push ebx
mov dword [esp + 0x38], eax
call fcn.00488740
mov esi, eax
add esp, 4
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x68]
test eax, eax
je 0x49300e
cmp di, 0x139d
jb 0x49300e
push 0x130
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x2c], 0
je 0x492ff9
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
push ebp
and edi, 0xffff
push esi
push edi
push 0
push 0
mov ecx, eax
call fcn.0043c100
jmp 0x492ffb
xor eax, eax
push 1
push 0
mov ecx, eax
mov dword [esp + 0x34], 0xffffffff
call fcn.0045a530
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x497ef0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
push edi
mov al, byte [esi]
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov eax, dword [eax + esi]
push eax
call sub.WSOCK32.dll_ntohl
xor ecx, ecx
mov edi, eax
mov cl, byte [esi]
mov ax, word [ecx*8 + 0x54901c]
and ax, 0x8000
mov cx, ax
neg cx
sbb ecx, ecx
and ecx, 2
inc ecx
and ecx, 0xffff
mov dl, byte [ecx + esi + 4]
mov cx, ax
neg cx
sbb ecx, ecx
mov byte [esp + 0x10], dl
and ecx, 2
inc ecx
and ecx, 0xffff
neg ax
sbb eax, eax
mov cl, byte [ecx + esi + 5]
and eax, 2
mov byte [esp + 0x18], cl
inc eax
and eax, 0xffff
mov ax, word [eax + esi + 6]
push eax
call sub.WSOCK32.dll_ntohs
xor edx, edx
mov ebp, eax
mov dl, byte [esi]
add ebp, 0x18
mov ax, word [edx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 8]
push eax
call sub.WSOCK32.dll_ntohs
mov si, ax
push edi
add esi, 0x1f
call fcn.00488740
mov edi, eax
add esp, 4
test edi, edi
je case.0x497ff5.6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x68]
test eax, eax
je case.0x497ff5.6
mov ebx, dword [edi + 0xb4]
test ebx, ebx
je case.0x497ff5.6
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, 0xff
dec ecx
cmp ecx, 7
ja case.0x497ff5.6
jmp dword [ecx*4 + 0x4980b4]
mov al, byte [esp + 0x18]
mov ecx, dword [ebx + 0x114]
xor edx, edx
cmp al, 1
sete dl
mov esi, edx
mov dword [ebx + 0xd4], esi
mov dword [ecx + 0x14], esi
test al, al
jne 0x498032
mov ecx, dword [ebx + 0x114]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 0x54]
push eax
push edx
jmp 0x498049
mov edx, dword [ebx + 0x114]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov eax, dword [edx + 0xa8]
push ecx
push eax
call fcn.004447f0
mov eax, dword [ebx + 0x20]
add esp, 0xc
cdq
sub eax, edx
pop edi
mov ecx, eax
mov eax, dword [esp + 0x14]
cdq
sub eax, edx
mov edx, dword [ebx + 0x114]
sar ecx, 1
sar eax, 1
sub ecx, eax
mov dword [edx + 0x30], ecx
mov eax, dword [ebx + 0x110]
mov dword [eax + 0x6c], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Request_to_edit_denied.
push 3
push 0
call fcn.004c4a70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x18]
push esi
push ebp
push ecx
push eax
mov ecx, edi
call fcn.00484ee0
mov ecx, ebx
call fcn.0043d590
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x49e9e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ef05b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
xor eax, eax
push edi
mov al, byte [esi]
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov eax, dword [eax + esi]
push eax
call sub.WSOCK32.dll_ntohl
xor ecx, ecx
mov ebx, eax
mov cl, byte [esi]
mov ax, word [ecx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 4]
push eax
call sub.WSOCK32.dll_ntohs
xor edx, edx
mov ebp, eax
mov dl, byte [esi]
mov ax, word [edx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 6]
push eax
call sub.WSOCK32.dll_ntohs
xor ecx, ecx
mov cl, byte [esi]
mov cx, word [ecx*8 + 0x54901c]
and cx, 0x8000
mov dx, cx
neg dx
sbb edx, edx
and eax, 0xffff
and edx, 2
add eax, 8
inc edx
mov edi, eax
mov ax, cx
and edx, 0xffff
neg ax
sbb eax, eax
lea edx, [edx + esi + 8]
and eax, 2
mov dword [esp + 0x18], edx
inc eax
and eax, 0xffff
add eax, edi
inc edi
mov al, byte [eax + esi]
mov byte [esp + 0x14], al
mov ax, cx
neg ax
sbb eax, eax
and eax, 2
inc eax
and eax, 0xffff
add eax, edi
inc edi
neg cx
sbb ecx, ecx
mov dl, byte [eax + esi]
and ecx, 2
mov byte [esp + 0x10], dl
inc ecx
and ecx, 0xffff
add ecx, edi
mov ecx, dword [ecx + esi]
push ecx
call sub.WSOCK32.dll_ntohl
mov dword [esp + 0x30], eax
xor eax, eax
mov al, byte [esi]
add edi, 4
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
add eax, edi
mov ax, word [eax + esi]
push eax
call sub.WSOCK32.dll_ntohs
xor ecx, ecx
add edi, 2
mov cl, byte [esi]
push 0xac
mov ax, word [ecx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
add eax, edi
add eax, esi
mov esi, eax
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x28], 0
je 0x49eb8d
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push esi
push edx
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push ebp
push ebx
mov ecx, eax
call fcn.004b8ff0
jmp 0x49eb8f
xor eax, eax
push 1
push 0
mov ecx, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.0045a530
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret