joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48486c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov edx, dword [ebp + 0xa4]
mov dword [esp + 0x28], edx
mov eax, dword [ebp]
mov edi, dword [eax + 0x20]
mov eax, dword [0x68bb7c]
call dword [eax + 0x2b4]
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0x88
mov dword [esp], 0x68b600
mov eax, dword [0x68bb7c]
call dword [eax + 0x4cc]
mov ebx, eax
inc dword [eax]
test byte [ebp + 0x8b], 0x20
jne 0x4849f4
mov dword [esp], ebp
call fcn.004cd1f8
mov esi, eax
test eax, eax
jne 0x4849e8
mov ebp, dword [ebp]
test ebp, ebp
je 0x4849e8
test edi, edi
je 0x484a38
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0041c9b4
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x34]
mov dword [esp + 0x44], edx
add edx, dword [edi + 0x44]
mov dword [esp + 0x4c], edx
add eax, dword [edi + 0x40]
mov dword [esp + 0x48], eax
mov dword [esp], 0
mov eax, dword [0x68bb7c]
call dword [eax + 0x3ac]
mov dword [esp], 0x17
call sub.USER32.dll_GetSystemMetrics
push edi
test eax, eax
je 0x484a18
mov dword [esp], 1
call sub.USER32.dll_GetAsyncKeyState
push ecx
test ax, ax
js 0x484a2e
xor eax, eax
lea edx, [esp + 0x40]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x7c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.USER32.dll_TrackPopupMenu
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x3ac]
lea eax, [esp + 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetCursorPos
push edi
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00481ce0
mov ebp, dword [ebx]
test ebp, ebp
je 0x4849dc
mov dword [ebx], 0
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
dec dword [ebx]
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], fcn.00483758
mov eax, dword [0x68bb7c]
call dword [eax + 0x148]
mov dword [esp], ebp
call fcn.00483758
jmp 0x4848c1
mov dword [esp], 2
call sub.USER32.dll_GetAsyncKeyState
push edx
test ax, ax
jns 0x484959
mov eax, 2
jmp 0x48495b
mov eax, dword [esp + 0x7c]
sub eax, 0x32
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x7c]
add eax, 0x32
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x78]
sub eax, 0x32
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x78]
add eax, 0x32
mov dword [esp + 0x48], eax
jmp 0x48491c
Function at 0x492e0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x2c]
mov ecx, 3
mov edx, dword [esp + 0x28]
mov eax, edi
call fcn.00491894
test eax, eax
je 0x492e48
mov eax, dword [eax + 0x14]
mov edx, dword [esp + 0x24]
mov esi, dword [edx + eax]
test esi, esi
je 0x492e48
mov eax, esi
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00491a2c
mov esi, eax
test eax, eax
je 0x492e6f
mov eax, esi
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov ebx, dword [ebx + 0x78]
test ebx, ebx
je 0x492e3c
mov dword [esp + 4], edi
lea eax, [ebx + 0x3c]
mov dword [esp], eax
call dword [ebx + 0x68]
test eax, eax
je 0x492e6c
mov esi, dword [eax + 0xc]
jmp 0x492e3c
Function at 0x4a9504
Capabilities:
Hide graphical window

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov ebp, dword [esp + 0xd0]
call fcn.00433ee4
mov ebx, eax
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], eax
mov esi, str.TtkMonitorWindow
mov ecx, 0x11
mov edi, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x51]
xor eax, eax
mov cl, 0xf
rep stosb byte es:[edi], al
lea edi, [esp + 0x60]
mov esi, str.TtkMonitorClass
mov cl, 4
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x70]
mov cl, 0x10
rep stosb byte es:[edi], al
mov dword [esp + 0x80], 0x30
mov dword [esp + 0x84], 3
mov dword [esp + 0x88], 0x4a93e0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], ebx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [esp + 0x98], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [esp + 0xac], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], 5
lea esi, [esp + 0x60]
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
lea eax, [esp + 0x80]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
push edx
test ax, ax
je 0x4a96ec
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xcf0000
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov ebx, eax
mov dword [esp + 8], ebp
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call sub.USER32.dll_SetWindowLongA
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], ebx
call sub.USER32.dll_UpdateWindow
push eax
mov dword [esp + 8], 0x4a94f0
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.00491d04
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.004d23a0
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.004d32f8
xor eax, eax
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
jmp 0x4a96b3
Function at 0x4dc9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x60]
mov ebp, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x24], eax
cmp eax, 1
sbb ebx, ebx
not ebx
and ebx, 8
mov edi, dword [ebp]
mov edx, dword [esp + 0x28]
mov edx, dword [edx]
mov dword [esp + 0x2c], edx
mov ecx, dword [edi + 0x68]
test ecx, ecx
je 0x4dca2c
test esi, esi
je 0x4dca1f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.__is_busy
mov eax, dword [edi]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x61b01c
mov dword [esp], esi
call fcn.004e1460
mov eax, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x6c]
test edx, edx
je 0x4dca50
test esi, esi
je 0x4dca1f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.__is_busy
mov eax, dword [eax]
jmp 0x4dca0b
mov eax, dword [edi + 4]
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x2c]
mov edx, dword [edx + 4]
mov dword [esp + 0x3c], edx
and eax, 8
mov dword [esp + 0x34], eax
cmp ebx, eax
je 0x4dca81
xor ecx, ecx
test ebx, ebx
setne cl
mov edx, ebp
mov eax, esi
call fcn.004d95b0
test eax, eax
jne 0x4dca1f
cmp ebp, dword [esp + 0x28]
je 0x4dcab4
mov eax, dword [esp + 0x3c]
and eax, 8
cmp ebx, eax
je 0x4dcab4
xor ecx, ecx
test ebx, ebx
setne cl
mov edx, dword [esp + 0x28]
xor eax, eax
call fcn.004d95b0
test eax, eax
je 0x4dcab4
cmp ebx, dword [esp + 0x34]
jne 0x4dcb41
nop
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 4]
and eax, 0xffffffcf
or eax, 0x20
mov dword [edx + 4], eax
mov eax, dword [edi + 0x60]
add eax, 0x30
mov dword [esp], eax
call fcn.004edfec
mov edx, dword [edi + 0x60]
mov dword [eax + 0x28], edx
mov dword [eax], ebp
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 0x10], edx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], esi
mov edx, dword [esp + 0x24]
test edx, edx
je 0x4dcb15
mov edx, dword [esp + 0x24]
inc dword [edx]
mov edx, dword [esp + 0x24]
mov dword [eax + 0x24], edx
mov dword [edi + 0x68], eax
mov edx, dword [esp + 0x2c]
mov dword [edx + 0x6c], eax
cmp ebx, 8
jne 0x4dcb33
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x4dcb5f
xor edx, edx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004db76c
xor ecx, ecx
mov ebx, dword [esp + 0x34]
test ebx, ebx
setne cl
mov edx, ebp
xor eax, eax
call fcn.004d95b0
mov eax, 1
jmp 0x4dca24
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4dc050
mov dword [esp], 0
call fcn.004d3adc
xor eax, eax
jmp 0x4dca24
Function at 0x4ef034
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov ecx, dword [0x68b87c]
test ecx, ecx
je 0x4ef060
mov eax, dword [0x68b880]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
mov ebx, eax
test eax, eax
je 0x4ef088
mov eax, ebx
add esp, 0x18
pop ebx
ret
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x68b880], eax
mov dword [0x68b87c], 1
cmp eax, 0xffffffff
jne 0x4ef047
mov dword [esp], str.could_not_allocate_thread_local_storage
call fcn.00508cd0
jmp 0x4ef042
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x4ef056
mov dword [esp], str.TlsGetValue_failed_from_TclpGetAllocCache
call fcn.00508cd0
jmp 0x4ef056

Function at 0x4ef0a0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [0x68b880]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x4ef0c4
add esp, 0x1c
ret
mov dword [esp + 0x20], str.TlsSetValue_failed_from_TclpSetAllocCache
add esp, 0x1c
jmp fcn.00508cd0

Function at 0x4ef0d4
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4ef118
mov dword [esp], eax
call fcn.0050cec0
mov dword [esp + 4], 0
mov eax, dword [0x68b880]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x4ef108
add esp, 0x1c
ret
mov dword [esp + 0x20], str.TlsSetValue_failed_from_TclpFreeAllocCache
add esp, 0x1c
jmp fcn.00508cd0
mov ecx, dword [0x68b87c]
test ecx, ecx
je 0x4ef103
mov eax, dword [0x68b880]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsFree
push edx
test eax, eax
je 0x4ef144
mov dword [0x68b87c], 0
add esp, 0x1c
ret
mov dword [esp], str.TlsFree_failed_from_TclpFreeAllocCache
call fcn.00508cd0
jmp 0x4ef134
Function at 0x4f4420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
test byte [esi], 4
je 0x4f445f
inc dword [esi + 8]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004f428c
mov edx, eax
test byte [esi], 4
je 0x4f4495
dec dword [esi + 8]
test edx, edx
je 0x4f4544
cmp dword [edx], 1
jle 0x4f44df
mov dword [esp], edx
call fcn.004dd9c0
mov edx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
call fcn.00532230
test eax, eax
mov edx, dword [esp + 0x2c]
je 0x4f4500
mov eax, dword [edx]
dec eax
mov dword [edx], eax
test eax, eax
jle 0x4f4538
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
call fcn.00532230
test eax, eax
mov edx, dword [esp + 0x2c]
jne 0x4f44d5
nop
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x78], edi
mov dword [esp + 0x74], edx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004f3d9c
mov dword [esp], edx
call fcn.004dd854
jmp 0x4f44d5
mov dword [esp], 0
call fcn.004de46c
mov edx, eax
jmp 0x4f449d
Function at 0x4f6944
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [esp + 0x50]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x60]
mov ebp, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
test eax, eax
je 0x4f69d8
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
call fcn.004eb494
mov ebx, eax
inc dword [eax]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call fcn.004f573c
mov edx, dword [ebx]
dec edx
mov dword [ebx], edx
test edx, edx
jle 0x4f6a10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], 0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x50], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004f573c
mov dword [esp], ebx
mov dword [esp + 0x24], eax
call fcn.004dd854
mov eax, dword [esp + 0x24]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4f8a9c
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x61c
mov esi, eax
xor eax, eax
mov ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
lea ebx, [edx + ecx - 2]
cmp edx, ebx
jb 0x4f8acd
jmp 0x4f8ae0
dec ebx
cmp ebx, edx
je 0x4f8c7c
cmp byte [ebx], 0x2f
jne 0x4f8ac4
mov ecx, ebx
sub ecx, edx
dec eax
cmp ecx, eax
je 0x4f8c0c
inc ebx
cmp ebx, edx
je 0x4f8c7c
mov dword [esp + 8], 0x104
lea ebp, [esp + 0xfc]
mov dword [esp + 4], ebp
mov dword [esp], 0x61e932
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
test eax, eax
jne 0x4f8b50
mov byte [esp + 0x304], 0
mov dword [esp + 8], 0x104
lea edi, [esp + 0x304]
mov dword [esp + 4], edi
mov dword [esp], str.TCL_LIBRARY
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
cmp byte [esp + 0x304], 0
jne 0x4f8b6a
add esp, 0x61c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0x304]
mov edx, edi
mov eax, ebp
call fcn.004f894c
cmp byte [esp + 0x304], 0
je 0x4f8b42
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call fcn.004eb494
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 0
call fcn.004dfccc
mov dword [esp], edi
call fcn.0053eab4
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00570790
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x4f8bd1
mov edx, dword [esp + 0x24]
mov eax, dword [edx + eax*4 - 4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpiA
sub esp, 8
test eax, eax
jne 0x4f8c26
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call fcn.004eb494
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 0
call fcn.004dfccc
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.004ee144
add esp, 0x61c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.last_character_in_lib_cannot_be__
mov dword [esp + 0x1c], edx
call fcn.00508cd0
mov edx, dword [esp + 0x1c]
inc ebx
jmp 0x4f8ae0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [eax + edx*4 - 4], ebx
lea ebx, [esp + 0x28]
mov dword [esp], ebx
call fcn.004fe628
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00570c38
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004eb494
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
call fcn.004fe768
mov eax, dword [esp + 0x1c]
jmp 0x4f8be1
mov dword [esp], str.no___character_found_in_lib
call fcn.00508cd0
jmp 0x4f8ae8
Function at 0x4fb470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], 0x68b8a4
call fcn.004eec50
test ebx, ebx
je 0x4fb4d8
mov dword [esp + 4], ebx
mov dword [esp], 0x68b8c0
call dword [0x68b8ec]
test eax, eax
je 0x4fb4bc
mov ebx, dword [eax + 0xc]
inc dword [ebx + 0x1c]
mov dword [esp], 0x68b8a4
call fcn.004eecb4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], 0x68b8a4
call fcn.004eecb4
mov edx, ebx
mov eax, esi
add esp, 0x14
pop ebx
pop esi
jmp fcn.004fabec
mov eax, dword [0x68b8fc]
inc dword [eax + 0x1c]
mov dword [esp], 0x68b8a4
call fcn.004eecb4
mov ebx, dword [0x68b8fc]
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4fc074
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
call fcn.004fe628
mov edi, dword [ebx]
mov edx, dword [ebx + 8]
dec edx
test ebp, ebp
je 0x4fc178
mov eax, dword [esp + 0x74]
test eax, eax
je 0x4fc18c
mov eax, dword [esp + 0x78]
test eax, eax
js 0x4fc199
mov eax, 3
jmp 0x4fc0d8
lea eax, [eax + eax + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
mov edi, dword [ebx]
add edi, esi
mov edx, esi
not edx
add edx, dword [ebx + 4]
mov eax, 2
lea ecx, [esp + 0x4c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x40]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x3c], edx
call dword [ebp + 4]
mov esi, dword [esp + 0x48]
add esi, edi
sub esi, dword [ebx]
cmp eax, 0xfffffffc
mov edx, dword [esp + 0x3c]
jne 0x4fc160
mov eax, dword [esp + 0x44]
add dword [esp + 0x74], eax
sub dword [esp + 0x78], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4fc0b8
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx + 4]
jmp 0x4fc0b8
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [0x68b8fc]
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x4fc0a5
nop
mov dword [esp + 0x78], 0
jmp 0x4fc0b1
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 0x3c], edx
call dword [ebp + 0x18]
mov dword [esp + 0x78], eax
mov edx, dword [esp + 0x3c]
jmp 0x4fc0b1
Function at 0x4fc2d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
call fcn.004fe628
mov edx, dword [ebx]
mov esi, dword [ebx + 8]
dec esi
test ebp, ebp
je 0x4fc410
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x4fc424
mov eax, dword [esp + 0x78]
test eax, eax
js 0x4fc3e0
mov eax, 3
mov ecx, esi
mov esi, edx
jmp 0x4fc33c
lea eax, [eax + eax + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
mov esi, dword [ebx]
add esi, edi
mov ecx, edi
not ecx
add ecx, dword [ebx + 4]
mov eax, 2
lea edx, [esp + 0x4c]
mov dword [esp + 0x24], edx
lea edx, [esp + 0x48]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x44]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
lea edx, [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
call dword [ebp + 8]
mov edi, dword [esp + 0x48]
add edi, esi
sub edi, dword [ebx]
cmp eax, 0xfffffffc
mov ecx, dword [esp + 0x3c]
jne 0x4fc3c4
mov eax, dword [esp + 0x44]
add dword [esp + 0x74], eax
sub dword [esp + 0x78], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4fc31c
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx + 4]
jmp 0x4fc31c
cmp dword [ebp + 0x10], 2
je 0x4fc3fc
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [esp + 0x74]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x78], ecx
jmp 0x4fc311
lea eax, [edi + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
jmp 0x4fc3ca
mov ebp, dword [0x68b8fc]
mov ecx, dword [esp + 0x74]
test ecx, ecx
jne 0x4fc305
nop
mov dword [esp + 0x78], 0
jmp 0x4fc311
Function at 0x514490
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
mov ebp, edx
mov edx, ecx
mov ecx, 0x10
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
mov word [ebx], 2
and edx, 0xffff
mov dword [esp], edx
call sub.WS2_32.dll_htons
push edi
mov word [ebx + 2], ax
test ebp, ebp
je 0x5144e8
mov dword [esp], ebp
call sub.WS2_32.dll_inet_addr
push esi
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x5144ec
mov dword [ebx + 4], eax
mov eax, 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x5144d6
mov dword [esp], ebp
call sub.WS2_32.dll_gethostbyname
push ecx
test eax, eax
je 0x514510
lea edx, [esp + 0x1c]
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
jmp 0x5144d6
mov dword [esp], 0x94
call fcn.00505cd8
xor eax, eax
jmp 0x5144de