joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f3a80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x5c04b4]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, 0xfffffffe
push 0x2710
mov dword [esp + 0x24], edi
mov esi, ecx
mov dword [esp + 0x14], ebx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
je 0x4f3ce1
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov edx, str.LICENSE
mov ecx, edi
call fcn.00531950
mov edi, eax
add esp, 8
test edi, edi
je 0x4f3bd1
nop
push str.FLAGS
mov edx, edi
mov ecx, esi
call fcn.00534600
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4f3ba8
mov edx, ebx
mov ecx, esi
call fcn.00534160
cmp eax, 1
jne 0x4f3ba8
lea eax, [esp + 0x1c]
mov edx, ebx
push eax
push str.VALUE
mov ecx, esi
call fcn.00534990
add esp, 8
neg eax
sbb eax, eax
inc eax
je 0x4f3ba8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x104
push eax
lea eax, [esp + 0x2c]
mov edx, edi
push eax
push 0x591558
mov ecx, esi
call fcn.00534260
add esp, 0xc
test eax, eax
je 0x4f3ba8
mov eax, dword [esp + 0x1c]
sub eax, 2
jne 0x4f3ba8
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp word [esp + 0x28], bx
je 0x4f3bae
lea eax, [esp + 0x28]
push str..lic
push eax
call dword [sym.imp.MSVCR120.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4f3b9b
call fcn.004f3d70
mov ebx, eax
mov dword [esp + 0x10], ebx
jmp 0x4f3bb0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4f3bb0
mov ebx, dword [esp + 0x10]
jmp 0x4f3bb0
xor ebx, ebx
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
mov edx, str.LICENSE
call fcn.00531950
mov edi, eax
add esp, 8
test edi, edi
jne 0x4f3af0
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
mov edx, str.LICENSE
mov dword [esp + 0x1c], 0
call fcn.00531950
mov edi, eax
add esp, 8
test edi, edi
je 0x4f3cd4
lea ebx, [ebx]
push str.FLAGS
mov edx, edi
mov ecx, esi
call fcn.00534600
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4f3caf
mov edx, ebx
mov ecx, esi
call fcn.00534160
cmp eax, 1
jne 0x4f3caf
lea eax, [esp + 0x1c]
mov edx, ebx
push eax
push str.VALUE
mov ecx, esi
call fcn.00534990
add esp, 8
neg eax
sbb eax, eax
inc eax
je 0x4f3caf
mov eax, dword [esp + 0x1c]
dec eax
jne 0x4f3caf
push str.CONTENTS
mov edx, edi
mov dword [esp + 0x1c], 0x2710
mov ecx, esi
call fcn.00534600
mov edi, eax
add esp, 4
test edi, edi
je 0x4f3caf
mov edx, edi
mov ecx, esi
call fcn.00534160
cmp eax, 3
jne 0x4f3caf
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push ebx
push str.VALUE
mov edx, edi
mov ecx, esi
call fcn.00534b90
add esp, 0xc
neg eax
sbb eax, eax
inc eax
je 0x4f3caf
mov edx, dword [esp + 0x18]
mov ecx, ebx
call fcn.004f3770
mov dword [esp + 0x10], eax
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
mov edx, str.LICENSE
call fcn.00531950
mov edi, eax
add esp, 8
test edi, edi
jne 0x4f3c00
mov ebx, dword [esp + 0x10]
push dword [esp + 0x24]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov ecx, dword [esp + 0x234]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x4f3d70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.0050a4d0
add esp, 4
test al, al
je 0x4f3e75
push str.License_
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.0052fae0
push str..lic
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.0052fae0
add esp, 8
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f3e63
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
test byte [ebp - 0x460], 0x10
jne 0x4f3e4e
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.0050a4d0
add esp, 4
test al, al
je 0x4f3e29
push str.License_
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.0052fae0
add esp, 4
lea eax, [ebp - 0x434]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x210]
call fcn.0052fae0
add esp, 4
lea ecx, [ebp - 0x210]
call fcn.00509d60
lea eax, [ebp - 0x460]
push eax
push esi
call edi
test eax, eax
jne 0x4f3df0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
pop edi
xor ecx, ebp
pop esi
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x4f40c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
mov eax, ecx
mov dword [ebp - 0xc], edx
push closesocket
push eax
mov dword [ebp - 0x10], eax
call dword [0x5c008c]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4f40fd
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
xor ebx, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
test edi, edi
je 0x4f4132
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x4f412d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
test eax, eax
jne 0x4f4132
mov ebx, 1
test ebx, ebx
je 0x4f4206
cmp dword [ebp - 4], 0
ja 0x4f4206
jb 0x4f4152
cmp esi, 0x10000
ja 0x4f4206
push esi
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4f4175
push edi
lea esi, [eax - 5]
call dword [0x5c001c]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f41e7
cmp dword [ebp - 4], esi
jne 0x4f41e7
sub esp, 0xc
mov edx, esi
mov ecx, ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.004f4220
mov esi, eax
add esp, 0x24
test esi, esi
js 0x4f41ec
mov ecx, dword [ebp + 0xc]
mov edx, 0x105
push dword [ebp - 0x10]
lea ecx, [ecx + 0x31c]
call fcn.0052fa00
add esp, 4
push ebx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
push edi
call dword [0x5c001c]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xfffffffe
push ebx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
push edi
call dword [0x5c001c]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov esi, 0xfffffffc
call dword [0x5c001c]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f4cd0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcdc
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x468]
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4f4e2e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f4d06
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
cmp ecx, 0x105
jae 0x4f4d35
push esi
push 0x105
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
jmp 0x4f4d50
push 0x104
push esi
push 0x105
push eax
call dword [sym.imp.MSVCR120.dll_wcsncpy_s]
add esp, 0x10
xor eax, eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x218]
push 0x5c
push eax
call dword [sym.imp.MSVCR120.dll_wcsrchr]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4f4d70
lea edi, [ebp - 0x218]
jmp 0x4f4d73
add edi, 2
test byte [ebp - 0x468], 0x10
jne 0x4f4e11
mov eax, edi
lea ecx, [ebp - 0x218]
sub eax, ecx
mov esi, 0x105
sar eax, 1
sub esi, eax
je 0x4f4de4
lea ecx, [ebp - 0x43c]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f4da0
sub ecx, edx
sar ecx, 1
cmp ecx, esi
jae 0x4f4dc7
lea eax, [ebp - 0x43c]
push eax
push esi
push edi
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
jmp 0x4f4de4
lea eax, [esi - 1]
push eax
lea eax, [ebp - 0x43c]
push eax
push esi
push edi
call dword [sym.imp.MSVCR120.dll_wcsncpy_s]
add esp, 0x10
xor eax, eax
mov word [edi + esi*2 - 2], ax
sub esp, 0xc
lea eax, [ebp - 0x7b0]
xor edx, edx
lea ecx, [ebp - 0x218]
push fcn.0042d290
push 0x49ba60
push eax
lea eax, [ebp - 0xcd8]
push eax
push 0
call fcn.004f40c0
add esp, 0x20
lea eax, [ebp - 0x468]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4f4d73
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x4f5270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
lea edx, [ebp - 4]
push edx
mov eax, dword [ebx]
mov edx, esi
add eax, 0x100
push 0
push eax
push 0x1c
call fcn.004f6050
add esp, 0x10
test eax, eax
jne 0x4f5350
cmp dword [ebp - 4], 0x1c
jne 0x4f5350
cmp dword [esi + 4], 5
je 0x4f52bc
mov eax, 0x1771
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
lea edx, [esi + 1]
mov dword [ebp - 4], eax
mov edi, 7
mov dword [esi + 0x18], 0
or eax, 0xffffffff
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
dec edi
jne 0x4f52d4
not eax
cmp dword [ebp - 4], eax
jne 0x4f5350
cmp dword [esi], 0x45fa785e
jne 0x4f5350
add dword [ebx], 0x11c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x1770
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f5360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
add dword [ecx], 0x108
or ecx, 0xffffffff
push esi
mov esi, dword [edx + 0x104]
push edi
mov dword [edx + 0x104], 0
mov edi, 0x2c
inc edx
movzx eax, byte [edx - 1]
lea edx, [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x58e240]
movzx eax, byte [edx - 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x58e240]
movzx eax, byte [edx - 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x58e240]
movzx eax, byte [edx - 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x58e240]
movzx eax, byte [edx - 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x58e240]
movzx eax, byte [edx - 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x58e240]
dec edi
jne 0x4f5381
not ecx
sub esi, ecx
neg esi
pop edi
sbb esi, esi
and esi, 0x1770
mov eax, esi
pop esi
ret

Function at 0x4f5420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
add dword [ecx], 0x24
or eax, 0xffffffff
push esi
push edi
mov edi, dword [edx + 0x20]
mov esi, 6
mov dword [edx + 0x20], 0
inc edx
jmp 0x4f5440
movzx ecx, byte [edx - 1]
lea edx, [edx + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
movzx ecx, byte [edx - 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58e240]
dec esi
jne 0x4f5440
not eax
sub eax, edi
neg eax
pop edi
sbb eax, eax
and eax, 0x1770
pop esi
ret
Function at 0x4f6050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
cmp eax, 0xffffffff
jne 0x4f6075
cmp ecx, 0xffffffff
je 0x4f611e
cmp byte [0x5c6a90], 0
je 0x4f60d3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jg 0x4f609d
jl 0x4f608e
test eax, eax
jae 0x4f609d
push 0x19
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
or ecx, eax
jmp 0x4f6106
push 0xe
push 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [0x5c0080]
mov esi, eax
push esi
call dword [0x5c00a8]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x4f60cb
or eax, 0xffffffff
or ecx, eax
jmp 0x4f6106
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x4f6106
push 0
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4f6103
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4f6100
or eax, 0xffffffff
or ecx, eax
jmp 0x4f6106
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x4f611b
cmp ecx, eax
jne 0x4f611b
mov eax, 0x1b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
cmp byte [0x5c6a90], 0
je 0x4f6136
push dword [ebp + 8]
mov ecx, edi
call fcn.005029e0
add esp, 4
jmp 0x4f6153
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4f6150
or eax, 0xffffffff
jmp 0x4f6153
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
jne 0x4f6164
mov eax, 0x1b5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4f616a
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f7350
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp edi, 0xffffffff
je 0x4f73b3
test edx, edx
je 0x4f73b3
cmp dword [ebp + 8], 0
jl 0x4f73b3
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4f73b3
xor eax, eax
test byte [ebp + 0xc], 1
je 0x4f7379
mov eax, 1
test byte [ebp + 0xc], 2
je 0x4f7382
or eax, 2
push dword [ecx + 4]
push dword [ecx]
push eax
push dword [ebp + 8]
push edx
push edi
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x4f73ab
cmp eax, 0xffffffff
je 0x4f73ab
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4f73a6
mov dword [ecx], eax
xor eax, eax
pop edi
pop ebp
ret
mov eax, 0x1388
pop edi
pop ebp
ret
mov eax, 0x1b62
pop edi
pop ebp
ret
Function at 0x4f7640
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ecx, 0xffffffff
je 0x4f7687
test edx, edx
je 0x4f7687
mov eax, dword [ebp + 8]
test eax, eax
jns 0x4f766c
push dword [edx + 4]
push dword [edx]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
neg eax
sbb eax, eax
and eax, 0x1388
pop ecx
pop ebp
ret
push eax
call fcn.00500fa0
xor ecx, ecx
add esp, 4
test eax, eax
setns cl
lea eax, [ecx - 1]
and eax, 0x1388
pop ecx
pop ebp
ret
mov eax, 0x1b62
pop ecx
pop ebp
ret

Function at 0x4f7f90
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov esi, eax
push edi
mov edi, edx
test eax, eax
jle 0x4f8080
jmp 0x4f7fc0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x110], ebx
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 1
push eax
push 0
push 1
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x224], 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x114]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x4f8069
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4f8049
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4f807d
jmp 0x4f804d
add edi, eax
sub esi, eax
test esi, esi
jg 0x4f7fc0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x220], 0
jne 0x4f807d
push 0x5b4
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553510
mov esp, ebp
pop ebp
ret

Function at 0x4f85f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5674ac
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c04b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], vtable.CBuffer.0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], vtable.CArray_class_http::CHTTPBuffer__class_http::CHTTPBuffer_const__.0
mov dword [esi + 0x34], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x44], vtable.CArray_class_http::CHTTPBuffer__class_http::CHTTPBuffer_const__.0
mov dword [esi + 0x48], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x58], vtable.CBuffer.0
mov dword [esi + 0x60], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov byte [ebp - 4], 3
call fcn.004f86e0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f8b70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov dword [ebp - 0x20c], eax
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x4f8ce3
test eax, eax
je 0x4f8ce3
push 0x100
mov dword [eax], 0
lea eax, [ebp - 0x204]
push eax
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
lea edx, [ebp - 0x204]
push esi
mov ecx, 0x100
mov word [ebp - 6], ax
call fcn.00500540
mov esi, eax
add esp, 4
test esi, esi
je 0x4f8cce
mov ecx, esi
call fcn.00500690
push esi
mov dword [ebp - 0x208], eax
call dword [0x5c0248]
mov esi, dword [ebp - 0x208]
test esi, esi
je 0x4f8cce
push edi
mov edi, esi
jmp 0x4f8c10
push dword [edi + 0x10]
push dword [edi + 0xc]
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x4f8c4d
push dword [ebp + 0xc]
mov edx, edi
mov ecx, eax
call fcn.00500fa0
add esp, 4
test eax, eax
je 0x4f8c56
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x4f8c4d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], 0xffffffff
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x4f8c10
jmp 0x4f8c65
mov ecx, edi
call fcn.00500b40
mov ecx, dword [ebp - 0x20c]
mov dword [ecx], eax
mov ecx, dword [esi + 0x14]
call fcn.00500b10
push dword [esi]
mov esi, dword [sym.imp.MSVCR120.dll_free]
call esi
mov eax, dword [ebp - 0x208]
push eax
call esi
add esp, 8
test edi, edi
pop edi
jne 0x4f8c9d
pop esi
mov eax, 0x4e23
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 1
push 6
push dword [ebx]
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0x4e22
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x4e21
pop esi
xor ecx, ebp
pop ebx
call fcn.00553510
mov esp, ebp
pop ebp
ret

Function at 0x4f8fe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
xor eax, eax
mov dword [edi], 0
mov ecx, dword [esi + 0xc]
test cl, 1
je 0x4f8fff
mov eax, 1
test cl, 2
je 0x4f9007
or eax, 2
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4f9041
cmp eax, 0xffffffff
je 0x4f9041
test eax, eax
jne 0x4f9037
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
mov eax, 0x4e34
pop esi
pop ebp
ret 0xc
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00503330
cmp eax, 0x10
jne 0x4f905e
pop edi
mov eax, 0x4e35
pop esi
pop ebp
ret 0xc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
mov eax, 0x4e2a
pop esi
pop ebp
ret 0xc
Function at 0x500320
Capabilities:
Create udp socket

Disassembly:
mov eax, ecx
xor edx, edx
and eax, 3
dec eax
je 0x50033a
dec eax
je 0x500333
jmp dword [sym.imp.MSVCR120.dll_abort]
mov eax, 0x17
jmp 0x50033f
mov eax, 2
and ecx, 0x300
cmp ecx, 0x100
je 0x500365
cmp ecx, 0x200
jne 0x50036a
push 0
mov edx, 2
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
ret
mov edx, 1
push 0
push edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
ret

Function at 0x500380
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
test cl, 1
je 0x500395
mov eax, 1
test cl, 2
je 0x50039d
or eax, 2
push eax
push dword [ebp + 8]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
pop esi
cmp eax, 0xffffffff
jne 0x5003b1
or eax, eax
pop ebp
ret

Function at 0x5003c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 0x24], 0x1c
mov ecx, dword [ebp + 0xc]
test cl, 1
je 0x5003ed
mov eax, 1
test cl, 2
je 0x5003f5
or eax, 2
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp + 8]
push edx
push edi
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
cmp edi, 0xffffffff
jne 0x500423
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x500438
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.00500640
mov dword [esi], eax
test eax, eax
je 0x500410
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00553510
mov esp, ebp
pop ebp
ret

Function at 0x500450
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
test cl, 1
je 0x500465
mov eax, 1
test cl, 2
je 0x50046d
or eax, 2
push eax
push dword [ebp + 8]
push edx
push esi
call dword [sym.imp.WS2_32.dll_send]
pop esi
cmp eax, 0xffffffff
jne 0x500481
or eax, eax
pop ebp
ret