joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47861d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5e4ef4
call fcn.0046dc86
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0046432a
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004643f0
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x47865d
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4786bd
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x478698
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4786bd
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0046433d
call fcn.0046dc4f
ret 0xc
Function at 0x478b77
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x5e4f8f
call fcn.0046dcba
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x478c6e
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x478bf3
lea eax, [ebp - 0x218]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402ac0
and dword [ebp - 4], 0
push 0x5e6bac
call fcn.0048ed77
pop ecx
push eax
push 0x5e6bac
lea ecx, [ebp - 0x230]
call fcn.00405c20
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004787da
mov edi, eax
lea ecx, [ebp - 0x230]
push 0
push 1
test edi, edi
je 0x478c5f
call fcn.0041ece0
mov eax, edi
jmp 0x478d20
or dword [ebp - 4], 0xffffffff
call fcn.0041ece0
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x478d1e
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x478cb5
lea eax, [ebp - 0x218]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00402ac0
mov esi, 0x5e6bac
mov dword [ebp - 4], 1
push esi
call fcn.0048ed77
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00405c20
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004787da
push 0
lea ecx, [ebp - 0x248]
mov esi, eax
push 1
call fcn.0041ece0
test esi, esi
je 0x478d1e
mov eax, esi
jmp 0x478d20
xor eax, eax
call fcn.0046dc64
ret 4
Function at 0x478d28
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
test edi, edi
jne 0x478d50
xor eax, eax
jmp 0x478e86
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x478d49
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x478e74
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x478e4e
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.00480620
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push 0x5e88ac
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x478e42
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004809d6
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x478e7c
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x20c]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x478db9
push dword [ebp - 0x418]
call ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4
Function at 0x479974
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x479999
xor eax, eax
jmp 0x479a2c
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push esi
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x109
push esi
push str.SYSTEMCurrentControlSetServices_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x479a2a
push ebx
push 0x104
lea eax, [ebp - 0x20c]
mov ebx, esi
push eax
push esi
jmp 0x479a08
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0048ce61
pop ecx
pop ecx
test eax, eax
je 0x479a1a
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4799e7
jmp 0x479a1d
xor esi, esi
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4
Function at 0x479e2a
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push 0x83c
mov eax, 0x5e3e7e
call fcn.0046dcba
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], ebx
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
je 0x479e95
lea eax, [ebp - 0x218]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.00402ac0
mov dword [ebp - 4], ebx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
push ebx
call fcn.0048ed77
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x848]
call fcn.00405c20
xor ebx, ebx
cmp word [esi], bx
jne 0x479ecf
mov eax, ebx
jmp 0x479ed6
push esi
call fcn.0048ed77
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.00405c20
mov esi, 0x5e89ec
push esi
call fcn.0048ed77
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.00405c20
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x479fe4
push 0x208
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.00480620
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.0048edc3
add esp, 0x20
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.00478503
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
call fcn.0048ed77
pop ecx
test eax, eax
jne 0x479fd2
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0048edc3
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x479fe4
xor esi, esi
inc esi
jmp 0x479fe6
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x848]
call fcn.0041ece0
mov eax, esi
call fcn.0046dc64
ret 4
Function at 0x479ffe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x679b40]
test al, al
jne 0x47a097
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x47a08e
lea eax, [ebp - 0x20c]
push eax
call fcn.0048d1ac
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.004809d6
pop ecx
pop ecx
test eax, eax
jne 0x47a086
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.004809d6
pop ecx
pop ecx
test eax, eax
je 0x47a08e
mov byte [0x679b40], bl
jmp 0x47a094
mov bl, byte [0x679b40]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x47ab60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x47abcb
lea eax, [ebp - 0x20c]
push 0x5e6bac
push eax
call fcn.0048ed92
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0047a0a5
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4

Function at 0x47c49f
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x89], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x47d8c6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [eax + 0x210]
mov dword [ebp - 8], eax
mov esi, dword [ecx]
push edi
mov dword [ebp - 0xc], ecx
cmp esi, dword [eax + 0x214]
je 0x47d994
lea edi, [esi + 0x28]
mov dword [ebp + 8], edi
lea ecx, [ebx + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5eab7c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5eab7c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5eab7c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5eab7c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.0048f7c0
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x47d974
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.0048f7c0
pop ecx
pop ecx
test eax, eax
je 0x47d990
mov eax, 0x1b0
add edi, eax
add esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
je 0x47d994
jmp 0x47d8f8
mov byte [ebp - 1], 1
call fcn.00451f63
test al, al
je 0x47d9ad
sub eax, dword [ebx + 0x39]
mov ah, 0x1e
push eax
je 0x47d9e4
sub dh, byte [ecx + 0x3267013]
adc eax, 0xff7d8078
add byte [ebp + 0x1e], dh
cmp byte [ebp - 1], 0
jne 0x47d9d1
lea edx, [ebx + 0xa8]
push edx
call fcn.0048edf0
pop ecx
test eax, eax
je 0x47d9d1
mov ecx, dword [ebp - 0xc]
push ebx
call fcn.0047e704
mov al, 1
jmp 0x47d9d3
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop ebp
adc al, 0x56
Function at 0x47e5d1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x210]
push ebx
push esi
push edi
mov dword [ebp - 0x11c], ecx
mov dword [ecx + 0x214], eax
call fcn.004522e4
test al, al
je 0x47e616
invalid
call fcn.00452101
test al, al
je 0x47e63d
jns 0x47e632
retf 0xf85e
mov byte [0xd9cef5b3], al
das
invalid
call fcn.004521d0
test al, al
je 0x47e665
inc esi
shl dword [ebx], 0xa
fimul word [ecx]
popfd
or dword [edx + 0x3e], esp
fmul st(1)
test eax, 0x9dd36cb3
mov dword [edi + eax*2 - 0x903cf92], ecx
sbb dword [esi - 0x5724803b], edi
cli
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
mov esi, dword [ebp - 0x11c]
jne 0x47e6a8
mov ecx, esi
call fcn.0047de91
jmp 0x47e6bd
mov edi, ebx
test ebx, ebx
jne 0x47e6bd
mov ecx, esi
call fcn.0047dce8
inc edi
mov ebx, eax
cmp edi, 0xa
jl 0x47e6aa
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x47e76f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 8], esi
call fcn.0048edf0
movzx ecx, byte [edi]
push ecx
lea ebx, [eax - 1]
mov dword [ebp - 0xc], ebx
call fcn.0047e6e2
pop ecx
pop ecx
test al, al
je 0x47e7ae
inc esi
movzx eax, byte [esi + edi]
push eax
call fcn.0047e6e2
pop ecx
test al, al
jne 0x47e79b
mov dword [ebp - 8], esi
cmp ebx, esi
jl 0x47e7c9
movzx eax, byte [ebx + edi]
push eax
call fcn.0047e6e2
pop ecx
test al, al
je 0x47e7c6
dec ebx
cmp ebx, esi
jge 0x47e7b2
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
mov ecx, esi
cmp esi, ebx
jg 0x47e7e4
mov edx, edi
sub edx, esi
mov al, byte [ecx + edi]
mov byte [edx + ecx], al
inc ecx
cmp ecx, ebx
jle 0x47e7d6
mov dword [ebp - 4], ecx
call fcn.004522e4
test al, al
je 0x47e801
int1
sub dword [edi + eax*8 - 0x7f], edx
add byte [esi - 0xcf5d3b0], cl
pop ebx
or dword [ebx - 0x24], ebp
sub eax, 0x2f8500d6
call fcn.00452101
test al, al
je 0x47e828
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
sub esp, ebx
xchg esi, eax
adc bh, al
mov ecx, 0x139b2e8b
mov esp, 0x586f6009
in al, dx
inc ebp
test byte [edi], bl
loope 0x47e7c6
and dl, byte [eax + ecx*2 + 0xa9c60]
call fcn.004521d0
test al, al
je 0x47e850
xchg ecx, eax
inc eax
cmpsb byte [esi], byte es:[edi]
jo 0x47e876
mov edx, 0x331f6497
lodsd eax, dword [esi]
or bh, dh
salc
cmc
xchg esi, eax
test al, 0xbe
int1
sbb edi, ebx
pop esp
aam 0xb4
stosb byte es:[edi], al
sub cl, cl
out dx, al
xchg ebp, eax
cmpsb byte [esi], byte es:[edi]
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, ecx
jl 0x47e869
mov edx, dword [ebp + 8]
mov byte [eax + edx], 0
dec eax
cmp eax, ecx
jge 0x47e860
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
dec ebx
add byte [eax], al
add byte [eax + 0x400000], bh

Function at 0x497aae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049792d

Function at 0x49a265
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00499f25
Function at 0x4a45a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x4a45cc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4a45bd
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x4a4600
cmp dword [esi + 8], 0
jne 0x4a45f0
push 0x5eab88
push dword [eax + 8]
call fcn.0048d840
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4a45f0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0048dcf2
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4a4622
mov eax, dword [esi + 8]
test eax, eax
je 0x4a461c
push eax
call fcn.0048d627
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4a4a40
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4a4a90
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4a4a8a
shr eax, 8
cmp al, 2
jne 0x4a4a8a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x4a5af0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b68d0

Function at 0x4a6b10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x168]
call fcn.004a6df0
add esp, 8
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x4a6b94
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4a6b6c
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0x51
xor eax, eax
pop ebp
ret
push esi
push edi
call fcn.004a4b90
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.004a67d0
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x85b8], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4a6df0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, edx
push ebx
push esi
shl eax, 4
lea esi, [ecx + 0x18c]
mov ebx, dword [ecx + edx*4 + 0x168]
add esi, eax
mov eax, dword [ecx + 0x248]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x4a6ea0
cmp dword [ecx + edx*4 + 0x17c], 0x4a6a60
jne 0x4a6ea0
cmp dword [esi], 0
je 0x4a6e38
test edi, edi
je 0x4a6ea0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.004b4eb0
add esp, 0x10
cmp eax, 0xffffffff
je 0x4a6ea0
test al, 1
je 0x4a6ea0
cmp dword [esi], 0
jne 0x4a6e89
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x674cf4]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x4a6e89
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4a6ea0
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a6eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x4a6ed9
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4a6f0f
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x5f8020
push 2
push eax
call fcn.0048ecbb
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0048ecbb
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4ace90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4aceae
cmp dword [esi + 0x48], 0
je 0x4aceae
push 2
push 3
push esi
call fcn.004ba920
add esp, 0xc
push dword [ebp + 0xc]
call fcn.004bb0e0
add esp, 4
test esi, esi
je 0x4acece
cmp dword [esi + 0x48], 0
je 0x4acece
push 3
push esi
call fcn.004ba960
add esp, 8
pop esi
pop ebp
ret
Function at 0x4b5400
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x578]
test esi, esi
je 0x4b5454
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x4b5421
cmp dword [edi + 0x40], eax
je 0x4b5454
mov dword [ebp - 8], esi
mov byte [ebp - 4], 0
test eax, eax
jne 0x4b542f
mov eax, dword [edi + 0x40]
push 0x4b6240
lea ecx, [ebp - 8]
add eax, 0x68
push ecx
push eax
call fcn.004bfb00
add esp, 0xc
cmp byte [ebp - 4], 0
jne 0x4b545d
mov dword [edi + 0x578], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4b5466
mov dword [eax], esi
cmp byte [esi + 0x1ac], 0
mov edi, dword [esi + 0x168]
je 0x4b548b
push esi
call fcn.004a5af0
add esp, 4
test eax, eax
jne 0x4b54a3
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
je 0x4b54a3
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4b5454
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b58f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67a948]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x4b5941
push 3
push 2
push eax
push 6
call fcn.004d4f20
add esp, 0x10
test al, al
je 0x4b5935
mov dword [0x67a948], 2
mov esp, ebp
pop ebp
ret
mov dword [0x67a948], 1
jmp 0x4b5946
cmp eax, 2
je 0x4b5986
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4b596d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4b5986
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret

Function at 0x4b5a50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4b5a98
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004a4b90
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004a6870
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004a6870
add esp, 8
pop edi
pop esi
pop ebp
ret