joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488cc0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x50ae08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c]
mov esi, dword [ebp + 4]
xor ebx, ebx
mov edi, ecx
cmp esi, ebx
je 0x488d14
mov ecx, esi
call fcn.004c8f20
push esi
call fcn.004cf512
add esp, 4
mov dword [ebp + 4], ebx
cmp edi, ebx
je 0x488e38
push ebx
push 0x5240cc
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00408ed0
mov dword [esp + 0x44], ebx
cmp byte [ebp], bl
jne 0x488e3c
push 0x5230c8
lea eax, [esp + 0x1c]
push edi
push eax
mov dword [esp + 0x24], ebx
call fcn.004cf6cb
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, ebx
je 0x488e1c
push 2
push ebx
push eax
call fcn.004d12e9
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
call fcn.004d11f1
mov edx, dword [esp + 0x1c]
add esp, 4
push ebx
push ebx
push edx
mov esi, eax
call fcn.004d12e9
lea eax, [esi + 1]
add esp, 0xc
push eax
call fcn.004d0add
mov edi, eax
add esp, 4
mov byte [edi + esi], bl
mov ecx, dword [esp + 0x18]
push ecx
push esi
push 1
push edi
call fcn.004d1027
add esp, 0x10
cmp eax, esi
jne 0x488dc5
push edi
lea ecx, [esp + 0x20]
call fcn.0044f060
mov edx, dword [esp + 0x18]
push edx
call fcn.004d038d
add esp, 4
push edi
call fcn.004d051b
mov eax, dword [esp + 0x24]
mov esi, 0x10
add esp, 4
cmp dword [esp + 0x34], esi
jae 0x488dee
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x30]
push ecx
push eax
mov eax, ebp
call fcn.00488e80
mov dword [esp + 0x44], 0xffffffff
mov bl, al
cmp dword [esp + 0x34], esi
jb 0x488e18
mov edx, dword [esp + 0x20]
push edx
call fcn.004cf512
add esp, 4
mov al, bl
jmp 0x488e5a
mov dword [esp + 0x44], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x488e38
mov eax, dword [esp + 0x20]
push eax
call fcn.004cf512
add esp, 4
xor al, al
jmp 0x488e5a
mov dword [esp + 0x44], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x488e58
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004cf512
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004ccee1
add esp, 0x34
ret 4
Function at 0x48c4a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50bbba
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, edx
mov dword [esp + 0x38], 0
mov esi, dword [edi + 0x10]
mov ebp, dword [edi + 0xc]
mov ecx, esi
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jbe 0x48c526
cmp ebp, esi
jbe 0x48c4fb
call fcn.004d06e1
mov eax, dword [edi]
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
push esi
push eax
lea eax, [esp + 0x48]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push ebx
push edi
call fcn.0048d1b0
jmp 0x48c573
jae 0x48c573
cmp ebp, esi
jbe 0x48c531
call fcn.004d06e1
mov ebp, dword [edi + 0xc]
mov edx, dword [edi]
mov dword [esp + 0x20], edx
cmp ebp, dword [edi + 0x10]
jbe 0x48c544
call fcn.004d06e1
mov eax, dword [edi]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ebp
call fcn.0048d740
mov edx, dword [esp + 0x20]
mov ecx, dword [eax + 4]
push esi
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0048c5a0
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x3c], 0xffffffff
call fcn.0048bd90
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18

Function at 0x48eea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x48eeb5
mov esi, dword [eax]
test esi, esi
jne 0x48eeb5
xor eax, eax
pop esi
ret 8
push edi
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x48eed1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x48eed8
pop edi
xor eax, eax
pop esi
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ebx
pop ebx
pop edi
pop esi
ret 8
Function at 0x48f930
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x508370
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x1c]
call fcn.004402f0
mov dword [esp + 0x14], vtable.UserManager::t_lockerProc.0
mov esi, dword [ebp + 8]
push 0x545c28
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0
call fcn.00440340
test al, al
je 0x48fab9
push 0x64
push 0
lea ecx, [esp + 0x24]
call fcn.004402f0
mov dword [esp + 0x1c], vtable.UserManager::t_locker.0
push 0x545e58
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.00440340
test al, al
je 0x48faab
push 0
push esi
lea ecx, [edi + 0x154]
call fcn.0048e9e0
test al, al
je 0x48faab
push 0
push esi
lea ecx, [edi + 0x44c]
call fcn.0048e9e0
test al, al
je 0x48faab
mov ebx, dword [ebp + 0xc]
push 0x5213e4
mov ecx, ebx
call fcn.0043a2d0
cmp byte [edi + 0x151], 0
jne 0x48fa1d
push 0x5136d8
mov ecx, esi
call fcn.00439450
mov ecx, eax
jmp 0x48faa6
mov eax, dword [ebp + 0x10]
push 0
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edi + 0x10]
mov dword [esp + 0x1c], 0
call fcn.00491c70
test al, al
je 0x48fa87
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x48fa87
call fcn.00491490
push eax
mov ecx, ebx
call fcn.0043a2d0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.00440310
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00440310
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x5136c4
mov ecx, esi
call fcn.00439450
mov ecx, eax
call fcn.00439dd0
mov ecx, ebx
mov esi, eax
call fcn.00437460
push eax
mov ecx, esi
call fcn.00439dd0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.00440310
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00440310
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x490c20
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5089f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x2c]
mov edi, dword [esp + 0x28]
push str.Local_sgime_user_lock_proc
mov dword [esi + 4], ecx
push edi
mov ecx, 0x545c28
mov byte [esi], al
call fcn.0044aee0
test al, al
jne 0x490c90
push 0x5138b4
push edi
call fcn.00439500
add esp, 8
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
push str.Local_sgime_user_lock
push edi
mov ecx, 0x545e58
call fcn.00440410
test al, al
je 0x490c6d
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.004402f0
mov dword [esp + 0x10], vtable.UserManager::t_locker.0
push 0x545e58
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.00440340
test al, al
jne 0x490d0c
push 0x5138b4
push edi
call fcn.00439500
add esp, 8
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.00440310
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
cmp byte [esi + 0xa78], 0
jne 0x490d90
call fcn.004427e0
mov ecx, eax
call fcn.00440b60
test al, al
jne 0x490d5e
push edi
call fcn.004427e0
mov ecx, eax
call fcn.00440b90
test al, al
jne 0x490d5e
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00440310
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ecx, esi
call fcn.0048fd40
push 1
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, esi
call fcn.00490880
test al, al
je 0x490d36
lea eax, [esp + 0x10]
push eax
push edi
mov ecx, esi
call fcn.00490670
test al, al
je 0x490d36
mov byte [esi + 0xa78], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00440310
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
Function at 0x490dc0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5089f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov cl, byte [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
push str.Local_sgime_user_lock_proc
mov byte [esi + 8], cl
push edi
mov ecx, 0x545c28
mov dword [esi + 0xc], eax
call fcn.0044aee0
test al, al
jne 0x490e31
push 0x5138b4
push edi
call fcn.00439500
add esp, 8
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
push str.Local_sgime_user_lock
push edi
mov ecx, 0x545e58
call fcn.00440410
test al, al
je 0x490e0e
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.004402f0
mov dword [esp + 0x10], vtable.UserManager::t_locker.0
push 0x545e58
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.00440340
test al, al
jne 0x490ead
push 0x5138b4
push edi
call fcn.00439500
add esp, 8
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.00440310
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
cmp byte [esi + 0xa78], 0
jne 0x490f31
call fcn.004427e0
mov ecx, eax
call fcn.00440b60
test al, al
jne 0x490eff
push edi
call fcn.004427e0
mov ecx, eax
call fcn.00440b90
test al, al
jne 0x490eff
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00440310
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ecx, esi
call fcn.0048fd40
push 1
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, esi
call fcn.00490880
test al, al
je 0x490ed7
lea eax, [esp + 0x10]
push eax
push edi
mov ecx, esi
call fcn.00490670
test al, al
je 0x490ed7
mov byte [esi + 0xa78], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00440310
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
Function at 0x4910c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x508740
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.004402f0
mov dword [esp + 0x18], vtable.UserManager::t_lockerProc.0
mov esi, dword [esp + 0x30]
push 0x545c28
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00440340
test al, al
je 0x491157
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.004402f0
mov dword [esp + 0x10], vtable.UserManager::t_locker.0
push 0x545e58
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00440340
test al, al
jne 0x49117f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00440310
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.00440310
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0
push esi
lea ecx, [edi + 0x154]
call fcn.0048e9e0
test al, al
je 0x491149
push 0
push esi
lea ecx, [edi + 0x44c]
call fcn.0048e9e0
test al, al
je 0x491149
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, edi
call fcn.00490f60
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.00440310
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.00440310
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x4ae980
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4ae9b2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x4aeb00
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x16c]
test ecx, ecx
je 0x4aeb1b
mov edx, dword [esi + 0xfc]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x4aeb4f
cmp eax, 2
jg 0x4aeb4f
mov ecx, dword [esi + 0xf8]
push ecx
push 1
lea edx, [eax + eax*2 + 0x518620]
push 2
push edx
call fcn.004d38d2
mov eax, dword [esi + 0xf8]
push eax
push 1
push edi
push ebx
call fcn.004d38d2
add esp, 0x20
xor eax, eax
ret

Function at 0x4aee60
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + eax*4 + 0xc8]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x4aeecf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4aeeaf
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push eax
push edi
call fcn.004c4270
push eax
mov eax, dword [edi]
push str.Send_failure:__s
push eax
call fcn.004aece0
add esp, 0x14
mov dword [ebx], 0x37
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x4af570
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x108
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x134], 0
mov ebx, dword [ebp]
jne 0x4af681
push esi
mov esi, dword [esp + 0x11c]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
mov edi, 0x80
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4af5df
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.004c4270
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
jmp 0x4af676
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x98]
push eax
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4af613
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.004c4270
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x4af676
lea edi, [ebx + 0x86c4]
lea ecx, [ebx + 0x8694]
lea esi, [esp + 0x14]
call fcn.004af520
test eax, eax
jne 0x4af644
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.004c4270
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
jmp 0x4af676
lea edi, [ebx + 0x86f8]
lea ecx, [ebx + 0x86c8]
lea esi, [esp + 0x94]
call fcn.004af520
test eax, eax
jne 0x4af67f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.004c4270
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004aece0
add esp, 0x18
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
pop ebp
pop ebx
xor ecx, esp
call fcn.004ccee1
add esp, 0x108
ret

Function at 0x4af6a0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x308]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x4af6e3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004c4270
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004aec50
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004aec50
add esp, 8
pop esi
pop ecx
ret

Function at 0x4af700
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x1c], 0x4020
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4af749
mov edx, dword [esp + 4]
cmp edx, dword [esp + 8]
jg 0x4af761
push 4
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
add esp, 0xc
ret
Function at 0x4b10b0
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x4b1154
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x4b1125
cmp word [ecx + 0xa], 4
jne 0x4b1125
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4b1125
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.004b1040
mov dword [esi], eax
test eax, eax
je 0x4b1148
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x4b1100
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.004d34d5
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4b1164.11001
jmp dword [eax*4 + 0x4b1188]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18
Function at 0x4b19c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x546094], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x4b1420
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x4b1710
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.004b13d0
je 0x4b1a32
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x54035c]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004ccee1
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4b1b2d
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.004d06f1
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.004d0759
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4b1aad
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4b1af4
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.004d06f1
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.004d0759
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x4b1b29
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x4b1b5d
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
mov dword [esp + edi*8 + 0x14], eax
test eax, eax
je 0x4b1b5d
inc edi
cmp edi, 3
jl 0x4b1af6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x54035c], edx
mov dword [0x540364], eax
mov dword [fcn.004b13d0], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x54035c]
xor ecx, esp
mov dword [0x546094], 1
call fcn.004ccee1
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x4b1b29
Function at 0x4b1f30
Capabilities:
Create udp socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x48
push 1
mov ebx, eax
mov edi, ecx
call dword [0x540354]
mov esi, eax
xor eax, eax
add esp, 8
mov dword [esp + 0x10], 0xc
mov dword [edi + 0x330], esi
cmp esi, eax
je 0x4b1feb
mov dword [edi + 0x320], ebx
mov dword [edi + 0x328], eax
mov dword [edi + 0x32c], eax
mov dword [edi + 0x324], eax
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [esi], eax
lea ebp, [esi + 0x10]
push ebx
mov eax, ebp
mov dword [esi + 4], 0xffffffff
call fcn.004b1db0
add esp, 8
test eax, eax
je 0x4b1feb
mov eax, dword [edi + 0x31c]
push eax
call fcn.004add90
push ebx
call dword [0x540350]
add esp, 8
mov dword [edi + 0x31c], eax
test eax, eax
je 0x4b1feb
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4b1feb
push ebp
push 0x4b1e40
call fcn.004c4c00
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x4b200d
call fcn.004ce387
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
add edi, 0x31c
push edi
call fcn.004b1ed0
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4b6040
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x51861c
push ecx
call fcn.004aec50
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.004b5200
test eax, eax
jne 0x4b6070
mov eax, esi
jmp fcn.004b5690
ret