joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dd30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc16d
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x6218c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x150], 0
push str.unknow
lea ecx, [ebp - 0x28]
call fcn.004061c0
mov dword [ebp - 4], 0
push 0x11c
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.00572a00
add esp, 0xc
mov dword [ebp - 0x144], 0x11c
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49dee4
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x148], 5
jne 0x49ddea
cmp dword [ebp - 0x14c], 1
jne 0x49ddea
push str.winxp
lea ecx, [ebp - 0x28]
call fcn.0040ba10
jmp 0x49dee4
cmp dword [ebp - 0x148], 6
jne 0x49de0e
cmp dword [ebp - 0x14c], 0
jne 0x49de0e
push str.winvista
lea ecx, [ebp - 0x28]
call fcn.0040ba10
jmp 0x49dee4
cmp dword [ebp - 0x148], 6
jne 0x49de32
cmp dword [ebp - 0x14c], 1
jne 0x49de32
push str.win7
lea ecx, [ebp - 0x28]
call fcn.0040ba10
jmp 0x49dee4
cmp dword [ebp - 0x148], 6
jne 0x49de56
cmp dword [ebp - 0x14c], 2
jne 0x49de56
push str.win8
lea ecx, [ebp - 0x28]
call fcn.0040ba10
jmp 0x49dee4
cmp dword [ebp - 0x148], 6
jne 0x49de77
cmp dword [ebp - 0x14c], 3
jne 0x49de77
push str.win8.1
lea ecx, [ebp - 0x28]
call fcn.0040ba10
jmp 0x49dee4
cmp dword [ebp - 0x140], 0xa
jne 0x49dea4
cmp dword [ebp - 0x13c], 0
jne 0x49dea4
cmp dword [ebp - 0x138], 0x55f0
jb 0x49dea4
push 0x5cbe14
lea ecx, [ebp - 0x28]
call fcn.0040ba10
jmp 0x49dee4
cmp dword [ebp - 0x148], 0xa
jne 0x49dec5
cmp dword [ebp - 0x14c], 0
jne 0x49dec5
push str.win10
lea ecx, [ebp - 0x28]
call fcn.0040ba10
jmp 0x49dee4
cmp dword [ebp - 0x148], 0xa
jne 0x49dee4
cmp dword [ebp - 0x14c], 0
jle 0x49dee4
push str.win11
lea ecx, [ebp - 0x28]
call fcn.0040ba10
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406f80
mov edx, dword [ebp - 0x150]
or edx, 1
mov dword [ebp - 0x150], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406170
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057029b
mov esp, ebp
pop ebp
ret

Function at 0x49df30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 1], 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x28]
cmp ecx, 9
je 0x49df56
movzx edx, word [ebp - 0x28]
cmp edx, 0xc
jne 0x49df5a
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x49ebb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc210
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x6218c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 4
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x240]
push edx
push 0
push str.SystemComponent
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x238], 1
jne 0x49ec2b
mov al, 1
jmp 0x49ed49
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00572a00
add esp, 0xc
mov dword [ebp - 0x23c], 0x208
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
push ecx
push 0
push str.DisplayName
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x49ec89
mov al, 1
jmp 0x49ed49
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x244]
push ecx
push 0
push 0
push 0
push str.ParentKeyName
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49ecba
mov al, 1
jmp 0x49ed49
mov dword [ebp - 0x238], 0
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x240]
push edx
push 0
push str.ClickToRunComponent
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x238], 1
jne 0x49ecf7
mov al, 1
jmp 0x49ed49
mov ecx, dword [ebp + 0x14]
call fcn.00406a40
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.004a7060
add esp, 8
mov dword [ebp - 4], 0
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax]
call fcn.004a0530
mov byte [ebp - 0x231], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00406170
mov al, byte [ebp - 0x231]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057029b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a6140
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bcadd
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6218c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406cb0
mov dword [ebp - 4], 0
push 0
push 2
lea ecx, [ebp - 0x28]
call fcn.00407c50
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x34], cx
mov edx, 0x50
mov word [ebp - 0x40], dx
push 0
lea ecx, [ebp - 0x28]
call fcn.00406a50
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 3
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x4a61dd
mov dword [ebp - 0x30], 1
jmp 0x4a61e4
mov dword [ebp - 0x30], 0
mov cl, byte [ebp - 0x30]
mov byte [ebp - 0x29], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406c10
movzx eax, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057029b
mov esp, ebp
pop ebp
ret
Function at 0x4a6650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x4a6660
xor eax, eax
jmp 0x4a66da
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.00572a00
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4a66af
xor eax, eax
jmp 0x4a66da
cmp dword [ebp + 0x10], 0
je 0x4a66c1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4a66e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x4a66fc
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffff
xor eax, eax
jmp 0x4a677f
push 0x44
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.00572a00
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4a6754
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x4a677f
cmp dword [ebp + 0xc], 0
je 0x4a6766
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4a6900
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x6218c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x438], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0xffffffff
jne 0x4a695a
push 0x494da0
push str.Error_creating_process_snapshot.
push 0x62d300
call fcn.00493d90
add esp, 8
mov ecx, eax
call fcn.00495590
xor al, al
jmp 0x4a6a14
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4a6a05
push 0x104
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x430]
push eax
call fcn.004a6220
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x4a69ea
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.0058c9b4
add esp, 8
test eax, eax
jne 0x4a69ea
mov ecx, dword [ebp - 0x430]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
je 0x4a69ea
push 0
mov edx, dword [ebp - 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 0x43c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a6975
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057029b
mov esp, ebp
pop ebp
ret
Function at 0x4b2ef0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push str.SOFTWAREjiebangbang
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 8], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalljiebangbang
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jne 0x4b2f34
cmp dword [ebp - 0xc], 0
jne 0x4b2f34
mov dword [ebp - 4], 1
jmp 0x4b2f3b
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4b2f50
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bdb1d
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x6218c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
push 0x44
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.00572a00
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x9c], 0x44
mov dword [ebp - 0x70], 1
xor edx, edx
mov word [ebp - 0x6c], dx
lea eax, [ebp - 0x28]
push eax
call fcn.004090a0
add esp, 4
mov dword [ebp - 4], 0
push str.del.bat
lea ecx, [ebp - 0x28]
call fcn.0042ceb0
lea ecx, [ebp - 0x28]
call fcn.00406a40
push eax
push str.cmd__c_call___s_
lea ecx, [ebp - 0x40]
push ecx
call fcn.00406850
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00406a40
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x4b303d
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x40]
call fcn.00406c10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057029b
mov esp, ebp
pop ebp
ret
Function at 0x4b30b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bcb5d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6218c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.0049e2a0
add esp, 8
mov dword [ebp - 4], 0
push 0x5cd840
lea ecx, [ebp - 0x28]
call fcn.0041fbd0
push 0x5cd844
lea ecx, [ebp - 0x28]
call fcn.0041fbd0
lea ecx, [ebp - 0x28]
call fcn.00406a40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4b3123
mov byte [ebp - 0x29], 1
jmp 0x4b3127
mov byte [ebp - 0x29], 0
mov cl, byte [ebp - 0x29]
mov byte [ebp - 0x2a], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406c10
movzx eax, byte [ebp - 0x2a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057029b
mov esp, ebp
pop ebp
ret

Function at 0x4b3160
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6218c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x21c], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00572a00
add esp, 0xc
push 0
push 7
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x20c]
add edx, 0xfffffffe
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
mov cx, word [eax + 2]
mov word [ebp - 0x216], cx
add dword [ebp - 0x214], 2
cmp word [ebp - 0x216], 0
jne 0x4b31b2
mov edi, dword [ebp - 0x214]
mov edx, dword [str.b...]
mov dword [edi], edx
mov eax, dword [0x5cd938]
mov dword [edi + 4], eax
mov ecx, dword [0x5cd93c]
mov dword [edi + 8], ecx
mov edx, dword [0x5cd940]
mov dword [edi + 0xc], edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4b3216
mov byte [ebp - 0x20d], 1
jmp 0x4b321d
mov byte [ebp - 0x20d], 0
movzx eax, byte [ebp - 0x20d]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057029b
mov esp, ebp
pop ebp
ret
Function at 0x4d15b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4d165f
push esi
call fcn.004dfd00
add esp, 4
test al, al
jne 0x4d165f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4d15d7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004e12d0
add esp, 0xc
test eax, eax
je 0x4d160b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004e12d0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4d160d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x4d163e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.004cf640
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x4d1620
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4dfd00
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x6218c0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x4dfd48
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0057029b
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.0057029b
add esp, 0x18
ret

Function at 0x4dfeb0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4dfeee
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x104], 0
jne 0x4dfedf
push 0
call fcn.004dfeb0
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x104], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x104], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4dff03
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret
Function at 0x4e0c50
Capabilities:
Convert ip address from string
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x6218c0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp byte [eax + 0x6cb], 0
je 0x4e0e29
cmp byte [ebp + 0x18], 0
push ebx
lea ebx, [ebp + 0x18]
je 0x4e0e28
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x34]
push eax
push ebx
push 2
call esi
test eax, eax
jg 0x4e0e27
lea eax, [esp + 0x38]
push eax
push ebx
push 0x17
call esi
test eax, eax
jg 0x4e0e27
push dword [ebp + 0x14]
cmp byte [ebx], 0
mov eax, str._none_
mov esi, dword [ebp]
mov ebp, dword [esp + 0x14]
cmovne eax, ebx
push eax
push str.Host__s:_d_was_resolved.
push ebp
call fcn.004e1030
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.004e1ea0
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.004e1ea0
add esp, 0x20
test esi, esi
je 0x4e0d9b
lea edx, [edi + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x4e0d12
cmp ecx, 2
jne 0x4e0d90
xor eax, eax
mov byte [esp + 0x48], 0
cmp ecx, 2
lea ebx, [esp + 0x14]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x4e0d41
sub ecx, 0x15
jne 0x4e0d56
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x4e0d51
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
push ebx
call fcn.004e1ec0
add esp, 4
test eax, eax
je 0x4e0d75
push 2
push 0x5d6f30
push ebx
call fcn.004e1e60
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4e0dbb
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.004e1e10
mov edi, eax
add esp, 8
test edi, edi
jne 0x4e0dbb
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4e0d01
lea eax, [esp + 0x24]
push eax
call fcn.004e1ec0
add esp, 4
test eax, eax
je 0x4e0dcb
lea eax, [esp + 0x24]
push eax
call fcn.004e1ed0
add esp, 4
jmp 0x4e0dd0
push str.too_many_IP__cant_show
push ebp
call fcn.004e1030
add esp, 8
jmp 0x4e0e10
mov eax, str._none_
push eax
push str.IPv6:__s
push ebp
call fcn.004e1030
lea eax, [esp + 0x20]
push eax
call fcn.004e1ec0
add esp, 0x10
test eax, eax
je 0x4e0dfc
lea eax, [esp + 0x14]
push eax
call fcn.004e1ed0
add esp, 4
jmp 0x4e0e01
mov eax, str._none_
push eax
push str.IPv4:__s
push ebp
call fcn.004e1030
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.004e1e70
lea eax, [esp + 0x28]
push eax
call fcn.004e1e70
add esp, 8
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
pop edi
pop ebp
xor ecx, esp
call fcn.0057029b
add esp, 0x6c
ret
Function at 0x4e1a30
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.004fde70
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call fcn.004dd070
push dword [esp + 0x40]
mov edi, eax
call fcn.004dd070
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x4e1ac5
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.004fde70
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.004fdf20
add esp, 0x20
test edx, edx
ja 0x4e1ae9
jb 0x4e1ab7
cmp eax, 0x3e8
ja 0x4e1ae9
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x4e1a80
test edi, edi
je 0x4e1ad2
push edi
call fcn.00584c22
add esp, 4
test esi, esi
je 0x4e1adf
push esi
call fcn.00584c22
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x4e1af6
push edi
call fcn.00584c22
add esp, 4
test esi, esi
je 0x4e1b03
push esi
call fcn.00584c22
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret

Function at 0x4e2060
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x2b
test edi, edi
je 0x4e2110
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ebx, 4
lea eax, [esp + 0x1c]
push 4
push eax
cmp edi, ebx
push ebp
cmovb ebx, edi
call fcn.004dab70
add esp, 0xc
cmp eax, 4
je 0x4e20a3
mov ecx, eax
jmp 0x4e20cd
cmp byte [0x62cb7c], 0
jne 0x4e20d7
push 2
push 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb ecx, ecx
and ecx, 2
mov eax, ecx
test eax, eax
jne 0x4e2112
mov eax, dword [esp + 0x1c]
jmp 0x4e20f4
imul eax, dword [0x62cb78], 0x41c64e6d
add eax, 0x3039
mov dword [0x62cb78], eax
ror eax, 0x10
xor ecx, ecx
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x4e2108
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x4e20f8
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x4e2080
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4e2120
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
sub ebx, 1
je 0x4e219b
mov esi, dword [esp + 0x14]
mov ebp, 0x3e
nop word [eax + eax]
push 4
lea eax, [esp + 0x20]
push eax
push esi
call fcn.004dab70
add esp, 0xc
cmp eax, 4
jne 0x4e217c
cmp byte [0x62cb7c], 0
jne 0x4e21a5
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x4e21a0
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffc
jae 0x4e2140
xor edx, edx
div ebp
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x4e2140
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
imul eax, dword [0x62cb78], 0x41c64e6d
add eax, 0x3039
mov dword [0x62cb78], eax
ror eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x4e2184

Function at 0x4e21d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0
push dword [esp + 0xc]
call fcn.00572a00
add esp, 0xc
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
ret

Function at 0x4e3320
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0x18]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x140]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4e336c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004e0f60
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.004e2f40
add esp, 0x10
pop esi
pop ebx
ret