joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc960
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, eax
lea ebp, [esp + 0x3c]
test byte [ebx + 0x18], 2
je 0x4bca90
mov esi, dword [ebx + 0x24]
test esi, esi
je 0x4bcb30
mov edi, dword [ebx + 0x30]
mov edx, dword [ebx + 0x2c]
lea eax, [esi + 0x1000]
cmp edi, eax
ja 0x4bcaa0
mov eax, dword [ebx + 0x34]
lea ecx, [edx + 0x1000]
lea edi, [esi + eax]
cmp edi, ecx
jae 0x4bc9f1
mov ecx, dword [ebx + 0x28]
sub edx, esi
sub ecx, esi
add eax, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
mov dword [ebx + 0x34], eax
mov dword [esp + 4], eax
mov dword [esp], esi
mov edi, dword [ebx + 0x30]
call dword [0x6713d4]
sub edi, esi
mov dword [ebx + 0x24], eax
test eax, eax
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
je 0x4bcb75
add edx, eax
add ecx, eax
add edi, eax
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x30], edi
mov eax, dword [ebx + 0x14]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ws2_32.dll_recv
sub esp, 0x10
mov esi, eax
mov dword [ebx + 0x38], eax
cmp eax, 0
jg 0x4bcb60
je 0x4bca90
cmp eax, 0xffffffff
je 0x4bcad4
mov eax, dword [ebx + 0x14]
cmp eax, 0x40
jg 0x4bca90
mov dword [esp + 0x40], eax
lea edx, [esp + 0x34]
inc eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], eax
mov dword [esp + 0x34], 0x3c
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
call sub.ws2_32.dll_select
sub esp, 0x14
test eax, eax
jg 0x4bc970
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x4bc970
nop
xor esi, esi
add esp, 0x14c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
sub edx, edi
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], edi
call sub.msvcrt.dll_memmove
sub esi, edi
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x28]
add edx, esi
add ecx, esi
mov dword [ebx + 0x30], edx
mov edx, dword [ebx + 0x2c]
add edx, esi
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x2c], edx
mov esi, dword [ebx + 0x24]
jmp 0x4bc999
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2734
jle 0x4bcb17
cmp eax, 0x2746
je 0x4bca90
cmp eax, 0x274a
je 0x4bca90
mov dword [esp + 8], str.recv_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
add esp, 0x14c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x2733
jge 0x4bca2c
cmp eax, 0xb
jne 0x4bcaee
jmp 0x4bca2c
mov dword [esp], 0xfde8
call dword [0x6713d8]
mov edi, eax
mov dword [ebx + 0x24], eax
test eax, eax
je 0x4bcb97
mov dword [ebx + 0x34], 0xfde8
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov edx, eax
mov esi, eax
jmp 0x4bc98b
mov eax, dword [ebx + 0x2c]
add eax, esi
mov dword [ebx + 0x2c], eax
add esp, 0x14c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.allocating_input_buffer
call fcn.004bc930
mov dword [esp], esi
call dword [0x6713e0]
or esi, 0xffffffff
mov dword [ebx + 0x38], 0xffffffff
jmp 0x4bca92
mov eax, str.allocating_input
or esi, 0xffffffff
call fcn.004bc930
mov dword [ebx + 0x38], 0xffffffff
jmp 0x4bca92
Function at 0x4bced0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push edi
push esi
push ebx
mov esi, eax
sub esp, 0x240
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.ws2_32.dll_socket
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
je 0x4bd0e8
lea eax, [esp + 0x28]
mov dword [esp + 4], 0x8004667e
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 0x28], 1
call sub.ws2_32.dll_ioctlsocket
sub esp, 0xc
inc eax
setne dl
and edx, 0xff
mov dword [esp + 8], 0x10
dec edx
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x24], edx
call sub.ws2_32.dll_connect
sub esp, 0xc
inc eax
je 0x4bd0c8
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x34], 0
cmp ebx, 0x40
jg 0x4bd090
lea eax, [esp + 0x30]
lea edi, [esp + 0x13c]
mov dword [esp + 0x10], eax
lea esi, [esp + 0x38]
lea eax, [ebx + 1]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], 1
mov dword [esp + 0x140], ebx
mov dword [esp + 0x13c], 1
call sub.ws2_32.dll_select
sub esp, 0x14
cmp eax, 0xffffffff
je 0x4bd098
test eax, eax
jne 0x4bd000
mov dword [esp + 8], str.Connect_attempt_timed_out
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
mov dword [esp], ebx
call sub.ws2_32.dll_closesocket
or ebx, 0xffffffff
push edi
add esp, 0x240
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
push ecx
push ecx
je 0x4bd0a5
lea eax, [esp + 0x2c]
mov dword [esp + 8], 0x1007
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
mov dword [esp + 0x2c], 4
call sub.ws2_32.dll_getsockopt
sub esp, 0x14
test eax, eax
js 0x4bd109
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4bcff2
mov dword [esp + 8], str.Error_connecting_to_remote_host
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
mov dword [esp], ebx
call sub.ws2_32.dll_closesocket
push eax
call sub.msvcrt.dll__errno
mov edx, dword [esp + 0x24]
mov dword [eax], edx
lea esi, [esi]
or ebx, 0xffffffff
jmp 0x4bcff2
mov dword [esp + 8], str.Connect_failed
jmp 0x4bcfd2
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
push edx
push edx
jne 0x4bd016
mov dword [esp + 8], str.select_failed_n
jmp 0x4bcfd2
call sub.ws2_32.dll_WSAGetLastError
sub eax, 0x2733
cmp eax, 1
jbe 0x4bcf55
mov dword [esp + 8], str.error_connecting_to_HTTP_server
jmp 0x4bcfd2
mov dword [esp + 8], str.socket_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
jmp 0x4bcff2
mov dword [esp + 8], str.getsockopt_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
jmp 0x4bd090
Function at 0x4bd130
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, edx
mov dword [esp], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call sub.ws2_32.dll_gethostbyname
mov ebx, eax
test eax, eax
push ecx
je 0x4bd228
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4bd21d
cmp word [ebx + 8], 2
jne 0x4bd21d
movsx ecx, word [ebx + 0xa]
cmp cx, 4
ja 0x4bd201
and ebp, 0xffff
mov esi, 4
lea edi, [esp + 0x1c]
jmp 0x4bd1be
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + esi]
test eax, eax
je 0x4bd21d
cmp word [ebx + 8], 2
jne 0x4bd21d
movsx ecx, word [ebx + 0xa]
add esi, 4
cmp cx, 4
ja 0x4bd201
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x1c]
mov dword [esp], ebp
mov word [esp + 0x20], 2
mov dword [esp + 0x24], eax
call sub.ws2_32.dll_htons
push edx
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
call fcn.004bced0
cmp eax, 0xffffffff
je 0x4bd1a0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.address_size_mismatch_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
add esp, 0x3c
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.Failed_to_resolve_host
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
or eax, 0xffffffff
jmp 0x4bd1f9

Function at 0x4bd360
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
and edx, 1
mov ebx, dword [esp + 0x150]
je 0x4bd420
mov edi, ecx
test ecx, ecx
je 0x4bd420
test ebx, ebx
jle 0x4bd420
mov esi, eax
xor ebp, ebp
jmp 0x4bd39c
add ebp, eax
cmp ebx, ebp
jle 0x4bd422
mov eax, ebx
mov dword [esp + 0xc], 0
sub eax, ebp
mov dword [esp + 8], eax
lea eax, [edi + ebp]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.ws2_32.dll_send
sub esp, 0x10
test eax, eax
jg 0x4bd392
inc eax
je 0x4bd430
mov eax, dword [esi]
cmp eax, 0x40
jg 0x4bd46a
lea edx, [esp + 0x24]
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], edx
inc eax
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call sub.ws2_32.dll_select
sub esp, 0x14
jmp 0x4bd394
xor ebp, ebp
add esp, 0x13c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0xb
je 0x4bd3c7
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4bd3c7
mov dword [esp + 8], str.send_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00441df0
test ebp, ebp
jne 0x4bd422
or ebp, 0xffffffff
jmp 0x4bd422
Function at 0x4bd5a0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
mov ecx, dword [0x737f08]
test ecx, ecx
je 0x4bd5b0
ret
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.ws2_32.dll_WSAStartup
test eax, eax
push edx
push edx
jne 0x4bd5e3
mov eax, dword [0x737f0c]
test eax, eax
je 0x4bd5f0
mov dword [0x737f08], 1
add esp, 0x1ac
ret
mov dword [esp], 0x7078f5
mov dword [0x737f10], 0x50
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4bd60f
cmp byte [eax], 0x2a
je 0x4bd629
mov dword [esp], str.http_proxy
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4bd631
mov dword [esp], eax
call fcn.004bd4b0
jmp 0x4bd5d9
cmp byte [eax + 1], 0
jne 0x4bd60f
jmp 0x4bd5d9
mov dword [esp], str.HTTP_PROXY
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x4bd61f
jmp 0x4bd5d9
Function at 0x4be7f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, eax
test eax, eax
je 0x4be91f
lea ebx, [eax + 0x3c]
mov edi, dword [eax + 0x440]
mov dword [esp + 0x1c], ebx
nop
cmp edi, 0x400
ja 0x4be91f
mov eax, dword [ebp + 0x444]
cmp eax, 0x400
ja 0x4be91f
cmp eax, edi
jl 0x4be91f
test edi, edi
je 0x4be93b
sub eax, edi
mov ebx, dword [esp + 0x1c]
mov dword [esp + 8], eax
lea eax, [ebp + edi + 0x3c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memmove
mov edx, dword [ebp + 0x440]
mov edi, dword [ebp + 0x444]
xor eax, eax
sub edi, edx
mov edx, 0x400
sub edx, edi
mov dword [ebp + 0x444], edi
mov dword [ebp + 0x440], 0
jne 0x4be94c
or eax, edi
je 0x4be91f
mov eax, dword [ebp + 0x440]
lea ecx, [ebp + edi + 0x3c]
mov dword [esp + 0x18], eax
lea edx, [ebp + eax + 0x3c]
cmp edx, ecx
jae 0x4be90f
mov eax, ecx
sub eax, edx
cmp eax, 2
jle 0x4be905
movsx eax, byte [edx]
lea ebx, [eax - 0x30]
cmp bl, 9
ja 0x4be905
mov bl, byte [edx + 1]
mov byte [esp + 0x16], bl
lea esi, [ebx - 0x30]
mov ebx, esi
cmp bl, 9
ja 0x4be905
movzx esi, byte [edx + 2]
lea ebx, [esi - 0x30]
cmp bl, 9
ja 0x4be905
cmp byte [edx + 3], 0x2d
je 0x4be905
movsx ebx, byte [esp + 0x16]
lea eax, [eax + eax*4 - 0xf0]
lea eax, [ebx + eax*2 - 0x30]
mov ebx, esi
movsx esi, bl
lea eax, [eax + eax*4]
lea ebx, [esi + eax*2 - 0x30]
test ebx, ebx
je 0x4be905
jmp 0x4be994
inc edx
cmp edx, ecx
je 0x4be930
cmp byte [edx], 0xa
jne 0x4be900
inc edx
cmp edx, ecx
jb 0x4be8a2
mov edi, dword [esp + 0x18]
cmp edi, 0x400
jbe 0x4be81c
or edx, 0xffffffff
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 0x440], edi
jmp 0x4be810
mov edi, eax
mov edx, 0x400
xor eax, eax
sub edx, edi
je 0x4be884
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov eax, dword [ebp + 0x440]
lea eax, [ebp + eax + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp], eax
call sub.ws2_32.dll_recv
sub esp, 0x10
test eax, eax
js 0x4be9f8
mov edi, dword [ebp + 0x444]
add edi, eax
mov dword [ebp + 0x444], edi
mov byte [ebp + edi + 0x3c], 0
jmp 0x4be884
lea eax, [edx + 3]
lea esi, [ebp + 0x3c]
mov edi, eax
sub edi, esi
cmp ecx, eax
mov dword [ebp + 0x448], edi
jbe 0x4be9ba
cmp byte [edx + 3], 0xa
jne 0x4be9b5
jmp 0x4be9f2
cmp byte [eax], 0xa
je 0x4be9f2
inc eax
cmp eax, ecx
jne 0x4be9b0
mov dl, byte [eax]
cmp dl, 0xa
je 0x4be9f2
cmp dl, 0xd
sete dl
and edx, 0xff
add eax, edx
mov edx, 0x51eb851f
sub eax, esi
mov dword [ebp + 0x440], eax
mov eax, ebx
imul edx
sar ebx, 0x1f
add esp, 0x2c
sar edx, 5
sub edx, ebx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov dl, byte [eax + 1]
inc eax
jmp 0x4be9c1
mov dword [esp + 8], str.recv_failed
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00441df0
mov eax, dword [ebp + 0x2c]
mov dword [esp], eax
call sub.ws2_32.dll_closesocket
or edx, 0xffffffff
push eax
mov dword [ebp + 0x2c], 0xffffffff
jmp 0x4be922
Function at 0x4bee70
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
mov ecx, dword [0x737f14]
test ecx, ecx
je 0x4bee80
ret
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.ws2_32.dll_WSAStartup
test eax, eax
push edx
push edx
je 0x4beea7
add esp, 0x1ac
ret
mov dword [esp], str.no_proxy
mov dword [0x737f18], 0x15
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4beec6
cmp byte [eax], 0x2a
je 0x4bef30
mov dword [esp], str.ftp_proxy
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4bef40
mov dword [esp], eax
call fcn.004bed80
mov dword [esp], str.ftp_proxy_user
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4beefc
mov dword [esp], eax
call dword [0x6713d0]
mov dword [0x737f1c], eax
mov dword [esp], str.ftp_proxy_password
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4bef1a
mov dword [esp], eax
call dword [0x6713d0]
mov dword [0x737f20], eax
mov dword [0x737f14], 1
jmp 0x4beea0
cmp byte [eax + 1], 0
je 0x4beea0
jmp 0x4beec6
mov dword [esp], str.FTP_PROXY
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x4beed6
jmp 0x4beede

Function at 0x4bf200
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x100]
test ebx, ebx
je 0x4bf2c0
lea esi, [esp + 0x28]
mov dword [esp + 8], str.QUIT_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], esi
call sub.msvcrt.dll__snprintf
mov edx, esi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x4bf235
test eax, 0x8080
jne 0x4bf259
shr eax, 0x10
add edx, 2
add al, al
mov dword [esp + 0xc], 0
sbb edx, 3
mov dword [esp + 4], esi
sub edx, esi
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.ws2_32.dll_send
sub esp, 0x10
test eax, eax
js 0x4bf290
xor eax, eax
add esp, 0xf4
pop ebx
pop esi
ret
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
mov dword [esp], 9
mov dword [esp + 0x1c], eax
call fcn.00441df0
mov eax, dword [esp + 0x1c]
add esp, 0xf4
pop ebx
pop esi
ret
or eax, 0xffffffff
jmp 0x4bf284
Function at 0x4c0130
Capabilities:
Get socket status

Disassembly:
push ebx
sub esp, 0x238
mov ebx, dword [esp + 0x240]
test ebx, ebx
je 0x4c0210
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.ws2_32.dll_closesocket
push eax
mov dword [ebx + 0x30], 0xffffffff
lea edx, [esp + 0x20]
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x12c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0xc], edx
inc eax
lea edx, [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x12c], 1
call sub.ws2_32.dll_select
sub esp, 0x14
cmp eax, 0
jl 0x4c01f5
je 0x4c01d8
mov eax, ebx
call fcn.004be7f0
mov edx, eax
xor eax, eax
cmp edx, 2
jne 0x4c01f5
add esp, 0x238
pop ebx
ret
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.ws2_32.dll_closesocket
push eax
mov dword [ebx + 0x2c], 0xffffffff
add esp, 0x238
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.ws2_32.dll_closesocket
push eax
mov dword [ebx + 0x2c], 0xffffffff
or eax, 0xffffffff
jmp 0x4c01d0
or eax, 0xffffffff
jmp 0x4c01d0
Function at 0x4c0a10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [esp + 0x160]
mov edi, dword [esp + 0x164]
test ebx, ebx
je 0x4c0bd1
test edi, edi
je 0x4c0bc6
mov dword [esp], ebx
call fcn.004bfcf0
mov dword [ebx + 0x30], eax
inc eax
je 0x4c0bd1
lea esi, [esp + 0x14]
mov dword [esp + 8], str.TYPE_I_r_n
mov dword [esp + 4], 0x12c
mov dword [esp], esi
call sub.msvcrt.dll__snprintf
mov eax, esi
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
xor ecx, 0xffffffff
and edx, ecx
and edx, 0x80808080
je 0x4c0a68
test edx, 0x8080
jne 0x4c0a8e
shr edx, 0x10
add eax, 2
add dl, dl
mov dword [esp + 0xc], 0
sbb eax, 3
mov dword [esp + 4], esi
sub eax, esi
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.ws2_32.dll_send
sub esp, 0x10
mov ebp, eax
test eax, eax
js 0x4c0b68
mov eax, ebx
call fcn.004be7f0
mov ebp, eax
cmp eax, 2
jne 0x4c0ba4
test edi, edi
je 0x4c0bf0
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.RETR__s_r_n
mov dword [esp + 4], 0x12c
mov dword [esp], esi
call sub.msvcrt.dll__snprintf
mov byte [esp + 0x13f], 0
mov edx, esi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x4c0afd
test eax, 0x8080
je 0x4c0be0
add al, al
mov dword [esp + 0xc], 0
sbb edx, 3
mov dword [esp + 4], esi
sub edx, esi
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.ws2_32.dll_send
sub esp, 0x10
mov ebp, eax
test eax, eax
js 0x4c0b68
mov eax, ebx
call fcn.004be7f0
mov ebp, eax
cmp eax, 1
jne 0x4c0ba4
mov ebp, dword [ebx + 0x30]
add esp, 0x14c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00441df0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.ws2_32.dll_closesocket
push eax
mov dword [ebx + 0x30], 0xffffffff
add esp, 0x14c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.ws2_32.dll_closesocket
neg ebp
push eax
mov dword [ebx + 0x30], 0xffffffff
add esp, 0x14c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4c0a38
or ebp, 0xffffffff
jmp 0x4c0b5b
shr eax, 0x10
add edx, 2
jmp 0x4c0b1f
mov eax, dword [ebx + 0xc]
mov dword [esp + 8], str.RETR__s_r_n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x12c
mov dword [esp], esi
call sub.msvcrt.dll__snprintf
jmp 0x4c0af3
Function at 0x4c2910
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [esp + 4], 0
mov dword [esp], 2
mov edi, dword [esp + 0x164]
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp eax, 0xffffffff
push ecx
push ecx
je 0x4c29c9
lea esi, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 0x18], 0x128
call sub.kernel32.dll_Process32First
test eax, eax
push edx
push edx
jne 0x4c2974
jmp 0x4c29c0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.kernel32.dll_Process32Next
test eax, eax
push ecx
push ecx
je 0x4c29c0
cmp dword [esp + 0x30], edi
jne 0x4c2962
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0x1f0fff
call sub.kernel32.dll_OpenProcess
sub esp, 0xc
mov ebp, eax
test eax, eax
je 0x4c2962
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.kernel32.dll_TerminateProcess
push eax
push eax
mov dword [esp], ebp
call sub.kernel32.dll_CloseHandle
push eax
jmp 0x4c2962
mov dword [esp], ebx
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [esp + 0x160]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.kernel32.dll_TerminateProcess
push edx
push edx
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4c2a10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.kernel32.dll_ReadFile
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x4c2a4c
mov edx, dword [esp + 0x2c]
mov eax, edx
add esp, 0x3c
ret

Function at 0x4c2a60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.kernel32.dll_WriteFile
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x4c2a9c
mov edx, dword [esp + 0x2c]
mov eax, edx
add esp, 0x3c
ret
Function at 0x4d0430
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov al, byte [edx + 8]
cmp al, 3
je 0x4d04b6
mov edi, dword [edx]
test al, 2
jne 0x4d04c0
mov esi, dword [esp + 0x30]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [edx + 9]
mov cl, byte [esi + 3]
sub ebx, ecx
mov dword [esp + 4], ebx
mov ebx, 1
test al, 4
je 0x4d047e
mov esi, dword [esp + 0x30]
xor eax, eax
xor ecx, ecx
mov al, byte [edx + 9]
mov cl, byte [esi + 4]
sub eax, ecx
mov dword [esp + ebx*4 + 4], eax
inc ebx
lea eax, [esp + 4]
xor esi, esi
lea ecx, [eax + ebx*4]
cmp dword [eax], 0
jle 0x4d0507
mov esi, 1
add eax, 4
cmp eax, ecx
jne 0x4d0487
test si, si
je 0x4d04b6
mov al, byte [edx + 9]
cmp al, 4
je 0x4d0585
jbe 0x4d0510
cmp al, 8
je 0x4d05c6
cmp al, 0x10
je 0x4d0532
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x30]
xor ecx, ecx
mov cl, byte [edx + 9]
xor ebx, ebx
mov bl, byte [esi]
mov esi, ecx
sub esi, ebx
xor ebx, ebx
mov dword [esp + 4], esi
mov esi, dword [esp + 0x30]
mov bl, byte [esi + 1]
mov esi, ecx
sub esi, ebx
xor ebx, ebx
mov dword [esp + 8], esi
mov esi, dword [esp + 0x30]
mov bl, byte [esi + 2]
mov dword [esp], ebx
mov ebx, ecx
mov ecx, dword [esp]
sub ebx, ecx
mov dword [esp + 0xc], ebx
mov ebx, 3
jmp 0x4d0465
mov dword [eax], 0
jmp 0x4d0491
cmp al, 2
jne 0x4d04b6
mov eax, dword [edx + 4]
test eax, eax
lea edx, [ebp + eax]
je 0x4d04b6
nop
mov al, byte [ebp]
shr al, 1
and eax, 0x55
mov byte [ebp], al
inc ebp
cmp ebp, edx
jne 0x4d0520
jmp 0x4d04b6
imul edi, ebx
mov dword [esp], edi
test edi, edi
je 0x4d04b6
xor esi, esi
mov cl, byte [ebp + 1]
xor eax, eax
mov al, byte [ebp]
and ecx, 0xff
shl eax, 8
mov edi, ecx
add edi, eax
xor edx, edx
mov eax, esi
and edi, 0xffff
div ebx
inc esi
mov ecx, dword [esp + edx*4 + 4]
sar edi, cl
mov eax, edi
shr ax, 8
mov byte [ebp], al
mov eax, edi
mov byte [ebp + 1], al
add ebp, 2
cmp esi, dword [esp]
jne 0x4d0542
jmp 0x4d04b6
mov ecx, dword [esp + 4]
mov eax, 0xf0
mov ebx, dword [edx + 4]
mov edx, 0xf
sar eax, cl
and eax, 0xfffffff0
sar edx, cl
or edx, eax
test ebx, ebx
je 0x4d04b6
add ebx, ebp
lea esi, [esi]
xor eax, eax
mov al, byte [ebp]
sar eax, cl
and eax, edx
mov byte [ebp], al
inc ebp
cmp ebp, ebx
jne 0x4d05b0
jmp 0x4d04b6
imul edi, ebx
mov dword [esp], edi
test edi, edi
je 0x4d04b6
xor esi, esi
mov al, byte [ebp + esi]
xor edx, edx
and eax, 0xff
mov edi, eax
mov eax, esi
div ebx
mov ecx, dword [esp + edx*4 + 4]
sar edi, cl
mov edx, edi
mov byte [ebp + esi], dl
inc esi
cmp esi, dword [esp]
jne 0x4d05d6
jmp 0x4d04b6
Function at 0x4d5a50
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
cmp byte [edx + 8], 0
jne 0x4d5a80
mov ecx, dword [edx + 4]
test ecx, ecx
lea edx, [eax + ecx]
je 0x4d5a78
lea esi, [esi]
xor byte [eax], 0xff
inc eax
cmp eax, edx
jne 0x4d5a70
pop ebx
ret
mov ecx, dword [edx + 8]
cmp cx, 0x804
je 0x4d5ab3
cmp cx, 0x1004
jne 0x4d5a78
mov ebx, dword [edx + 4]
test ebx, ebx
je 0x4d5a78
mov edx, eax
lea esi, [esi]
xor byte [edx], 0xff
not byte [edx + 1]
add edx, 4
mov ecx, edx
sub ecx, eax
cmp ebx, ecx
ja 0x4d5aa0
pop ebx
ret
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x4d5a78
xor edx, edx
lea esi, [esi]
xor byte [eax + edx], 0xff
add edx, 2
cmp ecx, edx
ja 0x4d5ac0
pop ebx
ret