joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49aae0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1a78
call fcn.00645130
push edi
mov edi, dword [esp + 0x1a80]
test edi, edi
jne 0x49ab03
xor ax, ax
pop edi
add esp, 0x1a78
ret 0x10
mov ecx, dword [0x826818]
push ebx
push esi
push edi
call fcn.004474d0
mov ebx, eax
push 2
lea eax, [esp + 0x18]
push 0x6fb624
push eax
call dword [fcn.0065f1b0]
mov edx, dword [esp + 0x1a9c]
mov ecx, dword [0x6fb626]
mov dword [esp + 0x1c], 6
mov dword [edx], ecx
movsx ax, byte [edi + 0xec]
push eax
push edi
call fcn.00555190
push edi
mov byte [esp + 0x24], al
call fcn.0047c830
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x1aa4]
lea ecx, [esp + 0x28]
push eax
movsx ax, byte [edi + 0xec]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
movsx edx, word [esp + 0x38]
push edi
push ecx
add edx, 0x6fb624
push esi
push edx
call fcn.005560e0
add esp, 0x38
mov word [esi], 0x23a
lea eax, [esi + 0x1a]
mov ecx, 0x77
mov dx, word [eax - 0x1a]
add eax, 0x1a
inc dx
dec ecx
mov word [eax - 0x1a], dx
jne 0x49ab98
mov word [esi + 0xc30], 0x30c
lea eax, [esi + 0xc4a]
mov ecx, 0x77
mov dx, word [eax - 0x1a]
add eax, 0x1a
inc dx
dec ecx
mov word [eax - 0x1a], dx
jne 0x49abbc
mov eax, dword [esp + 0x1a94]
test eax, eax
jle 0x49ad41
movsx eax, bx
push edi
push eax
mov dword [esp + 0x14], 0
call fcn.00476a10
mov ecx, dword [0x73aaac]
add esp, 4
lea edx, [esp + 0x1c]
push eax
push ecx
push 0x6a1518
push edx
call dword [fcn.0065f1cc]
mov edi, dword [fcn.0065f1e8]
push 0x40
lea eax, [esp + 0x30]
push 0x6a0008
push eax
call edi
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x49ac40
push 0x40
lea ecx, [esp + 0x1c]
push 0x69a9ec
push ecx
call edi
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x49ad41
push ebx
call fcn.00476080
mov edx, eax
mov eax, 0xa11eff37
mul edx
mov edi, edx
add esp, 4
shr edi, 0xc
test edi, edi
jle 0x49acd7
mov eax, edi
push ebp
shl eax, 4
add eax, edi
shl eax, 4
sub eax, edi
lea eax, [eax + eax*2]
lea ecx, [edi + eax*2]
shl ecx, 2
push ecx
call fcn.00643b70
push ebx
mov ebp, eax
push edi
push 0x196c
push ebp
call dword [fcn.0065f1bc]
add esp, 0x14
xor edx, edx
test edi, edi
jle 0x49acb9
xor ecx, ecx
mov eax, ecx
shl eax, 4
add eax, ecx
shl eax, 4
sub eax, ecx
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x1a98]
cmp dword [ebp + ecx*4], eax
je 0x49acb9
inc edx
movsx ecx, dx
cmp ecx, edi
jl 0x49ac92
movsx ecx, dx
cmp ecx, edi
mov edi, 1
jl 0x49acc9
mov edi, dword [esp + 0x10]
push ebp
call fcn.00643cfc
add esp, 4
test edi, edi
pop ebp
jne 0x49ad37
mov ecx, 0x65a
xor eax, eax
lea edi, [esp + 0x11c]
mov edx, dword [esp + 0x1a94]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1a90]
lea edi, [esp + 0x120]
push 2
mov dword [esp + 0x11c], edx
mov ecx, dword [eax]
push 0
mov dword [esp + 0x124], ecx
mov ecx, 0x618
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [fcn.0065f1d4]
push ebx
push 1
lea edx, [esp + 0x12c]
push 0x196c
push edx
call dword [fcn.0065f1b4]
add esp, 0x1c
push ebx
call dword [fcn.0065f1c0]
add esp, 4
mov ax, word [esp + 0x14]
pop esi
pop ebx
pop edi
add esp, 0x1a78
ret 0x10
Function at 0x49b630
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x64c85b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4c
push ebp
lea ecx, [esp + 0xc]
call fcn.00643d62
mov eax, dword [esp + 0xb60]
mov dword [esp + 0xb58], 0
and eax, 0xff
push eax
call fcn.00476a10
mov ecx, dword [0x73aaac]
add esp, 4
lea edx, [esp + 0xc]
push eax
push ecx
push 0x6a1544
push edx
call fcn.00643d50
mov eax, dword [esp + 0x1c]
push 0x6a0008
push eax
call dword [fcn.0065f1b8]
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x49b78d
push esi
push edi
mov ecx, 0x2d0
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xb74]
cmp ecx, 0xb4
jb 0x49b6cc
mov ecx, 0xb4
mov esi, dword [esp + 0xb78]
lea edi, [esp + 0x18]
shl ecx, 4
mov edx, ecx
mov eax, dword [esp + 0xb70]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [fcn.0065f1d4]
lea edi, [eax + eax*4]
push edi
push ebp
call esi
push ebp
push 5
lea eax, [esp + 0x20]
push 1
push eax
call dword [fcn.0065f1bc]
mov al, byte [esp + 0x28]
add esp, 0x1c
cmp al, 1
jne 0x49b73b
mov ecx, dword [esp + 0xd]
push 0
push ecx
push ebp
call esi
push ebp
push 0xb40
lea edx, [esp + 0x2c]
push 1
push edx
call dword [fcn.0065f1b4]
add esp, 0x1c
jmp 0x49b781
push ebx
push 2
push 0
push ebp
call esi
push ebp
call fcn.00476080
mov ebx, eax
push ebp
push 0xb40
lea eax, [esp + 0x34]
push 1
push eax
call dword [fcn.0065f1b4]
push 0
push edi
push ebp
call esi
push ebp
push 5
lea ecx, [esp + 0x44]
push 1
push ecx
mov byte [esp + 0x4c], 1
mov dword [esp + 0x4d], ebx
call dword [fcn.0065f1b4]
add esp, 0x3c
pop ebx
push ebp
call dword [fcn.0065f1c0]
add esp, 4
pop edi
pop esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xb58], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0xb50]
pop ebp
mov dword fs:[0], ecx
add esp, 0xb58
ret
Function at 0x49d420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
jne 0x49d430
xor ax, ax
pop ebp
ret 0x10
xor ecx, ecx
push ebx
mov cx, word [0x6f35fe]
xor eax, eax
push esi
push edi
test ecx, ecx
jle 0x49d45b
mov dl, byte [0x6e5bcd]
mov bl, byte [eax + 0x6fb624]
xor bl, dl
mov byte [eax + 0x6fb624], bl
inc eax
cmp eax, ecx
jl 0x49d448
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
movsx eax, si
mov edi, ebx
push 2
lea ecx, [eax + eax*2]
xor eax, eax
shl ecx, 2
mov edx, ecx
push 0x6fb624
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x1c], 0
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [fcn.0065f1b0]
lea eax, [esp + 0x1c]
push eax
call edi
mov eax, dword [esp + 0x20]
add esp, 0xc
xor ecx, ecx
test ax, ax
setl cl
dec ecx
and eax, ecx
cmp si, ax
mov dword [esp + 0x14], eax
jge 0x49d4b9
mov dword [esp + 0x14], esi
mov edx, dword [esp + 0x20]
push 4
push 0x6fb626
push edx
call edi
movsx ax, byte [ebp + 0xec]
push eax
push ebp
mov dword [esp + 0x30], 6
call fcn.00555190
movsx eax, word [esp + 0x30]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x30]
push ecx
push edx
add eax, 0x6fb624
push ebx
push eax
call fcn.00556780
mov ax, word [esp + 0x38]
add esp, 0x24
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x49d600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
jne 0x49d610
xor ax, ax
pop ebp
ret 0x10
xor ecx, ecx
push ebx
mov cx, word [0x6f35fe]
xor eax, eax
push esi
push edi
test ecx, ecx
jle 0x49d63b
mov dl, byte [0x6e5bce]
mov bl, byte [eax + 0x6fb624]
xor bl, dl
mov byte [eax + 0x6fb624], bl
inc eax
cmp eax, ecx
jl 0x49d628
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
movsx eax, si
mov edi, ebx
push 2
lea ecx, [eax + eax*2]
push 0x6fb624
mov dword [esp + 0x1c], 0
lea ecx, [eax + ecx*4]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [fcn.0065f1b0]
lea eax, [esp + 0x1c]
push eax
call edi
mov eax, dword [esp + 0x20]
add esp, 0xc
xor ecx, ecx
test ax, ax
setl cl
dec ecx
and eax, ecx
cmp si, ax
mov dword [esp + 0x14], eax
jge 0x49d699
mov dword [esp + 0x14], esi
mov edx, dword [esp + 0x20]
push 4
push 0x6fb626
push edx
call edi
movsx ax, byte [ebp + 0xec]
push eax
push ebp
mov dword [esp + 0x30], 6
call fcn.00555190
movsx eax, word [esp + 0x30]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x30]
push ecx
push edx
add eax, 0x6fb624
push ebx
push eax
call fcn.00556850
mov ax, word [esp + 0x38]
add esp, 0x24
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x49dfb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
movsx ecx, word [0x6fb630]
stosw word es:[edi], ax
mov edx, dword [0x73aaac]
stosb byte es:[edi], al
mov eax, dword [0x6fb628]
push eax
push 0x6fb632
push ecx
push edx
lea eax, [esp + 0x18]
push 0x6a2c40
push eax
call dword [fcn.0065f1cc]
lea ecx, [esp + 0x20]
push 0x69a9ec
push ecx
call dword [fcn.0065f1b8]
mov esi, eax
add esp, 0x20
test esi, esi
je 0x49e02a
push esi
push 1
push 0x60
push 0x6fb63d
call dword [fcn.0065f1b4]
push esi
call dword [fcn.0065f1c0]
add esp, 0x14
pop edi
pop esi
add esp, 0x104
ret

Function at 0x49e0a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x73aaac]
push 0x6fb632
stosb byte es:[edi], al
movsx eax, word [0x6fb630]
push eax
push ecx
lea edx, [esp + 0x14]
push 0x6a2c5c
push edx
call dword [fcn.0065f1cc]
lea eax, [esp + 0x1c]
push 0x69a9ec
push eax
call dword [fcn.0065f1b8]
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x49e117
push esi
push 1
push 0xc0
push 0x6fb63d
call dword [fcn.0065f1b4]
push esi
call dword [fcn.0065f1c0]
add esp, 0x14
pop edi
pop esi
add esp, 0x104
ret
Function at 0x4a41c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64cc7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x668be8
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x4a4250
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x4a4217
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [fcn.0065e0cc]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x4a4241
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00644140
jmp 0x4a4256
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00644140
jmp 0x4a4256
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x661578
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0064406e
mov ecx, esi
mov dword [edi], 0x6602dc
mov dword [esp + 0x1c], 0xffffffff
call fcn.0064411c
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a6530
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [fcn.0065e160]
mov esi, ecx
call edi
sub eax, dword [0x828b24]
cmp eax, 0x1e
jb 0x4a6585
call edi
mov edi, dword [esp + 0xc]
mov dword [0x828b24], eax
cmp edi, dword [esi + 0xe2]
je 0x4a6577
mov eax, dword [esi]
push 0
push 0
push 0xf
mov ecx, esi
mov dword [esi + 0xe2], edi
mov dword [esi + 0xce], 2
call dword [eax + 4]
mov ecx, dword [esi + 0x3016]
push 1
push edi
call fcn.00513c40
pop edi
pop esi
ret 8

Function at 0x4a6590
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [fcn.0065e160]
mov esi, ecx
call edi
sub eax, dword [0x828b24]
cmp eax, 0x1e
jb 0x4a660a
call edi
mov edi, dword [esp + 0xc]
mov dword [0x828b24], eax
mov ecx, dword [esi + 0xde]
cmp edi, ecx
je 0x4a65fc
mov eax, dword [esi + 0xda]
mov dword [esi + 0xde], edi
sub eax, ecx
mov ecx, dword [esi + 0xd2]
add eax, edi
dec ecx
cmp eax, ecx
jge 0x4a65df
mov dword [esi + 0xda], eax
jmp 0x4a65e5
mov dword [esi + 0xda], ecx
mov eax, dword [esi]
push 0
push 0
push 0xf
mov ecx, esi
mov dword [esi + 0xce], 1
call dword [eax + 4]
mov ecx, dword [esi + 0x301a]
push 1
push edi
call fcn.00513c40
pop edi
pop esi
ret 8

Function at 0x4a6c40
Capabilities:
Check http status code

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 8]
cmp eax, 0x13
mov dword [edi], eax
jne 0x4a6c56
mov dword [edi], 6
mov eax, dword [edi]
push esi
cmp eax, 0xffffffff
jne 0x4a6d9b
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
test esi, esi
mov dword [ecx], esi
jge 0x4a6c7b
mov dword [ecx], 0
jmp 0x4a6da5
cmp esi, 0x190
jge 0x4a6ca8
mov eax, dword [0x826804]
cmp esi, eax
jl 0x4a6c94
dec eax
mov dword [ecx], eax
mov eax, dword [0x826804]
cmp eax, 1
jge 0x4a6da5
mov dword [edi], 6
jmp 0x4a6d9f
cmp esi, 0x1f4
jge 0x4a6cc7
cmp esi, 0x1b0
jl 0x4a6da5
mov dword [ecx], 0x1af
jmp 0x4a6da5
cmp esi, 0x258
jge 0x4a6ce6
cmp esi, 0x228
jl 0x4a6da5
mov dword [ecx], 0x227
jmp 0x4a6da5
cmp esi, 0x2bc
jge 0x4a6d1d
mov eax, dword [0x826808]
lea edx, [eax + 0x258]
cmp esi, edx
jl 0x4a6d09
add eax, 0x257
mov dword [ecx], eax
mov eax, dword [0x826808]
cmp eax, 1
jge 0x4a6da5
mov dword [edi], 6
jmp 0x4a6d9f
cmp esi, 0x320
jge 0x4a6d4d
mov eax, dword [0x826810]
lea edx, [eax + 0x2bc]
cmp esi, edx
jl 0x4a6d40
add eax, 0x2bb
mov dword [ecx], eax
mov eax, dword [0x826810]
cmp eax, 1
jge 0x4a6da5
mov dword [edi], 6
jmp 0x4a6d9f
cmp esi, 0x3e8
jge 0x4a6d93
mov edx, dword [0x826824]
mov eax, dword [edx + 0xc]
test eax, eax
jne 0x4a6d66
xor edx, edx
jmp 0x4a6d7c
mov edx, dword [edx + 0x10]
sub edx, eax
mov eax, 0x78787879
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + 0x320]
cmp esi, eax
jl 0x4a6d8e
lea eax, [edx + 0x31f]
mov dword [ecx], eax
cmp edx, 1
jge 0x4a6da5
mov dword [edi], 6
jmp 0x4a6d9f
mov ecx, dword [esp + 0x10]
mov dword [ecx], 0xffffffff
mov eax, dword [0x6e776e]
pop esi
test eax, eax
je 0x4a6dbb
mov dword [edi], 0xf
mov dword [ecx], 0xffffffff
pop edi
ret
Function at 0x4ab210
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x64d2c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0
mov ecx, dword [esi + eax*4 + 0x80]
mov eax, dword [esp + 0x30]
push eax
push 0x13e7
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [esp + 0x2c]
call fcn.00643d62
push 0x6b561c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0
call fcn.00643d2c
mov eax, dword [0x828b04]
mov byte [esp + 0x20], 1
test eax, eax
je 0x4ab285
push 0x6c7010
lea ecx, [esp + 0x2c]
call fcn.006440b6
push 0x69a8e4
lea ecx, [esp + 0x18]
call fcn.00643d2c
push 0x6b55e8
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x2c], 2
call fcn.00643ea6
mov edi, dword [esi + 0x62]
mov ebx, dword [eax]
mov edx, dword [esp + 0x28]
mov ebp, dword [esi + 0x788]
mov eax, edi
push edx
push eax
mov byte [esp + 0x28], 3
call fcn.004760c0
lea ecx, [eax + eax*4]
add esp, 4
mov eax, edi
lea edx, [ecx*2 + 0x6a774c]
mov ecx, 0x64
push edx
cdq
idiv ecx
mov eax, edi
mov ecx, 0x2710
push edx
cdq
idiv ecx
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x68db8bad
push edx
imul edi
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push edx
push ebp
add ebp, 0x18
lea edx, [esp + 0x44]
push ebp
push ebx
push edx
call fcn.00643d50
add esp, 0x24
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.00643d26
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.00643d26
mov eax, dword [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00643d44
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call fcn.00643d26
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x4b0c30
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
mov ebx, dword [0x65e1b8]
mov ebp, dword [0x65e1b4]
push esi
mov esi, ecx
push edi
mov edi, dword [0x65e274]
mov eax, dword [esi + 4]
test eax, eax
je 0x4b0c90
mov eax, dword [eax + 0x70]
push eax
call edi
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x6c]
push edx
call edi
mov eax, dword [esi + 4]
push 0x3e8
mov ecx, dword [eax + 0x2c]
push ecx
call ebx
test eax, eax
je 0x4b0c7b
mov edx, dword [esi + 4]
push 0
mov eax, dword [edx + 0x2c]
push eax
call ebp
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b0c90
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov dword [esi + 4], 0
mov ecx, esi
call fcn.004b0bf0
mov eax, dword [esi + 0x860]
test eax, eax
je 0x4b0cf7
mov eax, dword [eax + 0x88]
push eax
call edi
mov ecx, dword [esi + 0x860]
mov edx, dword [ecx + 0x84]
push edx
call edi
mov eax, dword [esi + 0x860]
push 0x3e8
mov ecx, dword [eax + 0x2c]
push ecx
call ebx
test eax, eax
je 0x4b0cdc
mov edx, dword [esi + 0x860]
push 0
mov eax, dword [edx + 0x2c]
push eax
call ebp
mov ecx, dword [esi + 0x860]
test ecx, ecx
je 0x4b0cf7
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov dword [esi + 0x860], 0
mov dword [esi + 0x850], 0
mov eax, dword [0x8267d8]
test eax, eax
je 0x4b0d38
mov eax, dword [esi + 8]
test eax, eax
jne 0x4b0d38
call fcn.00643ee2
test eax, eax
je 0x4b0d23
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x4b0d25
xor eax, eax
mov eax, dword [eax + 0x20]
push 0
push 0
push 0xfcc
push eax
call dword [fcn.0065f498]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4b1d70
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x128
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
push edi
mov edi, dword [esp + 0x13c]
xor esi, esi
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], esi
lea ebp, [edi + 1]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x34]
push eax
push 0
push 0
push ecx
push ebp
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], 1
call fcn.0064542c
cmp eax, 1
jne 0x4b1ebc
lea edx, [esp + 0x34]
push edx
push edi
call fcn.0064544a
test eax, eax
je 0x4b1ebc
mov eax, 0x8024
push 0
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
push edi
call fcn.00645426
test eax, eax
jle 0x4b1ebc
add esi, eax
cmp esi, 0x10
jb 0x4b1d99
mov edx, ebx
mov eax, dword [edx]
mov dword [esp + 0x18], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x1c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0xc]
mov ecx, eax
mov dword [esp + 0x24], eax
and ecx, 0xffff
add ecx, 0x10
cmp esi, ecx
jb 0x4b1d99
and eax, 0xffff
lea esi, [ebx + 0x10]
mov ecx, eax
mov edi, ebx
mov edx, ecx
mov dword [esp + 0x14], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x1c]
mov ecx, edx
and ecx, 3
test al, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x4b1ea8
mov eax, dword [esp + 0x26]
and eax, 0xffff
push eax
mov dword [esp + 0x14], eax
call fcn.00643b70
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4b1ebc
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
push ebp
call fcn.00640d90
add esp, 0x10
test eax, eax
jne 0x4b1e9f
mov eax, dword [esp + 0x10]
mov esi, ebp
mov ecx, eax
mov edi, ebx
mov edx, ecx
mov word [esp + 0x26], ax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.00643cfc
add esp, 4
mov eax, dword [esp + 0x26]
pop edi
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x128
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
Function at 0x4b1ed0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x128
push ebx
push ebp
mov ebp, dword [fcn.0065f2bc]
push esi
xor esi, esi
push edi
push esi
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], esi
call ebp
mov ebx, dword [esp + 0x144]
mov edi, dword [esp + 0x140]
add esp, 4
mov dword [esp + 0x10], eax
push 0
call ebp
mov edx, dword [esp + 0x14]
add esp, 4
sub eax, edx
cmp eax, 0xa
jge 0x4b1fd9
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x34]
push eax
push 0
push 0
lea edx, [edi + 1]
push ecx
push edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], 1
call fcn.0064542c
cmp eax, 1
jne 0x4b1fd9
mov eax, 0x8024
push 0
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
push edi
call fcn.00645426
test eax, eax
jle 0x4b1fd9
add esi, eax
cmp esi, 0x10
jb 0x4b1f06
mov edx, ebx
mov eax, dword [edx]
mov dword [esp + 0x18], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x1c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0xc]
mov ecx, eax
mov dword [esp + 0x24], eax
and ecx, 0xffff
add ecx, 0x10
cmp esi, ecx
jb 0x4b1f06
and eax, 0xffff
lea esi, [ebx + 0x10]
mov ecx, eax
mov edi, ebx
mov edx, ecx
mov dword [esp + 0x14], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x1c]
mov ecx, edx
and ecx, 3
test al, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x4b2024
mov eax, dword [esp + 0x26]
and eax, 0xffff
push eax
mov dword [esp + 0x14], eax
call fcn.00643b70
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4b1fe6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
push ebp
call fcn.00640d90
add esp, 0x10
test eax, eax
jne 0x4b201b
mov eax, dword [esp + 0x10]
mov esi, ebp
mov ecx, eax
mov edi, ebx
mov edx, ecx
mov word [esp + 0x26], ax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.00643cfc
add esp, 4
mov eax, dword [esp + 0x26]
pop edi
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x128
ret
Function at 0x4bf038
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64dc38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov eax, dword [esi + 0x14]
mov dword [esi + 0x4b19a], 0
push eax
mov dword [esi + 0x4b196], 0
call fcn.00644170
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push 1
push ecx
lea eax, [esp + 0xc]
push edx
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004b8840
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.0064416a
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x4c9a80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [fcn.0065e008]
mov esi, eax
test esi, esi
jne 0x4c9ae2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [fcn.0065e014]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [fcn.0065e1a4]
mov edx, dword [esp + 4]
push edx
call dword [fcn.0065e010]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x4c9cf0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push 0x69af6c
mov edi, ecx
push 0
call dword [fcn.0065f2cc]
mov esi, eax
cmp esi, 0x20
ja 0x4c9de4
lea ecx, [esp + 0x10]
push ecx
push 0x6b6660
push 0x80000000
mov ecx, edi
call fcn.004c9a80
test eax, eax
jne 0x4c9de4
mov ebx, dword [0x65e1d4]
lea edx, [esp + 0x10]
push 0x6b664c
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x80000000
mov ecx, edi
call fcn.004c9a80
test eax, eax
jne 0x4c9de4
lea edx, [esp + 0x10]
push 0x6b6644
push edx
call dword [0x65f254]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c9db5
lea eax, [esp + 0x10]
push 0x6b6640
push eax
call dword [fcn.0065f1fc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c9db5
lea ecx, [esp + 0x10]
push ecx
call dword [fcn.0065e184]
lea esi, [esp + eax + 0xf]
jmp 0x4c9db8
mov byte [esi], 0
push 0x69cc68
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [0x65e1d0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x4cdca0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x64e9e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00643d62
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0
test eax, eax
jne 0x4cdce1
lea eax, [esi + 8]
lea ecx, [esp + 4]
push eax
call fcn.00644098
jmp 0x4cdceb
push eax
lea ecx, [esp + 8]
call fcn.006440b6
mov esi, dword [esi + 4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 4]
push esi
push ecx
push edx
push eax
call dword [fcn.0065e168]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc