joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4664b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd0
mov esi, esp
mov dword [esi + 0xb8], ebp
mov dword [esi + 0xbc], esp
mov dword [esi + 0xc8], 0xffffffff
lea eax, [esi + 0xc0]
mov dword [esi + 0xc4], 0x5cd8e0
mov ecx, dword fs:[0]
mov dword [esi + 0xc0], ecx
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov eax, dword [0x60a8b0]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete dl
setne al
cmp dword [0x60a8b4], 0xa
setl ah
setge cl
mov dword [edi + 8], 0
cmp ah, dl
jne 0x466542
or cl, al
je 0x466542
nop word cs:[eax + eax]
jmp 0x466540
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], esp
lea ecx, [ebp + 8]
lea eax, [ebp + 0x10]
push eax
sub esp, 0x38
mov edi, esp
movzx edx, byte [ecx + 0x30]
mov byte [esi + 6], dl
movzx edx, byte [ecx + 0x34]
mov byte [esi + 7], dl
lea ecx, [edi + 0xc]
mov dword [esi + 0x10], edi
mov dword [edi + 0x30], 0
mov dword [esi + 0xc8], 1
mov dword [esi + 8], ecx
push eax
call fcn.00539cc0
mov eax, dword [esi + 0x10]
add eax, 4
lea ecx, [ebp + 8]
mov ecx, dword [ecx + 4]
mov dword [esi + 0xc8], 3
push ecx
push eax
call fcn.00539ee0
add esp, 8
lea eax, [esi + 0x18]
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
movzx eax, byte [esi + 6]
mov byte [ecx + 0x34], al
movzx eax, byte [esi + 7]
mov byte [ecx + 0x38], al
mov dword [esi + 0xc8], 0
call fcn.0052ae70
add esp, 0x3c
mov esp, dword [esi + 0x14]
mov dword [esi + 0xc8], 2
lea ecx, [esi + 0x18]
push dword [esi + 0xc]
push 1
call fcn.0052b010
lea ecx, [esi + 0x48]
call fcn.00530570
lea ecx, [esi + 0x18]
call fcn.00523170
lea ecx, [ebp + 0x10]
call fcn.00523170
lea eax, [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [esi + 0xc0]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47efb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub edx, ecx
mov ebx, 0x9ebe122e
xor esi, esi
mov eax, 0x811c9dc5
mov edi, 0x54899540
cmp esi, edx
mov ebp, 0xb1697bc8
cmovb ebp, edi
nop dword [eax]
cmp ebx, 0xd3a46413
jle 0x47f010
cmp ebx, 0xd3a46414
je 0x47f076
cmp ebx, 0x4d4ddb9d
je 0x47f030
cmp ebx, 0x54899540
jne 0x47efe0
jmp 0x47f040
cmp ebx, 0x9ebe122e
je 0x47f027
cmp ebx, 0xb1697bc8
jne 0x47efe0
mov ebx, 0xd3a46414
jmp 0x47efe0
mov ebx, ebp
jmp 0x47efe0
inc esi
mov ebx, 0x9ebe122e
jmp 0x47efcf
movzx ebx, byte [ecx + esi]
mov ebp, eax
not ebp
and ebp, 0x944bbafb
and eax, 0x6bb44504
or eax, ebp
mov ebp, ebx
not ebp
and ebp, 0x944bbafb
and ebx, 4
or ebx, ebp
xor ebx, eax
imul eax, ebx, 0x1000193
mov ebx, 0x4d4ddb9d
jmp 0x47efcf
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4c2af0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x606180]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x60b760]
mov ecx, dword [0x60b764]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [ebp - 0x11]
cmp ecx, 0xa
setl byte [ebp - 0x12]
movzx eax, byte [ebp + 0xc]
movzx edi, al
mov eax, 0xb16b3ab5
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, 0x8f7bc04
nop
cmp eax, 0x748439e
jle 0x4c2b60
cmp eax, 0x748439f
je 0x4c2bb5
cmp eax, 0x8f7bc04
jne 0x4c2b40
jmp 0x4c2bff
cmp eax, 0xb16b3ab5
je 0x4c2bd0
cmp eax, 0xdcf4078a
jne 0x4c2b40
push eax
mov eax, esp
mov dword [eax], edi
push eax
push 0x8004667e
push dword [ebp + 8]
call ebx
mov eax, dword [0x60b760]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x748439f
cmove eax, esi
cmp dword [0x60b764], 0xa
mov edx, 0x748439f
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, esi
jmp 0x4c2b40
push eax
mov eax, esp
mov dword [eax], edi
push eax
push 0x8004667e
push dword [ebp + 8]
call ebx
mov eax, 0xdcf4078a
jmp 0x4c2b40
movzx ecx, byte [ebp - 0x11]
movzx eax, byte [ebp - 0x12]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x748439f
mov esi, 0xdcf4078a
cmovne eax, esi
test cl, cl
mov ecx, 0x748439f
cmove eax, ecx
test dl, dl
cmovne eax, esi
jmp 0x4c2b39
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce735
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c36b0
Capabilities:
Get socket status

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ebx, dword [esp + 0x28]
mov eax, 0x2aced132
xor esi, esi
jmp 0x4c36f0
cmp edx, 0xffffffff
cmovne eax, ebp
cmp ecx, 0xa
cmovge eax, ebp
nop
cmp eax, 0xfe91359
jle 0x4c3730
cmp eax, 0x55cd76ee
jg 0x4c3760
cmp eax, 0xfe9135a
je 0x4c37e3
cmp eax, 0x17a20991
je 0x4c3821
cmp eax, 0x2aced132
jne 0x4c36f0
mov eax, 0xb71a73ec
jmp 0x4c36f0
cmp eax, 0xb71a73eb
jle 0x4c37c3
cmp eax, 0xb71a73ec
je 0x4c383e
cmp eax, 0xedcd2581
je 0x4c3871
cmp eax, 0x253a508
jne 0x4c36f0
mov eax, 0x6053476a
jmp 0x4c36f0
cmp eax, 0x55cd76ef
je 0x4c38b3
cmp eax, 0x5674bf40
je 0x4c38bd
cmp eax, 0x6053476a
jne 0x4c36f0
mov eax, dword [0x60b770]
lea edx, [eax + 1]
imul edx, eax
mov edi, edx
xor edi, 0xfffffffe
mov ecx, 0xa21f4fa3
mov eax, 0x253a508
mov ebp, 0xa21f4fa3
test edi, edx
sete dl
je 0x4c37ac
mov ebp, 0x253a508
cmp dword [0x60b774], 0xa
cmovl eax, ebp
setl dh
xor dl, dh
cmovne eax, ecx
jmp 0x4c36f0
cmp eax, 0x8418b758
je 0x4c38c7
cmp eax, 0xa21f4fa3
jne 0x4c3905
mov eax, 0xaedbc496
jmp 0x4c36f0
mov eax, dword [0x60b770]
mov ecx, dword [0x60b774]
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl ah
xor ah, al
mov eax, 0xedcd2581
mov ebp, 0xedcd2581
jne 0x4c36e3
mov ebp, 0x55cd76ef
jmp 0x4c36e3
call fcn.005d78b7
cmp dword [eax], 4
mov eax, 0xfe9135a
je 0x4c36f0
mov eax, 0x8418b758
jmp 0x4c36f0
mov eax, dword [esp]
mov eax, dword [eax]
inc eax
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push ebx
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
mov eax, 0x17a20991
test esi, esi
js 0x4c36f0
mov eax, 0x8418b758
jmp 0x4c36f0
mov eax, dword [0x60b770]
lea edx, [eax + 1]
imul edx, eax
mov edi, edx
xor edi, 0xfffffffe
mov ecx, 0x5674bf40
mov eax, 0x55cd76ef
mov ebp, 0x5674bf40
test edi, edx
sete dl
je 0x4c389c
mov ebp, 0x55cd76ef
cmp dword [0x60b774], 0xa
cmovl eax, ebp
setl dh
xor dh, dl
cmovne eax, ecx
jmp 0x4c36f0
mov eax, 0xedcd2581
jmp 0x4c36f0
mov eax, 0x2aced132
jmp 0x4c36f0
mov eax, dword [0x60b770]
mov ecx, dword [0x60b774]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl ah
xor ah, al
mov eax, 0x6053476a
mov ebp, 0x6053476a
jne 0x4c36e3
mov ebp, 0x253a508
jmp 0x4c36e3
cmp eax, 0xaedbc496
jne 0x4c36f0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c7c70
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x606180]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x60b810]
mov ecx, dword [0x60b814]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [ebp - 0x11]
cmp ecx, 0xa
setl byte [ebp - 0x12]
mov eax, 0xbe545903
mov esi, 0x7c287797
mov edi, 0x33f2ac32
mov ebx, 0x2feb3902
jmp 0x4c7cd0
mov eax, 0xc7aa8380
nop word cs:[eax + eax]
cmp eax, 0x1d3e7f7
jle 0x4c7d80
cmp eax, 0x33f2ac31
jle 0x4c7db0
cmp eax, 0x33f2ac32
je 0x4c7e0b
cmp eax, 0x6c5538cb
je 0x4c7e25
cmp eax, 0x7c287797
jne 0x4c7cd0
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x1c], eax
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov edx, dword [0x60b810]
mov ecx, dword [0x60b814]
lea eax, [edx + 1]
imul eax, edx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete dl
cmp ecx, 0xa
setl dh
xor dh, dl
mov edx, 0xf33734a7
cmovne edx, ebx
cmp eax, 0xffffffff
mov eax, edx
cmove eax, ebx
cmp ecx, 0xa
cmovge eax, edx
jmp 0x4c7cd0
cmp eax, 0xc7aa837f
jle 0x4c7dd0
cmp eax, 0xf07d8d34
je 0x4c7e56
cmp eax, 0xf33734a7
jne 0x4c7e6a
mov eax, 0x7c287797
jmp 0x4c7cd0
cmp eax, 0x1d3e7f8
je 0x4c7e60
cmp eax, 0x2feb3902
jne 0x4c7cd0
mov eax, 0xf07d8d34
jmp 0x4c7cd0
cmp eax, 0x9db78253
je 0x4c7cbc
cmp eax, 0xbe545903
jne 0x4c7cd0
movzx ecx, byte [ebp - 0x11]
movzx eax, byte [ebp - 0x12]
mov edx, ecx
xor dl, al
mov edx, 0xf33734a7
cmovne edx, esi
test al, al
mov eax, edx
cmovne eax, esi
test cl, cl
cmove eax, edx
jmp 0x4c7cd0
call fcn.005d78b7
cmp dword [eax], 4
mov eax, 0x9db78253
mov ecx, 0x1d3e7f8
cmove eax, ecx
jmp 0x4c7cd0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov ecx, dword [ecx]
inc ecx
push dword [eax + 8]
push 0
push dword [eax + 4]
push 0
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
mov eax, 0x9db78253
cmovs eax, edi
jmp 0x4c7cd0
mov eax, 0x6c5538cb
jmp 0x4c7cd0
mov eax, 0xf07d8d34
jmp 0x4c7cd0
cmp eax, 0xc7aa8380
jne 0x4c7cd0
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce735
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c8000
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x265e2637
xor esi, esi
mov ebx, dword [sym.imp.WS2_32.dll_recv]
jmp 0x4c8030
cmp dword [0x60b820], 0xa
cmovl eax, edi
setl dh
xor dh, dl
cmovne eax, ecx
nop word cs:[eax + eax]
cmp eax, 0x2504d8a
jg 0x4c8070
cmp eax, 0xd69f1d47
jg 0x4c80a0
cmp eax, 0x8a2284d3
je 0x4c80eb
cmp eax, 0xa2835b39
je 0x4c811e
cmp eax, 0xc3820574
jne 0x4c8030
mov eax, 0x265e2637
jmp 0x4c8030
cmp eax, 0x2af4a9e4
jg 0x4c80cb
cmp eax, 0x2504d8b
je 0x4c813b
cmp eax, 0x146050f7
je 0x4c8145
cmp eax, 0x265e2637
jne 0x4c8030
mov eax, 0x8a2284d3
jmp 0x4c8030
cmp eax, 0xd69f1d48
je 0x4c8189
cmp eax, 0xe5f80be7
je 0x4c81bd
cmp eax, 0xfb9d8d5b
jne 0x4c8030
mov eax, 0x146050f7
jmp 0x4c8030
cmp eax, 0x46c2102d
je 0x4c8200
cmp eax, 0x673c0ec8
jne 0x4c8235
mov eax, 0xe5f80be7
jmp 0x4c8030
mov eax, dword [esp + 0x20]
push dword [eax]
mov eax, dword [esp + 0x20]
push dword [eax]
mov eax, dword [esp + 0x20]
push dword [eax]
mov eax, dword [esp + 0x20]
push dword [eax]
call ebx
mov esi, eax
mov eax, 0xa2835b39
test esi, esi
js 0x4c8030
mov eax, 0xd69f1d48
jmp 0x4c8030
call fcn.005d78b7
cmp dword [eax], 4
mov eax, 0x46c2102d
je 0x4c8030
mov eax, 0xd69f1d48
jmp 0x4c8030
mov eax, 0x2af4a9e5
jmp 0x4c8030
mov eax, dword [0x60b824]
mov ecx, dword [0x60b820]
lea edx, [eax + 1]
imul edx, eax
mov ebp, edx
xor ebp, 0xfffffffe
test ebp, edx
sete al
cmp ecx, 0xa
setl ah
xor ah, al
mov eax, 0x2504d8b
mov edi, 0x2504d8b
jne 0x4c8179
mov edi, 0xfb9d8d5b
test ebp, edx
cmovne eax, edi
cmp ecx, 0xa
cmovge eax, edi
jmp 0x4c8030
mov eax, dword [0x60b824]
lea edx, [eax + 1]
imul edx, eax
mov ebp, edx
xor ebp, 0xfffffffe
mov ecx, 0x146050f7
mov eax, 0xfb9d8d5b
mov edi, 0x146050f7
test ebp, edx
sete dl
je 0x4c8013
mov edi, 0xfb9d8d5b
jmp 0x4c8013
mov eax, dword [0x60b824]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
mov ecx, 0xc3820574
mov eax, 0x673c0ec8
mov edi, 0xc3820574
cmp edx, 0xffffffff
sete dl
je 0x4c81e9
mov edi, 0x673c0ec8
cmp dword [0x60b820], 0xa
cmovl eax, edi
setl dh
xor dl, dh
cmovne eax, ecx
jmp 0x4c8030
mov eax, dword [0x60b824]
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
mov ecx, 0xe5f80be7
mov eax, 0x673c0ec8
mov edi, 0xe5f80be7
cmp edx, 0xffffffff
sete dl
je 0x4c8013
mov edi, 0x673c0ec8
jmp 0x4c8013
cmp eax, 0x2af4a9e5
jne 0x4c8030
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c86f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x60b830]
mov ecx, dword [0x60b834]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [esp + 2]
cmp ecx, 0xa
setl byte [esp + 3]
mov eax, 0x256482bc
mov edi, dword [sym.imp.WS2_32.dll_send]
mov ebx, 0xa2c5114
nop
cmp eax, 0x361d9712
jg 0x4c8770
cmp eax, 0xa2c5114
je 0x4c879b
cmp eax, 0x256482bc
jne 0x4c8730
movzx ecx, byte [esp + 2]
movzx eax, byte [esp + 3]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x5829a5af
cmovne eax, ebx
test cl, cl
mov ecx, 0x5829a5af
cmove eax, ecx
test dl, dl
cmovne eax, ebx
jmp 0x4c8730
cmp eax, 0x361d9713
je 0x4c87f3
cmp eax, 0x5829a5af
jne 0x4c8730
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
mov ebp, dword [esi + 4]
push dword [eax]
push dword [ecx]
push dword [ebp]
push dword [edx]
call edi
mov eax, 0xa2c5114
jmp 0x4c8730
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
mov ebp, dword [esi + 4]
push dword [eax]
push dword [ecx]
push dword [ebp]
push dword [edx]
call edi
mov dword [esp + 4], eax
mov eax, dword [0x60b830]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x5829a5af
mov ebp, 0x361d9713
cmove eax, ebp
cmp dword [0x60b834], 0xa
mov edx, 0x5829a5af
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, ebp
jmp 0x4c8730
mov eax, dword [esp + 4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c9140
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, esp
mov eax, dword [0x606180]
xor eax, ebp
mov dword [esi + 0x18], eax
mov eax, dword [0x60b848]
mov ecx, dword [0x60b84c]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [esi + 5]
cmp ecx, 0xa
setl byte [esi + 6]
mov eax, 0x20ced82b
mov edi, 0xb46f32b9
mov ebx, 0x29970dd0
nop dword [eax + eax]
cmp eax, 0x29970dcf
jle 0x4c91e0
cmp eax, 0x29970dd0
je 0x4c9223
cmp eax, 0x359ff605
je 0x4c92ed
cmp eax, 0x5f7b2d27
jne 0x4c9190
push eax
sub esp, 0x7c
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
push eax
mov ecx, esp
mov dword [ecx], 0x80
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, 0xb46f32b9
jmp 0x4c9190
cmp eax, 0xb46f32b9
je 0x4c9239
cmp eax, 0xfea9c43f
je 0x4c92c9
cmp eax, 0x20ced82b
jne 0x4c9190
movzx ecx, byte [esi + 5]
movzx eax, byte [esi + 6]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x5f7b2d27
cmovne eax, edi
test cl, cl
mov ecx, 0x5f7b2d27
cmove eax, ecx
test dl, dl
cmovne eax, edi
jmp 0x4c9190
cmp byte [esi + 7], 0
mov eax, 0xfea9c43f
mov ecx, 0x359ff605
cmovne eax, ecx
jmp 0x4c9190
push eax
mov eax, esp
mov dword [esi + 0x10], eax
push eax
mov eax, esp
mov dword [esi + 0x14], eax
sub esp, 0x80
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0xc], eax
push eax
mov eax, esp
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov eax, dword [esi + 8]
mov dword [eax], 0x80
push dword [esi + 8]
push dword [esi + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
setne byte [esi + 7]
mov eax, dword [0x60b848]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x5f7b2d27
cmove eax, ebx
cmp dword [0x60b84c], 0xa
mov edx, 0x5f7b2d27
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x4c9190
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 8]
push dword [eax]
push dword [ecx]
push dword [edx]
push dword [esi + 0xc]
call fcn.004c8b20
add esp, 0x10
mov eax, 0x359ff605
jmp 0x4c9190
mov eax, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
xor ecx, ebp
call fcn.005ce735
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x541490
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov ebx, ecx
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
lea eax, [esi + 0x30]
mov dword [esi + 0x34], 0x5ce2f0
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea edi, [esi + 0x18]
mov ecx, edi
push dword [ebp + 8]
call fcn.005534d0
lea ecx, [ebx + 0x38]
mov eax, dword [ebx + 8]
mov dword [esi + 4], ebx
sub eax, dword [ebx + 4]
sar eax, 2
mov dword [esi + 0x38], 0
push edi
push 4
push eax
call fcn.00542970
mov byte [esi + 3], al
mov eax, dword [esi + 4]
lea ecx, [eax + 0x20]
lea eax, [esi + 3]
push eax
call fcn.00540350
cmp byte [esi + 3], 0
mov edx, dword [esi + 4]
je 0x54155f
mov eax, dword [edx + 8]
cmp dword [eax - 4], 0
je 0x54155f
mov dword [esi + 0xc], esp
push eax
sub esp, 0xc
mov ecx, esp
lea eax, [edx + 0x68]
mov dword [esi + 8], ecx
push eax
call fcn.00545c90
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 8]
mov dword [esi + 0x38], 1
lea eax, [esi + 0x10]
push dword [ebp + 8]
push eax
call fcn.00553940
mov ecx, dword [esi + 0x10]
add ecx, 0x28
call fcn.0053d9c0
mov esp, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov dword [ecx + 0x30], eax
lea ecx, [esi + 0x18]
call fcn.004668d0
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
mov al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x5d0230
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5d026f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5d026f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5d026f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5d026f
cmp dword [ecx + 0x74], 0xe
jbe 0x5d026f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5e0660
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5e068d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5e068d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5e976a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005e9775
Function at 0x402ddc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
call fcn.00402e5c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp + 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 8], esp
je 0x402e23
push 0x2d
push 0x40aa5b0
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 8], esp
push 0xffffffff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 8], esp
je 0x402e54
push 0x67
push 0x40aa5b0
push 6
call fcn.00441a64
add esp, 0xc
mov esp, ebp
pop ebp
ret 8
Function at 0x406680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x4066ac
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x406791
cmp dword [ebp + 8], 0
je 0x4066f8
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 0x100000
push 2
mov ebx, 0xc8
call fcn.004425f0
add esp, 0x1c
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0040685c
mov dword [ebp - 4], eax
jmp 0x406791
push 0x47b308
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call fcn.00403a88
add esp, 8
cmp eax, 0
je 0x406780
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x18]
call fcn.004068c8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x40673e
mov eax, 0
jmp 0x406856
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 0x100000
push 2
mov ebx, 0xc8
call fcn.004425f0
add esp, 0x1c
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0040685c
mov dword [ebp - 4], eax
jmp 0x406791
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
call fcn.00402ddc
cmp dword [ebp - 4], 0
je 0x406845
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4067cc
push 0x2a0
push 0x40aa3a4
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp + 0x24], 0
jne 0x4067e0
mov dword [ebp + 0x20], 0xffffffff
mov dword [ebp - 0xc], esp
push dword [ebp + 0x20]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40680f
push 0x316
push 0x40aa3a4
push 6
call fcn.00441a64
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x406845
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x406845
push 0x36d
push 0x40aa3a4
push 6
call fcn.00441a64
add esp, 0xc
cmp dword [ebp - 8], 1
mov eax, 0
sete al
jmp 0x406856
mov esp, ebp
pop ebp
ret 0x20
Function at 0x408d9c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
cmp dword [ebp - 4], esp
je 0x408dd3
push 0x12
push 0x409df17
push 6
call fcn.00441a64
add esp, 0xc
jmp 0x408dd8
mov esp, ebp
pop ebp
ret 4

Function at 0x40b48c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [0x5a3bac], 0
jle 0x40b5d6
mov dword [ebp - 8], esp
push dword [0x5a3bac]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b4d8
push 0x6d
push 0x40aa5df
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x40b528
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b514
push 0xb6
push 0x40aa5df
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
jmp 0x40b61f
mov dword [ebp - 8], esp
push 1
push dword [0x5a3bac]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b55c
push 0xe4
push 0x40aa5df
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b58b
push 0x132
push 0x40aa5df
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push dword [0x5a3bac]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b5d1
push 0x15e
push 0x40aa5df
push 6
call fcn.00441a64
add esp, 0xc
jmp 0x40b617
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b605
push 0x1ad
push 0x40aa5df
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40b61f
mov esp, ebp
pop ebp
ret 8

Function at 0x40b834
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
nop
cmp dword [ebp - 4], esp
je 0x40b869
push 0x24
push 0x40aa9e5
push 6
call fcn.00441a64
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x40b87d
mov esp, ebp
pop ebp
ret 4