joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6750
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x59ee48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x28]
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x28], eax
test esi, esi
mov dword [esp + 0x20], 0
jne 0x4b67a1
xor eax, eax
jmp 0x4b67b5
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b67a6
sub eax, edx
sar eax, 1
mov ebx, eax
push esi
lea eax, [esp + 0x2c]
call fcn.00404050
mov edx, dword [esp + 0x28]
mov eax, dword [edx - 0xc]
test eax, eax
jle 0x4b67f4
lea ecx, [eax - 1]
test ecx, ecx
jl 0x4b6873
cmp ecx, eax
jg 0x4b6873
movzx eax, word [edx + ecx*2]
cmp ax, 0x5c
je 0x4b67f4
push 0x5c
lea edi, [esp + 0x2c]
call fcn.00404400
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ebx, str.SyncCache
call fcn.00412480
add esp, 8
lea edi, [ebp + 8]
mov byte [esp + 0x20], 1
call fcn.004035d0
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b683d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x5c
call fcn.00404400
lea ecx, [esp + 0x14]
push edi
push ecx
mov ebx, str.Cache.ini
call fcn.00412480
add esp, 8
mov byte [esp + 0x20], 2
mov edx, dword [eax]
test edx, edx
jne 0x4b687d
xor eax, eax
jmp 0x4b6891
push 0x80070057
call fcn.00404550
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6882
sub eax, esi
sar eax, 1
mov ebx, eax
push edx
mov eax, ebp
call fcn.00404050
mov eax, dword [ebp + 4]
xor ebx, ebx
cmp eax, ebx
je 0x4b68ae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 4], ebx
mov byte [esp + 0x20], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b68d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b68fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4b7050
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x59dcb9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov eax, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4b7093
sub eax, edi
sar eax, 1
add eax, eax
push eax
push ecx
lea ecx, [esp + 0x1c]
push ecx
call fcn.00401a60
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x30], ebx
mov ecx, 1
mov dword [esp + 0xc], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x30
or eax, ecx
jge 0x4b70ee
mov ecx, 0x30
mov eax, esi
call fcn.00403d50
mov eax, dword [esi]
mov edi, 0x28
push edi
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x4b715f
mov dword [eax - 0xc], edi
mov edx, dword [esi]
mov word [edx + 0x50], bx
mov edx, dword [esi]
cmp edx, ebx
jne 0x4b711c
xor eax, eax
jmp 0x4b7132
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b7121
sub eax, edi
sar eax, 1
js 0x4b715f
cmp eax, dword [edx - 8]
jg 0x4b715f
mov dword [edx - 0xc], eax
mov ecx, dword [esi]
mov word [ecx + eax*2], bx
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005787fd
add esp, 0x28
ret
push 0x80070057
call fcn.00404550
int3
Function at 0x4b7dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0c28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
lea eax, [esp + 0x30]
push eax
mov ecx, str.Files_
call fcn.00404460
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x28], 1
mov ecx, dword [esp + 0x34]
lea esi, [esp + 0x34]
call fcn.004b7050
mov byte [esp + 0x28], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00403fc0
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b7e64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor esi, esi
xor edx, edx
or eax, esi
push eax
or edx, ecx
push edx
push str._I64u
lea edi, [esp + 0x20]
call fcn.004126f0
mov edi, dword [esp + 0x3c]
add esp, 0xc
mov esi, ebp
call fcn.004d0f20
mov eax, dword [ebp]
mov esi, dword [esp + 0x14]
push eax
push esi
push str.LastUpdate
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esi - 0x10]
mov byte [esp + 0x28], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b7eda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b7f02
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x4b8540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a4218
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, ecx
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
xor esi, esi
mov dword [esp + 0x24], esi
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], esi
mov dword [ebp], 9
call fcn.004b8150
cmp eax, esi
jne 0x4b85d8
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b85d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4b869a
mov ebx, dword [esp + 0x28]
xor ecx, ecx
cmp edi, esi
sete cl
add ebx, 8
mov dword [esp + 0x2c], ebx
lea ecx, [ecx + ecx + 1]
mov dword [ebp], ecx
mov eax, dword [esi + 0x5c880c]
mov edx, dword [esp + 0x30]
push eax
push edx
call fcn.00579288
add esp, 8
test eax, eax
je 0x4b8613
add esi, 4
cmp esi, 0x14
jb 0x4b85f1
jmp 0x4b862d
mov ecx, dword [esp + 0x28]
mov eax, edi
neg eax
sbb eax, eax
add eax, 7
add ecx, 0x158
mov dword [ebp], eax
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], ebx
jne 0x4b866e
xor esi, esi
mov eax, dword [esi + 0x5c8820]
mov edx, dword [esp + 0x30]
push eax
push edx
call fcn.00579288
add esp, 8
test eax, eax
je 0x4b8657
add esi, 4
cmp esi, 8
jb 0x4b8635
jmp 0x4b866e
mov eax, dword [esp + 0x28]
neg edi
sbb edi, edi
add edi, 5
add eax, 0x158
mov dword [ebp], edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b8696
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4b86b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5a877b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov eax, 0xa
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.CSyncMgrBase.0
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x18], 2
call fcn.004b7f20
lea ecx, [esi + 0x2f0]
push ecx
mov byte [esp + 0x18], 3
call fcn.004b8800
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esi + 0x304], eax
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esi + 0x308], eax
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esi + 0x30c], eax
mov dword [esi + 0x310], edi
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esi + 0x328], eax
lea eax, [esi + 0x2fc]
mov dword [esi + 0x318], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x314], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x31c], edi
mov dword [esi + 0x320], edi
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x4ba640
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
xor edi, edi
mov dword [eax], edi
cmp dword [ebx + 0x30], edi
je 0x4ba6c1
cmp dword [ebx + 0x2c], 0xffffffff
je 0x4ba6c1
push edi
push str.Shell_TrayWnd
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x4ba685
push edi
mov ecx, eax
lea esi, [esp + 0xc]
call fcn.004ba890
add esp, 4
mov ecx, dword [esp + 0xc]
cmp ecx, edi
mov eax, dword [esp + 0x10]
je 0x4ba698
mov edi, eax
sub edi, ecx
sar edi, 2
xor esi, esi
test edi, edi
jg 0x4ba6d4
mov eax, dword [esp + 0x18]
lea edx, [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [esp + 0x1c]
add edx, 8
test ecx, ecx
mov dword [eax + 4], edx
je 0x4ba6c1
push ecx
call fcn.00578327
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x4ba6e1
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x4ba6ea
call fcn.00578ff3
mov ecx, dword [esp + 0xc]
mov eax, dword [ebx + 0x2c]
lea edx, [esp + 0x18]
push edx
mov edx, dword [ebx + 0x30]
push eax
mov eax, dword [ecx + esi*4]
push edx
push eax
call fcn.004ba8e0
add esp, 0x10
cmp eax, 1
je 0x4ba715
mov ecx, dword [esp + 0xc]
add esi, 1
cmp esi, edi
jl 0x4ba6d0
jmp 0x4ba69e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp + 8]
add ecx, 8
add edx, 8
lea esi, [esp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
call fcn.00495960
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4baac0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push closesocket
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4bab10
call fcn.004129d0
test eax, eax
jl 0x4bab30
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x4bab18
call fcn.004129d0
test eax, eax
jge 0x4bab14
mov edi, eax
jmp 0x4bab23
mov esi, eax
jmp 0x4baaee
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [edi], eax
mov dword [edi + 4], edx
xor edi, edi
test esi, esi
je 0x4bab2e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x4c3fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59ec90
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov esi, ecx
mov dword [esi + 8], 2
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x80
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], bl
lea eax, [esp + 0x18]
mov dword [esp + 0x50], ebx
call fcn.004c1010
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x50], 1
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
push eax
push str.qqpy__u_freq.dat
lea edi, [esp + 0x1c]
call fcn.004126f0
mov edx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
add esp, 8
push edx
push ebp
push edi
push esi
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x50], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c4099
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebp, ebx
je 0x4c40a6
push ebp
call fcn.0057876f
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005787fd
add esp, 0x40
ret
Function at 0x4c6e80
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x59dc60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x1c], ebp
push ebp
push 0x80
push 3
push ebp
push 3
mov byte [esp + 0x40], 1
mov ebx, dword [esp + 0x48]
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
or esi, 0xffffffff
cmp eax, esi
jne 0x4c6ef7
call fcn.004129d0
cmp eax, ebp
jge 0x4c6efd
lea eax, [ebx - 0x10]
mov dword [esp + 0x2c], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jmp 0x4c7013
mov ebp, eax
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x18]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
mov dword [esp + 0x14], edi
jne 0x4c6f20
call fcn.004129d0
test eax, eax
jl 0x4c6f25
mov edi, dword [esp + 0x14]
cmp edi, 0x4c
jae 0x4c6f46
test ebp, ebp
je 0x4c6f30
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x2c], esi
lea edx, [eax + 0xc]
lock xadd dword [edx], esi
dec esi
test esi, esi
jmp 0x4c7013
push edi
call fcn.0057740a
add esp, 4
push edi
mov esi, eax
push 0
push esi
call fcn.00580260
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4c6fb0
call fcn.004129d0
test eax, eax
jge 0x4c6fb6
push esi
call fcn.0057832c
add esp, 4
test ebp, ebp
je 0x4c6f96
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4c7013
cmp dword [esp + 0x14], edi
jne 0x4c6f82
cmp dword [esi], 0x51505545
jne 0x4c6fe7
cmp word [esi + 4], 1
jne 0x4c6fe7
push esi
call fcn.0057832c
add esp, 4
lea esi, [esp + 0x1c]
call fcn.00410620
lea ecx, [esp + 0x34]
call fcn.00404510
mov eax, 1
jmp 0x4c7021
push esi
call fcn.0057832c
add esp, 4
test ebp, ebp
je 0x4c6ffb
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c701f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x4cc780
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x4cc814
cmp word [ebx + 8], 2
push edi
jne 0x4cc7e5
cmp word [ebx + 0xa], 4
jne 0x4cc7e5
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4cc7e5
jmp 0x4cc7c0
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ebp
push eax
push ecx
call fcn.004cc710
test eax, eax
mov dword [esi], eax
je 0x4cc808
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x4cc7c0
mov edx, dword [ebx]
mov eax, dword [esp + 0x20]
push 0x400
push edx
push 0x401
push eax
call fcn.0057d1c8
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4cc824.11001
jmp dword [eax*4 + 0x4cc84c]
pop esi
pop ebp
mov eax, 0x2af9
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afa
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
ret 0x10
Function at 0x4cd070
Capabilities:
Get common file path

Disassembly:
sub esp, 0x238
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x234], eax
cmp dword [0x60368c], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], str.getaddrinfo
mov dword [esp + 0x14], 0x4ccad0
mov dword [esp + 0x18], str.getnameinfo
mov dword [esp + 0x1c], 0x4ccdb0
mov dword [esp + 0x20], str.freeaddrinfo
mov dword [esp + 0x24], fcn.004cca80
je 0x4cd0d5
movzx eax, word [esp + 0x24c]
mov eax, dword [eax*8 + 0x5fc188]
jmp 0x4cd1ee
push 0x104
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4cd1d5
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.0057d163
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.0057d4f9
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4cd14c
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4cd198
push esi
call ebp
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.0057d163
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.0057d4f9
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x4cd1d5
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4cd198
push esi
call ebp
jmp 0x4cd1d5
xor edi, edi
lea ebx, [ebx]
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x4cd193
add edi, 1
cmp edi, 3
jl 0x4cd1a0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x5fc188], edx
mov dword [0x5fc190], eax
mov dword [fcn.004cca80], ecx
movzx edx, word [esp + 0x24c]
mov eax, dword [edx*8 + 0x5fc188]
mov dword [0x60368c], 1
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005787fd
add esp, 0x238
ret 4
Function at 0x4cd700
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x150
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x14c], eax
xor eax, eax
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, 2
xor edi, edi
push 0x104
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4d]
push edi
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 0x11
mov byte [esp + 0x54], 0
call fcn.00580260
add esp, 0xc
push 0x104
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4cd7cd
mov eax, dword [0x603690]
test eax, eax
jne 0x4cd7a9
push eax
call fcn.004cd070
mov dword [0x603690], eax
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x54]
push edx
call eax
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test esi, esi
jne 0x4cd84a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4cd84a
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
nop
mov eax, dword [eax + 0x18]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [eax + 4]
mov eax, dword [eax + 0xc]
push str.127.0.0.1
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
call edi
cmp esi, eax
jne 0x4cd818
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0x1c]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4cd7e0
mov esi, dword [esp + 0x14]
mov eax, dword [0x603694]
test eax, eax
jne 0x4cd82d
push 2
call fcn.004cd070
mov dword [0x603694], eax
mov edx, dword [esp + 0x10]
push edx
call eax
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x154]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret