joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bef0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x14], eax
xor eax, eax
cmp dword [esi + 0x520], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x48bf44
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0048ae90
add esp, 0xc
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ae123
add esp, 0x18
ret
mov edx, dword [esi + 0x524]
push edx
mov dword [esp + 0xc], 1
call fcn.004a2580
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x528]
push eax
call fcn.004a2580
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x48bfbd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0048ae90
add esp, 0x10
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ae123
add esp, 0x18
ret
Function at 0x48c6d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x8c], 2
push edi
mov edi, dword [ebp]
mov dword [esp + 0xc], edi
je 0x48c852
cmp dword [ebp + 0x260], 0
push ebx
push esi
jne 0x48c847
cmp dword [ebp + 0x2d0], 0
jne 0x48c847
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x48c769
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.0048f860
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.0048af30
add esp, 0x18
jmp 0x48c850
push ebx
lea edx, [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x1c], ebx
call fcn.004b28e0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x48c7b6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.0048f860
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.0048af30
add esp, 0x18
jmp 0x48c850
lea edi, [ebp + 0x102]
lea ebx, [ebp + 0x130]
lea esi, [esp + 0x98]
call fcn.0048c660
test eax, eax
jne 0x48c7f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.0048f860
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.0048af30
add esp, 0x18
jmp 0x48c850
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0x102]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x164]
lea edi, [ebp + 0x134]
lea esi, [esp + 0x18]
call fcn.0048c660
test eax, eax
jne 0x48c847
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.0048f860
push eax
mov eax, dword [esp + 0x20]
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.0048af30
add esp, 0x18
jmp 0x48c850
push ebp
call fcn.0048c5e0
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.004ae123
add esp, 0x10c
ret

Function at 0x48c870
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x48c8b9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0048f860
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0048ae90
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0048ae90
add esp, 8
pop edi
pop esi
ret
Function at 0x48d570
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ebp
xor ebp, ebp
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax], ebp
mov eax, dword [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 8], eax
cmp eax, ebp
jne 0x48d721
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebp
je 0x48d6ff
push ebx
push esi
lea esp, [esp]
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x48d5cd
lea ebx, [eax + 0xe]
jmp 0x48d5d9
cmp eax, 0x17
jne 0x48d678
lea ebx, [eax + 5]
cmp dword [edi + 0x18], ebp
je 0x48d678
mov eax, dword [edi + 0x10]
cmp eax, ebp
jbe 0x48d678
cmp eax, ebx
jb 0x48d678
push 0x20
call dword [0x517170]
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x48d685
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [0x517170]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebp
je 0x48d68f
mov ecx, dword [edi + 0x18]
push ebx
push ecx
push eax
call fcn.004b4b70
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp eax, ebp
je 0x48d65f
push eax
call dword [0x51717c]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebp
je 0x48d6a3
cmp dword [esp + 0x10], ebp
jne 0x48d669
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x48d674
mov dword [eax + 0x1c], esi
mov dword [esp + 0x18], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebp
jne 0x48d5c0
jmp 0x48d6bf
mov dword [esp + 0x14], 8
jmp 0x48d6bf
push esi
mov dword [esp + 0x18], 8
call dword [0x517174]
add esp, 4
jmp 0x48d6bf
mov edx, dword [esi + 0x18]
push edx
mov dword [esp + 0x18], 8
call dword [0x517174]
push esi
call dword [0x517174]
add esp, 8
mov eax, dword [esp + 0x1c]
pop esi
pop ebx
cmp eax, ebp
je 0x48d6d0
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 0xc], ebp
je 0x48d6f9
mov eax, dword [esp + 8]
push eax
call fcn.0048d530
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
add esp, 4
mov ecx, ebp
pop edi
mov dword [esp + 4], ebp
mov dword [edx], ecx
pop ebp
add esp, 0x10
ret
cmp dword [esp + 8], ebp
jne 0x48d712
push 0x2af9
mov dword [esp + 0x10], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov dword [edx], ecx
pop edi
pop ebp
add esp, 0x10
ret

Function at 0x48ee30
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.004b64ab
add esp, 0x18
test eax, eax
je 0x48ee53
cmp eax, 0xffffffff
jne 0x48ee55
xor eax, eax
ret
Function at 0x496f30
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x5046d4
push ecx
call fcn.0048ae90
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.00496090
test eax, eax
jne 0x496f60
mov eax, esi
jmp fcn.004964c0
ret
Function at 0x497380
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
push esi
mov esi, dword [ebp + 0x4b8]
push edi
mov edi, dword [ebp]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x497409
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.004b4b70
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov ecx, dword [esi + 0x14c]
cmp ecx, 4
jge 0x497444
push str.Received_too_short_packet
push edi
call fcn.0048af30
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ae123
add esp, 0x88
ret
mov edx, dword [esi + 0x15c]
movzx eax, byte [edx]
movzx edx, byte [edx + 1]
shl ax, 8
movzx eax, ax
or eax, edx
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x497469
jmp dword [eax*4 + 0x497580]
cmp ecx, 4
jle case.0x497469.4
mov eax, dword [esi + 0x15c]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl dx, 8
movzx edx, dx
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
jne case.0x497469.4
add ecx, 0xfffffffc
push ecx
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
push 1
push ebp
call fcn.0048b4b0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4974d4
mov ecx, 5
mov eax, esi
call fcn.00497300
mov eax, ebx
jmp 0x49742b
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x70], eax
mov eax, dword [edi + 0x70]
adc dword [edi + 0x74], edx
mov edx, dword [edi + 0x74]
push edx
push eax
push edi
call fcn.004a47e0
jmp 0x497555
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl cx, 8
movzx edx, cx
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
or edx, eax
push 0x5046d4
push edi
mov dword [esi + 8], edx
call fcn.0048ae90
jmp 0x497555
mov edx, dword [esi + 0x15c]
add ecx, 0xfffffffe
push ecx
add edx, 2
push edx
push esi
call fcn.00496200
add esp, 0xc
test eax, eax
je case.0x497469.4
jmp 0x49742b
push str.Internal_error:_Unexpected_packet
push 0x502128
push edi
call fcn.0048af30
add esp, 0xc
push ebp
call fcn.004a49a0
add esp, 4
test eax, eax
je 0x497429
mov ecx, 5
mov eax, esi
call fcn.00497300
mov eax, 0x2a
jmp 0x49742b
Function at 0x498f20
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x498f55
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.0048af30
add esp, 0xc
jmp 0x498f8e
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp]
cmp al, 2
jne 0x498f80
shr eax, 8
test al, al
jne 0x498f80
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ae123
add esp, 0x194
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.0048af30
add esp, 8
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.004ae123
add esp, 0x194
ret

Function at 0x499120
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x190]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x499164
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0048af30
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.00499020
add esp, 4
pop esi
pop ecx
ret
Function at 0x499950
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x90c
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x908], eax
push ebx
push ebp
push esi
push edi
push 0x7f
lea eax, [esp + 0x9d]
mov ebx, ecx
push 0
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0xa4], 0
call fcn.004b28e0
push 0x7f
lea ecx, [esp + 0x29]
push 0
push ecx
mov byte [esp + 0x30], 0
call fcn.004b28e0
mov ebp, dword [ebx]
mov edi, dword [ebp + 0x128]
mov edx, dword [edi + 0x1eb4]
sub edx, dword [edi + 0x1eb0]
lea eax, [edi + 0x1cb0]
add edx, 2
push edx
push 0x3c
mov esi, ebp
mov dword [esp + 0x30], ebp
call fcn.00499370
mov eax, dword [edi + 0x1eb0]
movzx ecx, byte [eax]
inc eax
add esp, 0x20
mov dword [edi + 0x1eb0], eax
cmp ecx, 0x18
je 0x499b38
cmp ecx, 0x23
je 0x499b12
cmp ecx, 0x27
jne 0x499bca
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [esp + 0x12c]
push 0x800
push eax
call fcn.0048e260
mov esi, dword [edi + 0x1cac]
add esp, 0x1c
mov ebp, 4
test esi, esi
je 0x499aa6
lea esp, [esp]
mov ebx, dword [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x499a37
sub eax, edx
lea edi, [eax + ebp + 1]
cmp edi, 0x7fa
jae 0x499a9b
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x9c]
push edx
push str._127_____127s
push ebx
call fcn.004b23d9
add esp, 0x10
test eax, eax
je 0x499a9b
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0xa0]
push ecx
push 0
mov edx, 0x800
push str._c_s_c_s
sub edx, ebp
push edx
lea eax, [esp + ebp + 0x130]
push eax
call fcn.0048e260
add esp, 0x1c
mov ebp, edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x499a30
mov ebx, dword [esp + 0x14]
push 0xf0
push 0xff
mov ecx, 0x800
push 0x4e833c
sub ecx, ebp
push ecx
lea edx, [esp + ebp + 0x128]
push edx
call fcn.0048e260
mov ecx, dword [ebx + 0x190]
add esp, 0x14
push 0
add ebp, 2
push ebp
lea eax, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x499b05
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push edx
call fcn.0048af30
add esp, 0xc
mov esi, dword [esp + 0x10]
add ebp, 0xfffffffe
push ebp
jmp 0x499bb9
lea ecx, [edi + 0x1c28]
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x499b20
push 0xf0
push 0xff
push ecx
push 0
push 0x23
jmp 0x499b59
lea ecx, [edi + 0x1c08]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x499b43
push 0xf0
push 0xff
push ecx
push 0
push 0x18
push 0xfa
push 0xff
sub eax, esi
push str._c_c_c_c_s_c_c
lea edi, [eax + 6]
lea eax, [esp + 0x138]
push 0x800
push eax
call fcn.0048e260
mov edx, dword [ebx + 0x190]
add esp, 0x28
push 0
push edi
lea ecx, [esp + 0x120]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x499bb3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebp
call fcn.0048af30
add esp, 0xc
add edi, 0xfffffffe
mov esi, ebp
push edi
push 0x3e
lea eax, [esp + 0x122]
call fcn.00499370
add esp, 8
mov ecx, dword [esp + 0x918]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ae123
add esp, 0x90c
ret
Function at 0x499e00
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [esp + 4], eax
jne 0x499f67
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
mov dword [ebp], edi
cmp edi, ebp
jae 0x499e39
mov byte [edi], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499e46
mov byte [eax], 0xfa
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499e53
mov byte [eax], 0x1f
inc dword [ebp]
movzx ecx, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499e87
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499e97
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499ea3
mov byte [eax], cl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499eaf
mov byte [eax], ch
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499ebc
mov byte [eax], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x499ec9
mov byte [eax], 0xf0
inc dword [ebp]
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, edi
sub eax, 2
push eax
lea eax, [ebx + 0x1cb2]
push 0x3e
mov dword [ebp], edi
call fcn.00499370
mov ebp, dword [sym.imp.WS2_32.dll_send]
add esp, 8
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov edx, dword [edi + 0x190]
push edx
call ebp
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x499f26
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.0048af30
add esp, 0xc
lea ecx, [ebx + 0x1cb3]
push 4
push ecx
call fcn.00499bf0
mov edx, dword [edi + 0x190]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push edx
call ebp
test eax, eax
jns 0x499f64
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.0048af30
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x49ab90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 0x194]
mov ebp, dword [esi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
or edi, 0xffffffff
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x49abed
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.0048c970
add esp, 8
cmp edi, 0xffffffff
jne 0x49ac11
push str.Error_accept__ing_server_connect
push ebp
call fcn.0048af30
add esp, 8
mov eax, 0x1e
jmp 0x49ac6c
push str.Connection_accepted_from_server_n
push ebp
call fcn.0048ae90
push 1
push edi
mov dword [esi + 0x288], 0
mov dword [esi + 0x194], edi
call fcn.004a69c0
mov dword [esi + 0x1a4], 1
mov eax, dword [ebp + 0x1b0]
add esp, 0x10
test eax, eax
je 0x49ac6a
mov ecx, dword [ebp + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x49ac6a
call fcn.0049aaf0
mov eax, 0x2a
jmp 0x49ac6c
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ae123
add esp, 0x88
ret
Function at 0x49e670
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x49e6a6
push str.Couldnt_set_desired_mode
push ebx
call fcn.0048af30
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x49e6bd
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0048ae90
add esp, 0xc
cmp ebp, 0x13
jne 0x49e6d1
push edi
call fcn.0049e5f0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x49e6e5
push edi
call fcn.0049b750
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x49e6fd
push 0xd
push 1
push edi
call fcn.0049d980
add esp, 0xc
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x49e711
push 0xe
push 1
push edi
call fcn.0049d980
add esp, 0xc
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4a6870
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
push esi
push 0x4eae28
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4a688a
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0x4eae14
push ebx
mov dword [esp + 0x18], edi
call fcn.004b2820
add esp, 8
test eax, eax
je 0x4a68d6
test edi, edi
je 0x4a68c7
push 8
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
test edi, edi
je 0x4a68fc
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a68fc
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x4a69b0
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a6915
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x517170]
mov esi, eax
add esp, 4
test esi, esi
je 0x4a69a6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4a69a6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a6943
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a6960
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4a6970
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4a699d
push 8
push 0
push esi
call eax
push esi
mov ebp, eax
call dword [0x517174]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push esi
call dword [0x517174]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret

Function at 0x4a69f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x2c]
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0x1ec]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x4a6a0d
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0048a930
push edx
push eax
call fcn.0048a960
mov ecx, eax
mov eax, esi
mov dword [esp + 0x24], edx
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov esi, edx
sbb esi, dword [esp + 0x14]
cmp dword [ebx + 0x1e0], 0
je 0x4a6a76
mov edx, dword [ebp + 0x184]
mov eax, dword [ebp + 0x180]
push edx
push eax
call fcn.0048a930
push edx
push eax
call fcn.0048a960
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov ebp, edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, ebp
cmp esi, edx
jl 0x4a6a76
jg 0x4a6a7a
cmp edi, eax
jae 0x4a6a7a
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4a7b10
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x4a7b42
push 0x2e
push esi
call fcn.004b0a10
add esp, 8
test eax, eax
je 0x4a7b40
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x4a7ca0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x30]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4a7d47
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea esi, [esp + 0x20]
mov eax, ebp
mov word [esp + 0x14], 0x208
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.004a7c10
mov ecx, esi
push 8
push ecx
call fcn.004ac530
mov ecx, dword [esp + 0x10]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x4a7d59
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ae123
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.004ae123
add esp, 0x24
ret