joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4838e0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x5b0008]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
push 0xa
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], 1
push eax
push dword [ebp + 8]
mov esi, ecx
call fcn.0052cb5a
add esp, 0xc
mov dword [esp + 0x34], 0
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 0
xorps xmm0, xmm0
mov dword [esp + 0x20], 1
movlpd qword [esp + 0x24], xmm0
push eax
lea eax, [esp + 0x1c]
movlpd qword [esp + 0x30], xmm0
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x20], 5
push eax
push 0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x483ad7
mov edi, dword [esp + 0x14]
mov dword [esp + 0xc], eax
test edi, edi
je 0x483aa1
mov edx, dword [sym.imp.WS2_32.dll_socket]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
nop dword [eax]
cmp eax, 0x40
je 0x483a9d
mov eax, dword [edi + 4]
cmp eax, 2
je 0x48399f
cmp eax, 0x17
jne 0x483a8e
jmp 0x483a26
push dword [edi + 0xc]
push dword [edi + 8]
push 2
call edx
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x483a88
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, esi
call fcn.00484410
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00483c00
mov ecx, dword [esi + 8]
test eax, eax
jne 0x4839f4
push ecx
call ebx
mov dword [esi + 8], 0xffffffff
jmp 0x483a88
cmp ecx, 0xffffffff
je 0x4839e5
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x483a16
mov ecx, dword [esi + 8]
push ecx
call ebx
mov dword [esi + 8], 0xffffffff
jmp 0x483a88
cmp dword [edi + 4], 0x17
jne 0x483ac6
mov edx, dword [sym.imp.WS2_32.dll_socket]
push dword [edi + 0xc]
push dword [edi + 8]
push 0x17
call edx
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x483a88
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, esi
call fcn.004844e0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00483c90
mov ecx, dword [esi + 0xc]
test eax, eax
je 0x483a7e
cmp ecx, 0xffffffff
je 0x483a7e
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x483ac6
mov ecx, dword [esi + 0xc]
push ecx
call ebx
mov dword [esi + 0xc], 0xffffffff
mov edx, dword [sym.imp.WS2_32.dll_socket]
mov eax, dword [esp + 0xc]
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x483980
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 0xc], 0
je 0x483ad7
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esp + 0xc]
mov edx, dword [sym.imp.WS2_32.dll_socket]
inc eax
mov dword [esp + 0xc], eax
jmp 0x483a92
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 8
Function at 0x483d30
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0xffffffff
je 0x483f2b
cmp dword [esi + 0xc], 0xffffffff
je 0x483f15
mov ebx, dword [sym.imp.WS2_32.dll_select]
xor eax, eax
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov dword [ebp - 0x108], eax
xor ecx, ecx
test eax, eax
je 0x483d8e
mov edx, dword [esi + 8]
nop dword [eax]
cmp dword [ebp + ecx*4 - 0x104], edx
je 0x483d8e
inc ecx
cmp ecx, eax
jb 0x483d80
cmp ecx, eax
jne 0x483dae
cmp eax, 0x40
jae 0x483dae
mov eax, dword [esi + 8]
mov dword [ebp + ecx*4 - 0x104], eax
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
xor ecx, ecx
test eax, eax
je 0x483dc5
mov edx, dword [esi + 0xc]
cmp dword [ebp + ecx*4 - 0x104], edx
je 0x483dc5
inc ecx
cmp ecx, eax
jb 0x483db7
cmp ecx, eax
jne 0x483dde
cmp eax, 0x40
jae 0x483dde
mov eax, dword [esi + 0xc]
mov dword [ebp + ecx*4 - 0x104], eax
inc dword [ebp - 0x108]
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 2
call ebx
cmp eax, 0xffffffff
je 0x483f35
lea eax, [ebp - 0x108]
push eax
push dword [esi + 8]
call edi
test eax, eax
jne 0x483eab
lea eax, [ebp - 0x108]
push eax
push dword [esi + 0xc]
call edi
test eax, eax
jne 0x483e27
mov eax, dword [ebp - 0x108]
jmp 0x483d70
mov edx, dword [ebp - 0x108]
xor ecx, ecx
test edx, edx
je 0x483e93
mov eax, dword [esi + 0xc]
cmp dword [ebp + ecx*4 - 0x104], eax
je 0x483e5c
inc ecx
cmp ecx, edx
jb 0x483e36
mov ecx, esi
call fcn.00484010
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
lea eax, [edx - 1]
cmp ecx, eax
jae 0x483e8c
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + ecx*4 - 0x100]
mov dword [ebp + ecx*4 - 0x104], eax
inc ecx
mov edx, dword [ebp - 0x108]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x483e70
dec edx
mov dword [ebp - 0x108], edx
mov ecx, esi
call fcn.00484010
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x108]
xor ecx, ecx
test edx, edx
je 0x483f13
mov eax, dword [esi + 8]
nop word [eax + eax]
cmp dword [ebp + ecx*4 - 0x104], eax
je 0x483ee6
inc ecx
cmp ecx, edx
jb 0x483ec0
mov ecx, esi
call fcn.00483f50
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
lea eax, [edx - 1]
cmp ecx, eax
jae 0x483f0c
nop dword [eax]
mov eax, dword [ebp + ecx*4 - 0x100]
mov dword [ebp + ecx*4 - 0x104], eax
inc ecx
mov edx, dword [ebp - 0x108]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x483ef0
dec edx
mov dword [ebp - 0x108], edx
mov ecx, esi
call fcn.00483f50
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xc], 0xffffffff
jne 0x483e95
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00519459
mov esp, ebp
pop ebp
ret
Function at 0x483f50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x483ffa
lea ecx, [ebp - 4]
mov dword [ebp - 4], 4
push ecx
lea ecx, [ebp - 8]
push ecx
push 0x1001
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x8000
push eax
push 0x1001
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
je 0x483ffa
push 0x23a8
call fcn.0051946c
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, eax
call fcn.00483350
mov esi, eax
test esi, esi
je 0x483fea
mov ecx, esi
mov dword [esi + 8], edi
call fcn.00484410
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x484010
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
je 0x4840ba
lea ecx, [ebp - 4]
mov dword [ebp - 4], 4
push ecx
lea ecx, [ebp - 8]
push ecx
push 0x1001
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x8000
push eax
push 0x1001
push 0xffff
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
je 0x4840ba
push 0x23a8
call fcn.0051946c
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, eax
call fcn.00483350
mov esi, eax
test esi, esi
je 0x4840aa
mov ecx, esi
mov dword [esi + 0xc], edi
call fcn.004844e0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4841d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x484225
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x10
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
mov ecx, str._unavailable_
pop esi
cmovne ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xc], 0xffffffff
je 0x4842b5
push 0x41
push 0
push 0x5bb948
mov dword [ebp - 0x34], 0x1c
call fcn.0051b450
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x34]
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
push eax
lea eax, [ebp - 0x30]
movq qword [ebp - 0x20], xmm0
push eax
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
movups xmm0, xmmword [ebp - 0x28]
push 0x41
push 0x5bb948
lea eax, [ebp - 0x14]
push eax
push 0x17
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.WS2_32.dll_inet_ntop]
mov ecx, 0x5bb948
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x484290
sub ecx, edx
mov eax, 0x5bb948
mov ecx, str._unavailable_
cmove eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, str._unavailable_
xor ecx, ebp
pop esi
call fcn.00519459
mov esp, ebp
pop ebp
ret

Function at 0x4842d0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x4842f9
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4842f7
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4842f7
mov eax, dword [eax]
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x484300
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
xorps xmm0, xmm0
mov dword [esp + 0x20], 4
mov edi, ecx
movlpd qword [esp + 0x28], xmm0
push 0
push edi
mov esi, edx
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x48437d
cmp dword [eax + 4], 0x17
jne 0x48437d
push esi
push edi
push 0x17
mov bl, 1
call dword [sym.imp.WS2_32.dll_inet_pton]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0
push edi
movlpd qword [esp + 0x38], xmm0
xor bl, bl
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edx, dword [esp + 0x14]
test eax, eax
jne 0x4843f9
mov ecx, edx
test ecx, ecx
je 0x4843f9
nop
cmp dword [ecx + 4], 0x17
jne 0x4843f2
mov eax, dword [ecx + 0x18]
mov bl, 1
movups xmm0, xmmword [eax + 8]
movups xmmword [esi], xmm0
mov ecx, dword [ecx + 0x1c]
test ecx, ecx
jne 0x4843e0
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4844e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 1
push eax
mov ebx, ecx
or edi, 0xffffffff
push 1
push 6
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
xor ecx, ecx
test eax, eax
push 4
lea eax, [ebp - 0x20]
cmovne edi, ecx
push eax
push 8
push 0xffff
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x484544
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push 0x98000004
push dword [ebx + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0x2710
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 0x3e8
call dword [sym.imp.WS2_32.dll_WSAIoctl]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
pop ebx
call fcn.00519459
mov esp, ebp
pop ebp
ret
Function at 0x4845e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x5de5d0], 2
push esi
mov esi, ecx
jb 0x484639
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x484639
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x484639
or eax, 0xffffffff
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4846a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x5de5d0], 2
push esi
mov esi, ecx
jb 0x4846f9
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4846f9
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4846f9
or eax, 0xffffffff
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x484830
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, eax
mov edx, dword [esi + 0x23a0]
add eax, edx
cmp eax, dword [esi + 0x23a4]
jb 0x4848f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x23a0]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x23a4]
sub eax, ecx
push eax
lea eax, [esi + 0x78]
add eax, ecx
push ebx
push eax
call fcn.0051aed0
mov ecx, dword [ebp + 0x10]
lea edx, [esi + 0x78]
add esp, 8
push dword [esi + 0x23a4]
call fcn.004850d0
add esp, 8
test al, al
je 0x484912
mov ecx, dword [esi + 0x23a4]
xor edx, edx
mov edi, dword [esi + 0x23a0]
mov eax, ecx
sub eax, edi
mov dword [esi + 0x23a0], 0
sub edi, ecx
add ebx, eax
add edi, dword [ebp + 0xc]
cmp edi, ecx
jb 0x4848f0
nop
push ecx
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, ebx
call fcn.004850d0
add esp, 8
test al, al
je 0x484912
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x23a4]
add ebx, ecx
sub edi, ecx
mov dword [esi + 0x10], eax
cmp edi, ecx
jae 0x4848c0
mov edx, dword [esi + 0x23a0]
push edi
lea ecx, [esi + 0x78]
add ecx, edx
push ebx
push ecx
call fcn.0051aed0
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x23a0], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x485030
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [sym.imp.WS2_32.dll_recv]
mov esi, 1
mov eax, dword [ebx + 8]
cmp eax, 0xffffffff
jne 0x485056
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
je 0x4850ae
push 0
push esi
push edi
push eax
call ecx
test eax, eax
jle 0x485067
add edi, eax
sub esi, eax
jmp 0x485076
je 0x4850ae
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x48508a
mov ecx, dword [sym.imp.WS2_32.dll_recv]
test esi, esi
jne 0x485046
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.VSocket::ReadExactHTTP_:_HTTP_socket_error:__d_n
push 4
push 0x5b0d48
call fcn.0041cc90
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push str.VSocket::ReadExactHTTP_:_zero_bytes_read3_n
push 4
push 0x5b0d48
call fcn.0041cc90
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4850d0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x5b0008]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edx
mov ebx, ecx
mov dword [esp + 0x10], 0
cmp dword [ebp + 8], edi
jbe 0x4851c5
mov dword [esp + 0x18], 1
xor esi, esi
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebx
push ecx
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 1
push ecx
lea eax, [ebx + 1]
push 0
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, eax
inc esi
mov al, byte [0x5b31af]
test ecx, ecx
jne 0x48516b
test al, al
jne 0x48516b
cmp esi, 0x258
jl 0x485118
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret
cmp esi, 0x258
jge 0x485154
test al, al
jne 0x485154
test ecx, ecx
js 0x485154
cmp ecx, 1
jg 0x485154
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov esi, dword [ebp + 8]
test eax, eax
je 0x4851ae
push 0
mov eax, esi
sub eax, edi
push eax
mov eax, dword [esp + 0x1c]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov dword [esp + 0x10], eax
jmp 0x4851b2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x485154
cmp eax, 0xffffffff
je 0x485154
add edi, eax
cmp edi, esi
jb 0x485106
mov ecx, dword [esp + 0x12c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret
Function at 0x4a4650
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
mov esi, edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x5c], eax
jne 0x4a4666
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 4
jb 0x4a4710
mov edx, dword [0x5b10dc]
push edi
nop word [eax + eax]
movzx edi, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edi, 8
or edi, eax
lea eax, [ebx - 4]
cmp edi, eax
ja 0x4a470c
movzx ecx, byte [esi + 1]
movzx eax, byte [esi]
shl cx, 8
or cx, ax
mov eax, 0x4453
cmp cx, ax
jne 0x4a46f5
cmp edx, 0xffffffff
jne 0x4a46d5
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4a46cb
mov edx, 1
mov dword [0x5b10dc], edx
jmp 0x4a46d9
xor edx, edx
mov dword [0x5b10dc], edx
jmp 0x4a46f5
test edx, edx
je 0x4a46f5
cmp edi, 5
jb 0x4a46f5
cmp byte [esi + 8], 0
ja 0x4a46f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov ecx, 0xfffffffc
add esi, 4
sub ecx, edi
add esi, edi
add ebx, ecx
cmp ebx, 4
jae 0x4a4680
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a4ca0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0x109d8]
call fcn.0052ce09
add esp, 4
cmp dword [edi + 0x14], 0
jne 0x4a4ea4
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x14]
call fcn.004a4af0
add esp, 8
mov dword [ebp - 0xc], eax
lea esi, [edi + 0x109f0]
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [edi + 0x8d8]
mov ebx, eax
mov ecx, dword [ecx + 0x14]
test cl, 0x5f
je 0x4a4d48
and ecx, 0x7f
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4a4d48
push 1
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push eax
push str._nwarning___d_:_could_not_set_file_attributes_n
push esi
call fcn.004a2840
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
lea esi, [edi + 0x109f0]
mov edx, dword [edi + 0x10918]
test edx, edx
je 0x4a4e09
lea eax, [ebp - 4]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
movzx eax, word [edi + 0x10938]
push eax
call fcn.004a4650
add esp, 0xc
test eax, eax
je 0x4a4e09
push dword [ebp - 4]
mov eax, dword [edi + 0x8d8]
mov edx, esi
push dword [ebp - 8]
mov ecx, edi
push dword [eax + 0x14]
call fcn.004a4420
add esp, 0xc
cmp eax, 0x4f
jne 0x4a4e09
mov edx, dword [edi + 0x38]
lea esi, [edi + 0x8dc]
test edx, edx
je 0x4a4dd6
push 1
lea edx, [edi + 0x88dc]
lea ecx, [edi + 0x109f0]
call fcn.004afcf0
push ecx
push eax
push 0x5a5b4c
push esi
call fcn.004a2840
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
mov edx, dword [edi + 0x38]
push 1
mov ecx, 0x569fe8
test edx, edx
push ecx
mov eax, 0x598520
cmove eax, ecx
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff5
push eax
push str._compressed_WinNT_security_data_missing___d_bytes__s
push esi
call fcn.004a2840
add esp, 0x14
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
cmp ebx, 0xffffffff
jne 0x4a4e3e
push 1
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push eax
push str._nCreateFile___error__d_when_trying_set_file_time_n
push esi
call fcn.004a2840
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4a4e9d
test cl, 1
lea eax, [ebp - 0x14]
mov edx, 0
cmove eax, edx
test cl, 2
push eax
lea eax, [ebp - 0x1c]
cmove eax, edx
test cl, 4
push eax
mov ecx, edx
lea eax, [ebp - 0x24]
cmove eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4a4e9d
push eax
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push eax
push str._nSetFileTime_failed:__d_n
push esi
call fcn.004a2840
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret