joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466130
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [ebp]
mov dword [esp + 0x14], edi
mov al, byte [edi]
cmp al, 0x2f
jne 0x4661b2
cmp byte [edi + 1], al
jne 0x46618c
mov esi, dword [esp + 0x10]
lea eax, [edi + 2]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00465e90
add esp, 8
test eax, eax
jne 0x466351
cmp dword [esi + 0xc], eax
jne 0x466176
mov dword [esi + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00466570
add esp, 8
test eax, eax
je 0x4661a5
pop edi
pop esi
pop ebp
ret
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call fcn.00466610
add esp, 8
test eax, eax
jne 0x466351
mov edi, dword [esp + 0x14]
xor eax, eax
mov dword [ebp], edi
pop edi
pop esi
pop ebp
ret
cmp al, 0x61
jl 0x4661be
cmp al, 0x7a
jle 0x46629d
cmp al, 0x41
jl 0x4661ca
cmp al, 0x5a
jle 0x46629d
cmp al, 0x30
jl 0x4661d6
cmp al, 0x39
jle 0x46629d
cmp al, 0x2d
je 0x46629d
cmp al, 0x2e
je 0x46629d
cmp al, 0x5f
je 0x46629d
cmp al, 0x7e
je 0x46629d
cmp al, 0x25
jne 0x46623c
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x466207
cmp cl, 0x39
jle 0x46621b
cmp cl, 0x61
jl 0x466211
cmp cl, 0x66
jle 0x46621b
cmp cl, 0x41
jl 0x46623c
cmp cl, 0x46
jg 0x46623c
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x466228
cmp cl, 0x39
jle 0x46629d
cmp cl, 0x61
jl 0x466232
cmp cl, 0x66
jle 0x46629d
cmp cl, 0x41
jl 0x46623c
cmp cl, 0x46
jle 0x46629d
cmp al, 0x21
je 0x46629d
cmp al, 0x24
je 0x46629d
cmp al, 0x26
je 0x46629d
cmp al, 0x28
je 0x46629d
cmp al, 0x29
je 0x46629d
cmp al, 0x2a
je 0x46629d
cmp al, 0x2b
je 0x46629d
cmp al, 0x2c
je 0x46629d
cmp al, 0x3b
je 0x46629d
cmp al, 0x3d
je 0x46629d
cmp al, 0x27
je 0x46629d
cmp al, 0x3a
je 0x46629d
cmp al, 0x40
je 0x46629d
mov esi, dword [esp + 0x10]
test esi, esi
je 0x46634c
mov eax, dword [esi + 0x18]
test eax, eax
je 0x46628d
push eax
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
mov dword [esi + 0x18], 0
xor eax, eax
mov dword [ebp], edi
pop edi
pop esi
pop ebp
ret
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
push 0
push eax
call fcn.00466ab0
add esp, 0xc
test eax, eax
jne 0x466351
mov esi, dword [esp + 0x14]
cmp byte [esi], 0x2f
jne 0x4662e6
push 1
lea eax, [esp + 0x18]
inc esi
push 0
push eax
mov dword [esp + 0x20], esi
call fcn.00466ab0
add esp, 0xc
test eax, eax
jne 0x466351
mov esi, dword [esp + 0x14]
cmp byte [esi], 0x2f
je 0x4662c3
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x466349
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x466300
push eax
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
cmp esi, edi
je 0x466342
mov eax, esi
sub eax, edi
test byte [ebx + 0x24], 2
je 0x466327
push eax
push edi
call sym.KomManager.exe_xmlStrndup
add esp, 8
mov dword [ebx + 0x18], eax
mov edi, esi
xor eax, eax
mov dword [ebp], edi
pop ebx
pop edi
pop esi
pop ebp
ret
push 0
push eax
push edi
call sym.KomManager.exe_xmlURIUnescapeString
add esp, 0xc
mov dword [ebx + 0x18], eax
mov edi, esi
xor eax, eax
mov dword [ebp], edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov dword [ebx + 0x18], 0
mov edi, esi
pop ebx
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x466360
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [ebp]
mov ebx, esi
mov dword [esp + 0x14], esi
mov al, byte [esi]
cmp al, 0x5b
jne 0x46640e
mov al, byte [esi + 1]
inc esi
mov edx, esi
cmp al, 0x5d
je 0x46639a
mov ecx, esi
mov edx, ecx
test al, al
je 0x466400
mov al, byte [ecx + 1]
lea esi, [ecx + 1]
mov ecx, esi
mov edx, esi
cmp al, 0x5d
jne 0x466386
lea esi, [edx + 1]
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x466565
mov eax, dword [edi + 8]
test eax, eax
je 0x4663bb
push eax
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
mov eax, dword [edi + 0xc]
mov dword [edi + 8], 0
test eax, eax
je 0x4663d3
push eax
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
cmp esi, ebx
je 0x46655e
mov eax, esi
sub eax, ebx
test byte [edi + 0x24], 2
je 0x466545
push eax
push ebx
call sym.KomManager.exe_xmlStrndup
add esp, 8
mov dword [edi + 0xc], eax
mov dword [ebp], esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp byte [esi], 0x5d
je 0x46639a
pop esi
pop ebp
mov eax, 1
pop ebx
ret
cmp al, 0x30
jl 0x466483
cmp al, 0x39
jg 0x466483
lea eax, [esp + 0x14]
push eax
call fcn.00465f30
add esp, 4
test eax, eax
jne 0x466483
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x2e
jne 0x466483
inc eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.00465f30
add esp, 4
test eax, eax
jne 0x466483
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x2e
jne 0x466483
lea eax, [esp + 0x14]
push eax
call fcn.00465f30
add esp, 4
test eax, eax
jne 0x466483
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x2e
jne 0x466483
lea eax, [esp + 0x14]
push eax
call fcn.00465f30
add esp, 4
test eax, eax
jne 0x466483
mov esi, dword [esp + 0x14]
jmp 0x46639d
mov al, byte [esi]
cmp al, 0x61
jl 0x466491
cmp al, 0x7a
jle 0x466533
cmp al, 0x41
jl 0x46649d
cmp al, 0x5a
jle 0x466533
cmp al, 0x30
jl 0x4664a9
cmp al, 0x39
jle 0x466533
cmp al, 0x2d
je 0x466533
cmp al, 0x2e
je 0x466533
cmp al, 0x5f
je 0x466533
cmp al, 0x7e
je 0x466533
cmp al, 0x25
jne 0x466503
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x4664ce
cmp cl, 0x39
jle 0x4664e2
cmp cl, 0x61
jl 0x4664d8
cmp cl, 0x66
jle 0x4664e2
cmp cl, 0x41
jl 0x466503
cmp cl, 0x46
jg 0x466503
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x4664ef
cmp cl, 0x39
jle 0x466533
cmp cl, 0x61
jl 0x4664f9
cmp cl, 0x66
jle 0x466533
cmp cl, 0x41
jl 0x466503
cmp cl, 0x46
jle 0x466533
cmp al, 0x21
je 0x466533
cmp al, 0x24
je 0x466533
cmp al, 0x26
je 0x466533
cmp al, 0x28
je 0x466533
cmp al, 0x29
je 0x466533
cmp al, 0x2a
je 0x466533
cmp al, 0x2b
je 0x466533
cmp al, 0x2c
je 0x466533
cmp al, 0x3b
je 0x466533
cmp al, 0x3d
je 0x466533
cmp al, 0x27
jne 0x46639d
cmp al, 0x25
jne 0x46653f
add esi, 3
jmp 0x466483
inc esi
jmp 0x466483
push 0
push eax
push ebx
call sym.KomManager.exe_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0xc], eax
mov dword [ebp], esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [edi + 0xc], 0
pop edi
mov dword [ebp], esi
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4666d0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x4666de
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x10]
mov al, byte [esi]
cmp al, 0x61
jl 0x4666f4
cmp al, 0x7a
jle 0x4667e0
cmp al, 0x41
jl 0x466700
cmp al, 0x5a
jle 0x4667e0
cmp al, 0x30
jl 0x46670c
cmp al, 0x39
jle 0x4667e0
cmp al, 0x2d
je 0x4667e0
cmp al, 0x2e
je 0x4667e0
cmp al, 0x5f
je 0x4667e0
cmp al, 0x7e
je 0x4667e0
cmp al, 0x25
jne 0x466776
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x46673d
cmp cl, 0x39
jle 0x46674f
cmp cl, 0x61
jl 0x466747
cmp cl, 0x66
jle 0x46674f
sub cl, 0x41
cmp cl, 5
ja 0x4667b2
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x466760
cmp cl, 0x39
jle 0x4667e0
cmp cl, 0x61
jl 0x46676a
cmp cl, 0x66
jle 0x4667e0
cmp cl, 0x41
jl 0x4667b2
cmp cl, 0x46
jle 0x4667e0
jmp 0x4667b2
cmp al, 0x21
je 0x4667e0
cmp al, 0x24
je 0x4667e0
cmp al, 0x26
je 0x4667e0
cmp al, 0x28
je 0x4667e0
cmp al, 0x29
je 0x4667e0
cmp al, 0x2a
je 0x4667e0
cmp al, 0x2b
je 0x4667e0
cmp al, 0x2c
je 0x4667e0
cmp al, 0x3b
je 0x4667e0
cmp al, 0x3d
je 0x4667e0
cmp al, 0x27
je 0x4667e0
cmp al, 0x3a
je 0x4667e0
cmp al, 0x40
je 0x4667e0
cmp al, 0x2f
je 0x4667e0
cmp al, 0x3f
je 0x4667e0
test edi, edi
je 0x466853
test byte [edi + 0x24], 1
je 0x4667f7
cmp al, 0x7b
je 0x4667e0
cmp al, 0x7d
je 0x4667e0
cmp al, 0x7c
je 0x4667e0
cmp al, 0x5c
je 0x4667e0
cmp al, 0x5e
je 0x4667e0
cmp al, 0x5b
je 0x4667e0
cmp al, 0x5d
je 0x4667e0
cmp al, 0x60
jne 0x4667f7
xor ecx, ecx
cmp al, 0x25
sete cl
lea esi, [esi + ecx*2]
inc esi
lea ecx, [ecx*2 + 1]
jmp 0x4666e6
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x466808
push eax
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x466820
push eax
push ecx
call sym.KomManager.exe_xmlStrndup
add esp, 8
jmp 0x46682c
push 0
push eax
push ecx
call sym.KomManager.exe_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x466840
push eax
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
push eax
push ecx
call sym.KomManager.exe_xmlStrndup
add esp, 8
mov dword [edi + 0x28], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x466ab0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x466ac1
cmp al, 0x7a
jle 0x466b29
cmp al, 0x41
jl 0x466ac9
cmp al, 0x5a
jle 0x466b29
cmp al, 0x30
jl 0x466ad1
cmp al, 0x39
jle 0x466b29
cmp al, 0x2d
je 0x466b29
cmp al, 0x2e
je 0x466b29
cmp al, 0x5f
je 0x466b29
cmp al, 0x7e
je 0x466b29
cmp al, 0x25
jne 0x466bd1
mov al, byte [edx + 1]
cmp al, 0x30
jl 0x466af4
cmp al, 0x39
jle 0x466b06
cmp al, 0x61
jl 0x466afc
cmp al, 0x66
jle 0x466b06
sub al, 0x41
cmp al, 5
ja 0x466c39
mov al, byte [edx + 2]
cmp al, 0x30
jl 0x466b11
cmp al, 0x39
jle 0x466b29
cmp al, 0x61
jl 0x466b19
cmp al, 0x66
jle 0x466b29
cmp al, 0x41
jl 0x466c39
cmp al, 0x46
jg 0x466c39
push ebx
mov bl, byte [esp + 0x10]
nop
mov al, byte [edx]
cmp al, 0x61
jl 0x466b3e
cmp al, 0x7a
jle 0x466c7c
cmp al, 0x41
jl 0x466b4a
cmp al, 0x5a
jle 0x466c7c
cmp al, 0x30
jl 0x466b56
cmp al, 0x39
jle 0x466c7c
cmp al, 0x2d
je 0x466c7c
cmp al, 0x2e
je 0x466c7c
cmp al, 0x5f
je 0x466c7c
cmp al, 0x7e
je 0x466c7c
cmp al, 0x25
jne 0x466c44
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x466b8b
cmp cl, 0x39
jle 0x466b9d
cmp cl, 0x61
jl 0x466b95
cmp cl, 0x66
jle 0x466b9d
sub cl, 0x41
cmp cl, 5
ja 0x466bca
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x466bae
cmp cl, 0x39
jle 0x466c7c
cmp cl, 0x61
jl 0x466bbc
cmp cl, 0x66
jle 0x466c7c
cmp cl, 0x41
jl 0x466bca
cmp cl, 0x46
jle 0x466c7c
pop ebx
mov dword [esi], edx
xor eax, eax
pop esi
ret
cmp al, 0x21
je 0x466b29
cmp al, 0x24
je 0x466b29
cmp al, 0x26
je 0x466b29
cmp al, 0x28
je 0x466b29
cmp al, 0x29
je 0x466b29
cmp al, 0x2a
je 0x466b29
cmp al, 0x2b
je 0x466b29
cmp al, 0x2c
je 0x466b29
cmp al, 0x3b
je 0x466b29
cmp al, 0x3d
je 0x466b29
cmp al, 0x27
je 0x466b29
cmp al, 0x3a
je 0x466b29
cmp al, 0x40
je 0x466b29
xor eax, eax
cmp dword [esp + 0x10], eax
pop esi
sete al
ret
cmp al, 0x21
je 0x466c7c
cmp al, 0x24
je 0x466c7c
cmp al, 0x26
je 0x466c7c
cmp al, 0x28
je 0x466c7c
cmp al, 0x29
je 0x466c7c
cmp al, 0x2a
je 0x466c7c
cmp al, 0x2b
je 0x466c7c
cmp al, 0x2c
je 0x466c7c
cmp al, 0x3b
je 0x466c7c
cmp al, 0x3d
je 0x466c7c
cmp al, 0x27
je 0x466c7c
cmp al, 0x3a
je 0x466c7c
cmp al, 0x40
jne 0x466bca
cmp al, bl
je 0x466bca
xor ecx, ecx
cmp al, 0x25
sete cl
lea edx, [edx + ecx*2]
inc edx
lea ecx, [ecx*2 + 1]
jmp 0x466b30
Function at 0x466dd0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x466de6
cmp al, 0x7a
jle 0x466e96
cmp al, 0x41
jl 0x466df2
cmp al, 0x5a
jle 0x466e96
cmp al, 0x30
jl 0x466dfe
cmp al, 0x39
jle 0x466e96
cmp al, 0x2d
je 0x466e96
cmp al, 0x2e
je 0x466e96
cmp al, 0x5f
je 0x466e96
cmp al, 0x7e
je 0x466e96
cmp al, 0x25
jne 0x466e66
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x466e2b
cmp cl, 0x39
jle 0x466e3d
cmp cl, 0x61
jl 0x466e35
cmp cl, 0x66
jle 0x466e3d
sub cl, 0x41
cmp cl, 5
ja 0x466e5e
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x466e4a
cmp cl, 0x39
jle 0x466e96
cmp cl, 0x61
jl 0x466e54
cmp cl, 0x66
jle 0x466e96
cmp cl, 0x41
jl 0x466e5e
cmp cl, 0x46
jle 0x466e96
pop esi
mov eax, 1
pop ebx
ret
cmp al, 0x21
je 0x466e96
cmp al, 0x24
je 0x466e96
cmp al, 0x26
je 0x466e96
cmp al, 0x28
je 0x466e96
cmp al, 0x29
je 0x466e96
cmp al, 0x2a
je 0x466e96
cmp al, 0x2b
je 0x466e96
cmp al, 0x2c
je 0x466e96
cmp al, 0x3b
je 0x466e96
cmp al, 0x3d
je 0x466e96
cmp al, 0x27
je 0x466e96
cmp al, 0x3a
jne 0x466ead
xor ecx, ecx
cmp al, 0x25
sete cl
lea esi, [esi + ecx*2]
inc esi
lea ecx, [ecx*2 + 1]
jmp 0x466dd8
cmp al, 0x40
jne 0x466e5e
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x466efb
mov eax, dword [edi + 0x10]
test eax, eax
je 0x466ecb
push eax
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x466eec
push eax
push ecx
call sym.KomManager.exe_xmlStrndup
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push eax
push ecx
call sym.KomManager.exe_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
ret

Function at 0x474180
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4741c4
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4741c4
push esi
push eax
push dword [esp + 0x14]
push 1
push ecx
call fcn.006449b7
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x4741c0
push str.fread__
push dword [0x6f6440]
push 0
push 0
push 8
call sym.KomManager.exe___xmlSimpleError
add esp, 0x14
mov eax, esi
pop esi
ret
or eax, 0xffffffff
ret

Function at 0x474340
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x47435d
mov ecx, dword [esp + 0xc]
test ecx, ecx
js 0x47435d
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
jmp sym.KomManager.exe_xmlNanoHTTPRead
or eax, 0xffffffff
ret

Function at 0x4743b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x4743cd
mov ecx, dword [esp + 0xc]
test ecx, ecx
js 0x4743cd
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
jmp sym.KomManager.exe_xmlNanoFTPRead
or eax, 0xffffffff
ret
Function at 0x47de00
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x7d4
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x7d0], eax
push esi
push edi
mov edi, dword [esp + 0x7e0]
xor esi, esi
push 0xd
push str.urn:publicid:
push edi
call sym.KomManager.exe_xmlStrncmp
add esp, 0xc
test eax, eax
je 0x47de4c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x7d0]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x7d4
ret
mov cl, byte [edi + 0xd]
add edi, 0xd
test cl, cl
je 0x47dfa4
nop word [eax + eax]
cmp esi, 0x7cc
ja 0x47df9c
cmp cl, 0x2b
jne 0x47de7b
mov byte [esp + esi + 8], 0x20
jmp 0x47df8a
cmp cl, 0x3a
jne 0x47de91
mov word [esp + esi + 8], 0x2f2f
mov eax, 2
jmp 0x47df8f
cmp cl, 0x3b
jne 0x47dea7
mov word [esp + esi + 8], 0x3a3a
mov eax, 2
jmp 0x47df8f
cmp cl, 0x25
jne 0x47df86
mov al, byte [edi + 1]
cmp al, 0x32
jne 0x47decf
cmp byte [edi + 2], 0x42
jne 0x47deef
mov byte [esp + esi + 8], 0x2b
add edi, 3
mov eax, 1
jmp 0x47df90
cmp al, 0x33
jne 0x47deeb
cmp byte [edi + 2], 0x41
jne 0x47df0b
mov byte [esp + esi + 8], 0x3a
add edi, 3
mov eax, 1
jmp 0x47df90
cmp al, 0x32
jne 0x47df07
cmp byte [edi + 2], 0x46
jne 0x47df24
mov byte [esp + esi + 8], 0x2f
add edi, 3
mov eax, 1
jmp 0x47df90
cmp al, 0x33
jne 0x47df20
cmp byte [edi + 2], 0x42
jne 0x47df3d
mov byte [esp + esi + 8], 0x3b
add edi, 3
mov eax, 1
jmp 0x47df90
cmp al, 0x32
jne 0x47df39
cmp byte [edi + 2], 0x37
jne 0x47df56
mov byte [esp + esi + 8], 0x27
add edi, 3
mov eax, 1
jmp 0x47df90
cmp al, 0x33
jne 0x47df52
cmp byte [edi + 2], 0x46
jne 0x47df7f
mov byte [esp + esi + 8], 0x3f
add edi, 3
mov eax, 1
jmp 0x47df90
cmp al, 0x32
jne 0x47df7f
mov al, byte [edi + 2]
cmp al, 0x33
jne 0x47df6c
mov byte [esp + esi + 8], 0x23
add edi, 3
mov eax, 1
jmp 0x47df90
cmp al, 0x35
jne 0x47df7f
mov byte [esp + esi + 8], 0x25
add edi, 3
mov eax, 1
jmp 0x47df90
mov byte [esp + esi + 8], 0x25
jmp 0x47df8a
mov byte [esp + esi + 8], cl
mov eax, 1
inc edi
mov cl, byte [edi]
add esi, eax
test cl, cl
jne 0x47de60
cmp esi, 0x7d0
jae 0x47dfcd
lea eax, [esp + 8]
mov byte [esp + esi + 8], 0
push eax
call sym.KomManager.exe_xmlStrdup
mov ecx, dword [esp + 0x7dc]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0x7d4
ret
call fcn.0062fd7e
int3
Function at 0x47ee50
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
je 0x47ef1a
push 0x67945c
push eax
call fcn.0063af62
mov esi, eax
add esp, 8
test esi, esi
je 0x47ef1a
push ebx
push 2
push 0
push esi
call fcn.00643324
add esp, 0xc
test eax, eax
jne 0x47ef0c
push esi
call fcn.00643044
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x47ef0c
push 0
push 0
push esi
call fcn.00643324
add esp, 0xc
test eax, eax
jne 0x47ef0c
lea eax, [ebx + 0xa]
push edi
push eax
call dword [sym.KomManager.exe_xmlMallocAtomic]
mov edi, eax
add esp, 4
test edi, edi
jne 0x47eed9
push str.allocating_catalog_data
call fcn.0047d9b0
push esi
call fcn.0063b2c6
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret
push esi
push ebx
push 1
push edi
call fcn.006449b7
push esi
mov ebx, eax
call fcn.0063b2c6
add esp, 0x14
test ebx, ebx
jns 0x47ef02
push edi
call dword [sym.KomManager.exe_xmlFree]
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
ret
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop ebx
pop esi
ret
push esi
call fcn.0063b2c6
add esp, 4
xor eax, eax
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4b09e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x6fe0ac], 0
jne 0x4b0a73
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4b0a73
cmp dword [0x6fe0b0], eax
jne 0x4b0a69
push str.no_proxy
mov dword [0x6fe0b4], 0x50
call fcn.0064501c
add esp, 4
test eax, eax
je 0x4b0a3e
cmp byte [eax], 0x2a
jne 0x4b0a3e
cmp byte [eax + 1], 0
je 0x4b0a69
push str.http_proxy
call fcn.0064501c
add esp, 4
test eax, eax
jne 0x4b0a60
push str.HTTP_PROXY
call fcn.0064501c
add esp, 4
test eax, eax
je 0x4b0a69
push eax
call sym.KomManager.exe_xmlNanoHTTPScanProxy
add esp, 4
mov dword [0x6fe0ac], 1
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
Function at 0x4b1610
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x21c
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
push edi
mov edi, dword [esp + 0x228]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b1656
push str.socket_failed_n
push 0
push 0xa
call fcn.00472980
add esp, 0xc
jmp 0x4b17be
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
inc eax
neg eax
push 0x10
sbb eax, eax
neg eax
push edi
dec eax
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4b16a6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
je 0x4b16a6
cmp eax, 0x2733
je 0x4b16a6
push str.error_connecting_to_HTTP_server
jmp 0x4b17ab
mov eax, dword [0x6f67c8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x120]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], esi
push eax
push 0
lea eax, [esi + 1]
mov dword [esp + 0x28], 1
push eax
mov dword [esp + 0x134], esi
mov dword [esp + 0x130], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4b17a6
test eax, eax
je 0x4b179f
lea eax, [esp + 0x18]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4b172c
lea eax, [esp + 0x11c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4b172c
push str.select_failed_n
jmp 0x4b17ab
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 4
push eax
lea eax, [esp + 0xc]
push eax
push 0x1007
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x4b175a
push str.getsockopt_failed_n
jmp 0x4b17ab
cmp dword [esp + 8], 0
je 0x4b1786
push str.Error_connecting_to_remote_host
push 0
push 0xa
call fcn.00472980
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call fcn.00636c72
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x4b17be
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x21c
ret
push str.Connect_attempt_timed_out
jmp 0x4b17ab
push str.Connect_failed
push 0
push 0xa
call fcn.00472980
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x220]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0x21c
ret
Function at 0x4b17e0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x18
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
xorps xmm0, xmm0
push esi
push eax
movups xmmword [esp + 0xc], xmm0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x4b182b
push str.Failed_to_resolve_host
push eax
push 0xa
call fcn.00472980
add esp, 0xc
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x18
ret
mov eax, dword [esi + 0xc]
push ebx
push ebp
push edi
cmp dword [eax], 0
je 0x4b18ae
mov ebx, dword [esp + 0x30]
xor edi, edi
mov ebp, dword [sym.imp.WS2_32.dll_htons]
cmp word [esi + 8], 2
jne 0x4b18ae
movsx ecx, word [esi + 0xa]
cmp ecx, 4
ja 0x4b189d
push ecx
push dword [edi + eax]
lea eax, [esp + 0x18]
push eax
call fcn.00633410
add esp, 0xc
mov eax, 2
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
push ebx
call ebp
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push eax
call fcn.004b1610
add esp, 4
cmp eax, 0xffffffff
jne 0x4b18b1
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x4b1842
jmp 0x4b18ae
push str.address_size_mismatch_n
push 0
push 0xa
call fcn.00472980
add esp, 0xc
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0x18
ret