joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ba71
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x599022
call fcn.004c9756
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0045be00
call fcn.0043841d
push eax
lea ecx, [ebp - 0x94]
call fcn.00435d3a
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00438423
mov ecx, eax
call fcn.0043653e
test al, al
je 0x45bb87
push ebx
lea ecx, [ebp - 0x94]
call fcn.00435fae
push edi
push 0x80
push 3
push edi
push 1
push closesocket
lea ecx, [ebp - 0x94]
call fcn.004bf2a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x45baf8
push str.Error_opening_file
jmp 0x45bc68
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x45bc01
cmp edi, 0x400000
ja 0x45bc12
and dword [ebp - 0x2c8], 0
push edi
call fcn.004c8d89
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x45bb70
push ebx
call fcn.004c8d92
pop ecx
mov ecx, esi
call fcn.0045be00
push 0
push str.Could_not_read_file
jmp 0x45bc68
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0045bcb3
push dword [ebp - 0x2cc]
jmp 0x45bc96
call fcn.00438423
push eax
lea ecx, [ebp - 0x94]
call fcn.00435f91
call fcn.00438729
test al, al
je 0x45bba8
call fcn.00438429
jmp 0x45bbbf
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.004bf2a0
push eax
call fcn.00458260
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x45bbd0
push eax
push str.Error_opening_zip_file
jmp 0x45bc68
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.00457ca1
add esp, 0x14
test eax, eax
je 0x45bbf7
push 0
push str.Could_not_find_ziped_file
jmp 0x45bc68
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x45bc0a
push 0
push str.File_is_empty
jmp 0x45bc68
cmp ebx, 0x400000
jbe 0x45bc1b
push 0
push 0x5a0148
jmp 0x45bc68
push ebx
call fcn.004c8d89
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.00458620
add esp, 0x18
test eax, eax
je 0x45bc73
cmp eax, 0x600
je 0x45bc73
push dword [ebp - 0x2c8]
call fcn.004c8d92
pop ecx
call fcn.00438729
test al, al
jne 0x45bc61
push edi
call fcn.00457afb
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0045be28
mov bl, al
jmp 0x45bc9e
call fcn.00438729
test al, al
jne 0x45bc83
push edi
call fcn.00457afb
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0045bcb3
push edi
mov bl, al
call fcn.004c8d92
pop ecx
lea ecx, [ebp - 0x94]
call fcn.00435e46
mov al, bl
call fcn.004c9711
ret 8

Function at 0x4649b8
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x638
jmp fcn.0046955a
Function at 0x470e48
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x470ec8
cmp dword [esi + 0x10], 0
je 0x470ec8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004c96d0
mov ebx, esp
test ebx, ebx
je 0x470ec8
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1c8
call fcn.00435ee4
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
push str.textchanged
push ecx
mov ecx, dword [ecx + 0x44]
call fcn.0043be49
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.00438736
test al, al
je 0x470ec8
mov ecx, dword [esi + 0x10]
call fcn.00442fe5
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret 0x10
Function at 0x471c47
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x599dd9
call fcn.004c9756
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.0043841d
push eax
lea ecx, [ebp - 0x94]
call fcn.00435d3a
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00438423
mov ecx, eax
call fcn.0043653e
test al, al
je 0x471d35
push ebx
lea ecx, [ebp - 0x94]
call fcn.00435fae
push edi
push 0x80
push 3
push edi
push 1
push closesocket
lea ecx, [ebp - 0x94]
call fcn.004bf2a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x471cd8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00435e46
jmp 0x471e16
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x471cc4
push esi
mov dword [ebp - 0x2c8], edi
call fcn.004c8d89
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x471e01
push edi
call fcn.004c8d92
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00435e46
jmp 0x471e14
call fcn.00438423
push eax
lea ecx, [ebp - 0x94]
call fcn.00435f91
call fcn.00438729
test al, al
je 0x471d56
call fcn.00438429
jmp 0x471d6d
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.004bf2a0
push eax
call fcn.00458260
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x471cc4
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.00457ca1
add esp, 0x14
test eax, eax
jne 0x471cc4
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x471cc4
push esi
call fcn.004c8d89
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.00458620
add esp, 0x18
test eax, eax
je 0x471df1
cmp eax, 0x600
je 0x471df1
push edi
call fcn.004c8d92
pop ecx
call fcn.00438729
test al, al
jne 0x471d21
push ebx
call fcn.00457afb
jmp 0x471d20
call fcn.00438729
test al, al
jne 0x471e01
push ebx
call fcn.00457afb
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00435e46
test edi, edi
jne 0x471e88
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push closesocket
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x471e84
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x471e84
push esi
mov dword [ebp - 0x2d0], edi
call fcn.004c8d89
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x471e80
push edi
call fcn.004c8d92
pop ecx
xor edi, edi
test edi, edi
jne 0x471e88
xor eax, eax
jmp 0x471ea0
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.00471ea8
push edi
mov esi, eax
call fcn.004c8d92
pop ecx
mov eax, esi
call fcn.004c9711
ret 4
Function at 0x473938
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x599f9e
call fcn.004c9756
mov esi, ecx
mov dword [ebp - 0x98], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x10], eax
mov dword [eax + 0x500], ebx
cmp dword [esi + 4], ebx
jne 0x4739c1
lea eax, [ebp - 0xa8]
push eax
call fcn.004734fb
push ebx
sub esp, 0x10
lea esi, [ebp - 0xa8]
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x98]
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.00438401
push eax
mov ecx, esi
call fcn.0043dedc
mov ecx, dword [esi + 0x10]
call fcn.0045dd63
mov ecx, dword [esi + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call fcn.00438102
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0043653e
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00435e46
mov edi, 0x4f0
test bl, bl
je 0x4739fc
mov eax, dword [esi + 0x10]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x10]
add eax, edi
push 0x10
push eax
lea eax, [esi + 0x1a]
push eax
call fcn.004cc330
mov eax, dword [esi + 0x10]
add esp, 0xc
add eax, edi
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esi + 0x18], 1
call fcn.004c9711
ret 4

Function at 0x473e31
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x473e5d
xor eax, eax
jmp 0x473ed2
push esi
mov esi, 0xff
lea eax, [ebp - 0x104]
push esi
push 0
push eax
call fcn.004cbb60
add esp, 0xc
lea eax, [ebp - 0x104]
push esi
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
pop esi
test eax, eax
je 0x473e59
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.004cc330
mov ecx, dword [ebp - 0x298]
add esp, 0xc
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
Function at 0x473fcf
Capabilities:
Hide graphical window

Disassembly:
push 0xa4
mov eax, 0x59a01f
call fcn.004c9756
mov esi, ecx
mov dword [ebp - 0x98], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x10], eax
mov dword [eax + 0x4f8], ebx
cmp dword [esi + 4], ebx
jne 0x474083
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 8
push eax
mov dword [ebp - 0x9c], 0x800
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x474060
lea eax, [ebp - 0xb0]
mov ecx, esi
push eax
call fcn.00473bc6
push ebx
sub esp, 0x10
lea esi, [ebp - 0xb0]
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
push 0x40030000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x98]
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.00438401
push eax
mov ecx, esi
call fcn.0043dedc
mov ecx, dword [esi + 0x10]
call fcn.0045dd63
mov ecx, dword [esi + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call fcn.00438102
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0043653e
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00435e46
test bl, bl
je 0x4740bb
call fcn.00473e31
mov ecx, dword [esi + 0x10]
mov dword [ecx + 0x4f0], eax
mov eax, dword [esi + 0x10]
push dword [eax + 0x4f0]
push 0
push 0x465
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esi + 0x18], 1
call fcn.004c9711
ret 4

Function at 0x477f09
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046955a

Function at 0x477f12
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x638
jmp method.DuiLib::CMenuUI.virtual_312
Function at 0x478cc9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
and dword [ebx + 0x468], 0
mov edi, dword [ebp + 0x1c]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], esi
mov dword [ebx + 0x464], ecx
mov dword [ebx + 0x46c], eax
test ecx, ecx
jne 0x478d34
call fcn.00478a8c
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test edi, edi
je 0x478d34
call fcn.00478a8c
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.00478a8c
mov esi, ebx
lea edx, [ebx + 0x10]
neg esi
mov ecx, eax
mov edi, dword [eax]
sbb esi, esi
and esi, edx
push esi
call dword [edi]
mov ecx, dword [ebx + 0x464]
test ecx, ecx
jne 0x478d5a
mov ecx, dword [ebp - 0x18]
jmp 0x478d61
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00438401
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.00435d16
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
push 0x88
movsd dword es:[edi], dword [esi]
push closesocket
push 0
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0043dedc
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x478da4
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x478d9f
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c8d78
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x47e90a
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
cmp esi, 0x21
jb 0x47e958
cmp esi, 0x28
jbe 0x47e952
lea eax, [esi - 0x2d]
cmp eax, 1
ja 0x47e958
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004cbb60
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x104
cmove ecx, edi
push eax
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00435d5f
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c8d78
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47ec4b
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x59abcd
call fcn.004c9756
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x47ed52
lea eax, [ebp - 0xa4]
push eax
call fcn.0047e3ea
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0xa4]
xor eax, eax
push eax
sub esp, 0x10
mov ecx, dword [ecx + 0x44]
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00438401
push eax
mov ecx, ebx
call fcn.0043dedc
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47ed52
mov ecx, dword [ebx + 0x10]
call fcn.0045dd63
mov ecx, dword [ebx + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call fcn.00438102
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
movzx eax, word [ecx + 0x70e]
push eax
movzx eax, word [ecx + 0x70c]
mov ecx, ebx
push eax
call fcn.0047f183
lea eax, [ebp - 0x94]
mov ecx, ebx
push eax
call fcn.0047e75c
mov ecx, dword [ebx + 0x10]
and dword [ebp - 4], 0
add ecx, 0x1c8
push eax
call fcn.00435ec5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00435e46
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x100]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x18], 1
call fcn.004c9711
ret 4

Function at 0x4801d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x480220
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x48021a
shr eax, 8
cmp al, 2
jne 0x48021a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
Function at 0x4a5a50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004ded70
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4a5ab4
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4a5ab4
lea eax, [ebp - 0x108]
push eax
call dword [0x60733c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret

Function at 0x4a5ad0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a5a50
Function at 0x4ab040
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
push ecx
mov eax, dword [edi + 0x1ac]
or esi, 0xffffffff
mov ebx, dword [edi]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4ab098
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x1c]
push edi
call fcn.00494250
add esp, 8
cmp esi, 0xffffffff
jne 0x4ab0cd
push str.Error_accept__ing_server_connect
push ebx
call fcn.004938c0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.004939a0
push 1
mov byte [edi + 0x28c], 0
push esi
mov dword [edi + 0x1ac], esi
call fcn.004b7c70
add esp, 0x10
mov byte [edi + 0x1b9], 1
cmp dword [ebx + 0x1d8], 0
je 0x4ab149
push 1
push ebx
call fcn.00484cb0
mov eax, dword [ebx + 0x1d8]
push 1
push esi
push dword [ebx + 0x1dc]
call eax
push 0
push ebx
mov esi, eax
call fcn.00484cb0
add esp, 0x1c
test esi, esi
je 0x4ab149
push edi
call fcn.004ab5b0
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c8d78
mov esp, ebp
pop ebp
ret

Function at 0x4ad520
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x4ad54f
push str.Couldnt_set_desired_mode
push edx
call fcn.004938c0
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x4ad566
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.004939a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x4ad57d
push edi
call fcn.004ad280
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x4ad591
push edi
call fcn.004ac2e0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x4ad5a5
push edi
call fcn.004ad260
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x4ad5b5
push edi
call fcn.004ad400
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4b0560
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x6073a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4b05ad
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.004938c0
add esp, 0xc
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4b05d5
shr eax, 8
test al, al
jne 0x4b05d5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c8d78
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.004938c0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 2
pop esi
call fcn.004c8d78
mov esp, ebp
pop ebp
ret

Function at 0x4b0e00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x1a8]
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4b0e48
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004938c0
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push dword [esi]
call fcn.004b06f0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b0f70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x150]
jne 0x4b10c6
push edi
lea eax, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], eax
cmp eax, edi
jae 0x4b0fa7
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4b0fb2
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4b0fbd
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
mov word [ebp - 0xc], ax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [edi]
mov word [ebp - 0x14], ax
cmp ecx, edi
jae 0x4b0fed
mov al, byte [ebp - 0xc]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4b0ffa
mov al, byte [ebp - 0xb]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4b1007
mov al, byte [ebp - 0x14]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4b1014
mov al, byte [ebp - 0x13]
mov byte [ecx], al
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4b101f
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4b102a
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
lea esi, [ebx + 0x1cb0]
mov dword [ebx + 0x1eb4], eax
sub eax, esi
sub eax, 2
mov dword [edi], esi
mov edi, dword [ebp - 4]
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push edi
call fcn.004b07f0
add esp, 0x10
push 0
push 3
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4b1082
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004938c0
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push esi
call fcn.004b0e60
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [esi + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x4b10c5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004938c0
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret