joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423daf
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x48
push 1
call dword [0x491010]
mov esi, dword [ebp + 8]
mov edi, eax
pop ecx
pop ecx
push 8
mov dword [esi + 0x3bc], edi
pop ebx
test edi, edi
je 0x423e6f
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esi + 0x3b4], ecx
mov dword [esi + 0x3b8], ecx
mov dword [esi + 0x3b0], ecx
push eax
push dword [ebp + 0xc]
mov dword [esi + 0x3ac], eax
or dword [edi + 4], 0xffffffff
mov dword [edi], ecx
lea ecx, [edi + 0x10]
push ecx
call fcn.00423e8f
add esp, 0x10
test eax, eax
je 0x423e6f
mov eax, dword [esi + 0x3a8]
test eax, eax
je 0x423e2a
push eax
call dword [0x491004]
and dword [esi + 0x3a8], 0
pop ecx
push dword [ebp + 0xc]
call dword [0x49100c]
mov dword [esi + 0x3a8], eax
pop ecx
test eax, eax
je 0x423e6f
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x423e6f
lea eax, [edi + 0x10]
push eax
push 0x423d22
call fcn.0042f5aa
mov dword [edi], eax
pop ecx
pop ecx
test eax, eax
jne 0x423e8a
call fcn.0045385a
mov ebx, dword [eax]
lea eax, [esi + 0x3a8]
push eax
call fcn.00423c5c
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
inc eax
jmp 0x423e85

Function at 0x42b277
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [edi + eax*4 + 0x130]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov esi, eax
and dword [ebx], 0
cmp esi, 0xffffffff
jne 0x42b2e7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x42b2bf
xor esi, esi
mov dword [ebx], 0x51
jmp 0x42b2e7
push eax
push edi
call fcn.0042e26a
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.0042afb4
mov eax, dword [edi]
add esp, 0x14
mov ecx, dword [ebp + 8]
mov dword [eax + 0x856c], ecx
mov dword [ebx], 0x37
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x42b470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x164]
test eax, eax
je 0x42b498
push dword [esi + 0xf4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
jmp 0x42b4d0
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x42b4ce
push dword [esi + 0xf0]
imul eax, eax, 3
push 1
push 2
add eax, 0x4776f8
push eax
call fcn.0045202d
push dword [esi + 0xf0]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0045202d
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42b62a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov ecx, dword [eax + 0x530]
cmp ecx, edi
je 0x42b67e
mov eax, dword [eax + 0x524]
mov eax, dword [eax]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x42b67e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42b657
mov dword [ecx], eax
cmp dword [eax + 0x148], 0
mov esi, dword [eax + 0x130]
jne 0x42b67e
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
cmove esi, edi
mov eax, esi
jmp 0x42b680
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x42b7db
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x19c], 0
mov ebx, dword [edi]
jne 0x42b8fb
lea eax, [ebp - 0x108]
mov esi, 0x80
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x42b84d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0042e26a
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.0042afb4
add esp, 0x18
jmp 0x42b902
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], esi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x42b886
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0042e26a
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x42b83f
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0x9e]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0042bc57
add esp, 0xc
test eax, eax
jne 0x42b8bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0042e26a
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
jmp 0x42b83f
lea eax, [edi + 0x100]
push eax
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0042bc57
add esp, 0xc
test eax, eax
jne 0x42b8fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0042e26a
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
jmp 0x42b83f
push edi
call fcn.0042b684
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449be1
mov esp, ebp
pop ebp
ret
Function at 0x42c037
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x42c07f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0042e26a
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0042b04a
add esp, 0x14
jmp 0x42c08c
push str.TCP_NODELAY_set_n
push esi
call fcn.0042b04a
pop ecx
pop ecx
pop edi
pop esi
pop ebp
ret

Function at 0x42db2e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x42db3f
jmp dword [eax*4 + 0x42dbb2]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret
Function at 0x42de60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
and dword [ebp - 0xc], edi
and dword [eax], edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x42dfca
push esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
test esi, esi
je 0x42dfb6
push ebx
cmp dword [esi + 4], 2
jne 0x42df55
cmp dword [esi + 0x18], 0
je 0x42df55
cmp dword [esi + 0x10], 0
jbe 0x42df55
cmp dword [esi + 0x10], 0x10
jb 0x42df55
push 0x20
call dword [section..data]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42dfaa
mov ecx, dword [esi]
mov dword [ebx], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov eax, dword [esi + 0xc]
and dword [ebx + 0x18], 0
and dword [ebx + 0x14], 0
and dword [ebx + 0x1c], 0
push 0x10
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x10
call dword [section..data]
mov dword [ebx + 0x18], eax
pop ecx
test eax, eax
je 0x42df9e
mov esi, dword [esi + 0x18]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
cmp dword [esi + 0x14], 0
je 0x42df3d
push dword [esi + 0x14]
call dword [0x49100c]
mov dword [ebx + 0x14], eax
pop ecx
test eax, eax
je 0x42df87
mov edi, dword [ebp - 4]
test edi, edi
mov eax, dword [ebp - 0xc]
cmove edi, ebx
mov dword [ebp - 4], edi
test eax, eax
je 0x42df52
mov dword [eax + 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov esi, dword [esi + 0x1c]
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x42dea2
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 8], 0
pop ebx
je 0x42df76
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x42dfaf
push dword [ebp - 4]
call fcn.0042de1f
pop ecx
xor edi, edi
jmp 0x42dfc2
push 8
pop esi
push dword [ebx + 0x18]
call dword [0x491004]
push ebx
call dword [0x491004]
pop ecx
pop ecx
jmp 0x42df66
push 8
pop esi
push ebx
call dword [0x491004]
jmp 0x42df9b
push 8
pop esi
jmp 0x42df66
mov edi, dword [ebp - 4]
test edi, edi
jne 0x42dfc2
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x42f5aa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.0045ae5b
add esp, 0x18
test eax, eax
je 0x42f5ca
cmp eax, 0xffffffff
jne 0x42f5cc
xor eax, eax
pop ebp
ret
Function at 0x4365e3
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x43661e
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.0042afb4
add esp, 0xc
jmp 0x436646
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x436639
shr eax, 8
test al, al
jne 0x436639
xor eax, eax
jmp 0x436649
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.0042afb4
pop ecx
pop ecx
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00449be1
mov esp, ebp
pop ebp
ret

Function at 0x436d34
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x130]
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x436d7c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0042afb4
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push dword [esi]
call fcn.0043675a
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x436e3b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x90c], ebx
mov esi, dword [ebx]
mov dword [ebp - 0x908], esi
mov edi, dword [esi + 0x8664]
mov eax, dword [edi + 0x1ab0]
sub eax, dword [edi + 0x1aac]
add eax, 2
push eax
lea eax, [edi + 0x18ac]
push eax
push 0x3c
push esi
call fcn.00436843
mov eax, dword [edi + 0x1aac]
add esp, 0x10
movzx ecx, byte [eax]
inc eax
mov dword [edi + 0x1aac], eax
cmp ecx, 0x18
je 0x436fe6
cmp ecx, 0x23
je 0x436fc2
cmp ecx, 0x27
jne 0x437071
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.0042c8e8
mov edi, dword [edi + 0x18a8]
add esp, 0x1c
push 4
pop ebx
test edi, edi
je 0x436f5c
mov ecx, dword [edi]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436eed
sub ecx, edx
lea esi, [ebx + 1]
add esi, ecx
cmp esi, 0x7fa
jae 0x436f4f
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
push str._127_____127s
push dword [edi]
call fcn.00423542
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, 0x800
sub eax, ebx
push str._c_s_c_s
push eax
lea eax, [ebp - 0x904]
add eax, ebx
push eax
call fcn.0042c8e8
add esp, 0x2c
mov ebx, esi
mov edi, dword [edi + 4]
test edi, edi
jne 0x436ee8
mov esi, dword [ebp - 0x908]
push 0xf0
push 0xff
mov eax, 0x800
sub eax, ebx
push 0x47a250
push eax
lea eax, [ebp - 0x904]
add eax, ebx
push eax
call fcn.0042c8e8
add esp, 0x14
lea eax, [ebx + 2]
push 0
push eax
lea eax, [ebp - 0x904]
push eax
mov eax, dword [ebp - 0x90c]
push dword [eax + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x436fbc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0042afb4
add esp, 0xc
push ebx
jmp 0x43705f
lea edx, [edi + 0x1828]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436fcd
push 0xf0
mov eax, 0xff
push eax
push edx
push 0
push 0x23
jmp 0x437008
lea edx, [edi + 0x1808]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436ff1
push 0xf0
mov eax, 0xff
push eax
push edx
push 0
push 0x18
push 0xfa
push eax
push str._c_c_c_c_s_c_c
sub ecx, edi
lea eax, [ebp - 0x904]
push 0x800
push eax
lea edi, [ecx + 6]
call fcn.0042c8e8
add esp, 0x28
lea eax, [ebp - 0x904]
push 0
push edi
push eax
push dword [ebx + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x43705b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0042afb4
add esp, 0xc
lea eax, [edi - 2]
push eax
lea eax, [ebp - 0x902]
push eax
push 0x3e
push esi
call fcn.00436843
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449be1
mov esp, ebp
pop ebp
ret
Function at 0x437d36
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x88]
push esi
push edi
push eax
mov esi, dword [ebx + 0x3d0]
lea eax, [ebp - 0x84]
mov edi, dword [ebx]
push eax
mov dword [ebp - 0x88], 0x80
mov eax, dword [esi + 0x154]
push 0
add eax, 4
mov dword [ebp - 0x8c], ebx
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x437dc7
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.0044b300
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x437df9
push str.Received_too_short_packet
push edi
call fcn.0042afb4
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449be1
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
mov dword [esi + 0xc], ecx
sub ecx, 3
je 0x437e89
sub ecx, 1
je 0x437f02
sub ecx, 1
je 0x437e5c
sub ecx, 1
je 0x437e3b
push str.Internal_error:_Unexpected_packet
push 0x48d52c
push edi
call fcn.0042afb4
jmp 0x437eff
lea eax, [edx - 2]
push eax
mov eax, dword [esi + 0x15c]
add eax, 2
push eax
push esi
call fcn.00437ae9
add esp, 0xc
test eax, eax
je 0x437f02
jmp 0x437de8
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
mov eax, dword [esi + 0x15c]
add eax, 4
mov dword [esi + 8], ecx
push eax
push 0x4769ec
push edi
call fcn.0042b04a
jmp 0x437eff
cmp edx, 4
jle 0x437f02
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [esi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x437f02
lea eax, [edx - 4]
push eax
mov eax, dword [esi + 0x15c]
add eax, 4
push eax
push 1
push ebx
call fcn.0042ada7
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x437edd
push 5
push esi
call fcn.00438588
pop ecx
pop ecx
mov eax, ebx
jmp 0x437de8
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x38], eax
adc dword [edi + 0x3c], edx
push dword [edi + 0x3c]
push dword [edi + 0x38]
push edi
call fcn.00434a80
mov ebx, dword [ebp - 0x8c]
add esp, 0xc
push ebx
call fcn.00434c78
pop ecx
test eax, eax
je 0x437de6
push 5
push esi
call fcn.00438588
pop ecx
pop ecx
push 0x2a
pop eax
jmp 0x437de8
Function at 0x439b8a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x10
mov eax, dword [ebx + 0x134]
mov esi, dword [ebx]
mov dword [ebp - 0x18], eax
jmp 0x439bdc
mov eax, 0x3e8
cmp ecx, eax
cmovl eax, ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
call fcn.0043596b
add esp, 0xc
cmp eax, 0xffffffff
je 0x439c83
test eax, eax
jne 0x439c10
push 1
push 0
push esi
call fcn.0042b730
mov ecx, eax
add esp, 0xc
test ecx, ecx
jns 0x439bb7
push str.Timeout_while_waiting_for_server_connect
push esi
call fcn.0042afb4
pop ecx
pop ecx
push 0x1c
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449be1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x439c3f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push dword [ebp - 0x18]
push ebx
call fcn.0042b4d3
pop ecx
pop ecx
cmp edi, 0xffffffff
jne 0x439c60
push str.Error_accept__ing_server_connect
push esi
call fcn.0042afb4
pop ecx
pop ecx
push 0x1e
jmp 0x439bfe
push str.Connection_accepted_from_server_n
push esi
call fcn.0042b04a
push 1
push edi
mov dword [ebx + 0x134], edi
call fcn.004400d6
add esp, 0x10
xor eax, eax
jmp 0x439bff
push str.Error_while_waiting_for_server_connect
jmp 0x439c54

Function at 0x43ba3a
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x43ba66
push str.Couldnt_set_desired_mode
push edx
call fcn.0042afb4
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x43baba
cmp ecx, 0xc8
je 0x43ba7d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.0042b04a
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x43ba8e
push edi
call fcn.0043b651
pop ecx
jmp 0x43bab6
cmp eax, 0x14
jne 0x43ba9b
push edi
call fcn.0043b211
jmp 0x43ba8b
cmp eax, 0x15
jne 0x43baa4
push 0xd
jmp 0x43baab
cmp eax, 0x16
jne 0x43bab8
push 0xe
push 1
push edi
call fcn.0043b6cb
add esp, 0xc
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x4407fb
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax + 0x2c]
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a4]
test esi, esi
jne 0x440816
mov esi, dword [eax + 0x28]
push dword [eax + 0x24]
push dword [eax + 0x20]
call fcn.0042de09
push edx
push eax
call fcn.0042ddb3
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x440860
push dword [ebx + 0x124]
push dword [ebx + 0x120]
call fcn.0042de09
push edx
push eax
call fcn.0042ddb3
mov ecx, dword [edi + 0x19c]
add esp, 0x10
sub ecx, eax
cmp esi, ecx
cmovl ecx, esi
mov esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x441199
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x441d77
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
pop ecx
test edi, edi
je 0x441e63
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x441de0
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x441de6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
pop ecx
test eax, eax
je 0x441e5b
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
sub ebx, 1
jne 0x441e00
mov ebx, dword [ebp - 8]
jmp 0x441e5b
push 1
push 0x47c99c
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x47c99d
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x441e3d
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4426c8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4426f2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4426e3
xor eax, eax
jmp 0x442745
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x442723
cmp dword [esi + 8], 0
jne 0x442713
push 0x48cbf4
push dword [eax + 8]
call fcn.00452438
mov dword [esi + 8], eax
pop ecx
pop ecx
test eax, eax
jne 0x442713
or eax, 0xffffffff
jmp 0x442745
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00453bd8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x442743
cmp dword [esi + 8], eax
je 0x44273d
push dword [esi + 8]
call fcn.0044f627
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret