joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4770c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xffffff00
lea eax, [ebp - 0x81c]
add edx, 0x200
push eax
or edx, 0x20019
push edx
push 0
mov dword [ebp - 0x820], 0
call fcn.00403360
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47713e
push 0x4fdaac
mov ecx, esi
call fcn.00404040
jmp 0x4771e3
xor eax, eax
push 0x800
push eax
lea ecx, [ebp - 0x812]
push ecx
mov word [ebp - 0x814], ax
call fcn.004b28e0
add esp, 0xc
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x820], 0x400
call fcn.00403540
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0x814]
push eax
push 0
push 0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00403360
mov ecx, dword [ebp - 0x81c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4771bd
lea edx, [ebp - 0x814]
push edx
push 0x5046bc
lea edx, [ebp - 0x818]
call fcn.00475ed0
add esp, 8
mov eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x818]
push ecx
mov ecx, esi
call fcn.00407bf0
lea ecx, [ebp - 0x818]
call fcn.00404140
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret

Function at 0x477200
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea eax, [ebp - 0x24]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x24]
cmp ax, 9
je 0x477228
cmp ax, 6
jne 0x477269
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47729a
push str.RegDeleteKeyExW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x477293
mov ecx, dword [ebp + 8]
push 0
push 0x100
push ebx
push ecx
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47729a
push str.RegDeleteKeyW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x477293
mov edx, dword [ebp + 8]
push ebx
push edx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4774e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da988
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5176f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, ecx
xor eax, eax
mov dword [ebp + 0xc], eax
mov edx, dword [esi + 0xc]
lea ecx, [ebp + 0xc]
push ecx
push edx
push eax
lea ecx, [esi + 8]
mov dword [ebp + 0xc], eax
call fcn.00403360
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x2000
push edi
call fcn.004b13d7
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x10], edi
call fcn.004b28e0
mov edx, dword [ebp + 0xc]
add esp, 0x10
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x477598
add edi, 0x1000
push edi
push esi
call fcn.004b0b08
mov ecx, dword [ebp + 0xc]
add esp, 8
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push 0
push ebx
push ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x477568
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4775a0
sub eax, edx
jne 0x4775c6
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
push 0x4fdaac
mov ecx, esi
call fcn.00404040
jmp 0x477603
mov edi, dword [ebp - 0x10]
shr edi, 1
dec edi
call fcn.004035c0
push eax
push edi
push esi
lea ecx, [ebp - 0x14]
call fcn.004071a0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.00407bf0
lea ecx, [ebp - 0x14]
call fcn.00404140
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x477920
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcf0a
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
mov eax, dword [0x5176f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
mov dword [ebp - 0x24], ebx
call fcn.00477b30
add esp, 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00403360
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x477a45
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x58]
call fcn.00407bf0
lea edx, [ebp - 0x54]
mov byte [ebp - 4], 1
push edx
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x58]
call fcn.00478550
push str.sres
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00404040
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, edi
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.004786b0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00404140
lea ecx, [ebp - 0x14]
call fcn.00403aa0
test eax, eax
je 0x477a13
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
call fcn.00407bf0
lea ecx, [ebp - 0x14]
call fcn.00404140
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x3c]
cmp ecx, ebx
je 0x477a01
push 1
call fcn.00407d90
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebp - 0x58]
jmp 0x477b0b
lea ecx, [ebp - 0x14]
call fcn.00404140
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x3c]
cmp ecx, ebx
je 0x477a30
push 1
call fcn.00407d90
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.00404140
push str.SoftwareSystemSres
lea ecx, [ebp - 0x1c]
call fcn.00404040
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.00403360
push eax
lea edx, [ebp - 0x38]
push edx
call fcn.00477430
mov byte [ebp - 4], 9
cmp byte [0x51c220], bl
je 0x477ad2
lea eax, [ebp - 0x28]
push eax
call fcn.00477d10
add esp, 4
lea ecx, [ebp - 0x14]
push 0x501b40
push ecx
mov esi, eax
mov byte [ebp - 4], 0xa
call fcn.00470cb0
lea edx, [ebp - 0x1c]
push edx
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xb
call fcn.00406d10
add esp, 0x14
push eax
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.00470e00
lea ecx, [ebp - 0x20]
call fcn.00404140
lea ecx, [ebp - 0x14]
call fcn.00404140
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00404140
mov ecx, edi
call fcn.00403360
push eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x38]
call fcn.004774e0
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x24]
push edx
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.00407bf0
lea ecx, [ebp - 0x24]
call fcn.00404140
lea ecx, [ebp - 0x30]
call fcn.00404140
lea ecx, [ebp - 0x1c]
call fcn.00404140
lea ecx, [ebp - 0x18]
call fcn.00404140
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478220
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da8f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5176f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
xor edi, edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], edi
push eax
mov ecx, ebx
mov dword [ebp - 0x14], edi
call fcn.00403360
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x14], eax
cmp eax, edi
jbe 0x47835c
push eax
call fcn.004ad653
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x14]
push esi
push ecx
push edi
mov ecx, ebx
call fcn.00403360
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x47834c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], edi
call fcn.00403540
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push str.VarFileInfoTranslation
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
push esi
call edi
test eax, eax
jne 0x478303
push 0x4fdaac
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00404040
lea ecx, [ebp - 0x10]
call fcn.00404140
push esi
call fcn.004ae118
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
movzx ecx, word [eax + 2]
push edx
movzx edx, word [eax]
push ecx
push edx
lea eax, [ebp - 0x10]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.00402f20
add esp, 0x14
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x10]
call fcn.00403360
push eax
push esi
call edi
test eax, eax
je 0x478344
mov eax, dword [ebp - 0x1c]
push eax
jmp 0x4782d4
lea ecx, [ebp - 0x10]
call fcn.00404140
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004ae118
add esp, 4
mov esi, dword [ebp + 8]
push 0x4fdaac
mov ecx, esi
call fcn.00404040
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478550
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dce7b
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.0040af80
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00403360
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4785c2
call fcn.00407c50
lea edi, [ebp - 0x48]
call fcn.004612d0
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00408610
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040b0a0
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4785e1
push 1
call fcn.00407d90
mov dword [esi + 0x1c], 0
push 0x50
call fcn.004ae3b4
add esp, 4
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x478603
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.004108d0
jmp 0x478605
xor eax, eax
push edi
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x2c]
call fcn.0040b0a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
Function at 0x478af0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
lea edi, [ebp - 0x434]
mov ecx, 0x10d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00479910
add esp, 4
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.004b28e0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.00478f50
add esp, 8
push 0x50324c
lea eax, [ebp - 0x118]
push eax
call fcn.00478fa0
add esp, 8
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.00478fa0
add esp, 8
xor eax, eax
mov word [ebp - 0x328], ax
push 0x206
push 0
lea eax, [ebp - 0x326]
push eax
call fcn.004b28e0
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x328]
push eax
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, esp
call fcn.004b2860
mov dword [ebp - 0x334], 0
jmp 0x478be6
mov eax, dword [ebp - 0x334]
add eax, 1
mov dword [ebp - 0x334], eax
mov esi, esp
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.004b2860
cmp dword [ebp - 0x334], eax
je 0x478c6a
mov eax, dword [ebp - 0x334]
movzx ecx, word [ebp + eax*2 - 0x328]
cmp ecx, 0x5c
je 0x478c2a
mov eax, dword [ebp - 0x334]
movzx ecx, word [ebp + eax*2 - 0x328]
cmp ecx, 0x2f
jne 0x478c65
xor eax, eax
mov ecx, dword [ebp - 0x334]
mov word [ebp + ecx*2 - 0x328], ax
mov esi, esp
push 0
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp esi, esp
call fcn.004b2860
mov eax, 0x5c
mov ecx, dword [ebp - 0x334]
mov word [ebp + ecx*2 - 0x328], ax
jmp 0x478bd7
mov dword [ebp - 0x340], 0x23
mov eax, dword [ebp + 8]
push eax
call fcn.00479980
add esp, 4
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x358], 0
lea eax, [ebp - 0x358]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00479af0
add esp, 8
test eax, eax
jne 0x478d45
mov esi, esp
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.004b2860
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xffffffff
jne 0x478cea
mov eax, dword [ebp - 0x340]
jmp 0x478d4b
mov dword [ebp - 0x370], 0
mov esi, esp
push 0
lea eax, [ebp - 0x370]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x358]
push edx
mov eax, dword [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.004b2860
test eax, eax
je 0x478d2f
mov dword [ebp - 0x340], 0
mov esi, esp
mov eax, dword [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004b2860
mov eax, dword [ebp - 0x340]
push edx
mov ecx, ebp
push eax
lea edx, [0x478d7c]
call fcn.004b2883
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae123
add esp, 0x434
cmp ebp, esp
call fcn.004b2860
mov esp, ebp
pop ebp
ret
Function at 0x47d2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004b2192
add esp, 0x10
cmp dword [ebp + 0xc], eax
je 0x47d2e8
mov eax, str._read_write_error
jmp 0x47d2ea
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.004b2860
mov esp, ebp
pop ebp
ret 8

Function at 0x47f4b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], 0
jmp 0x47f4e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jae 0x47f535
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0
jmp 0x47f503
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 8
jge 0x47f526
mov eax, dword [ebp - 0x14]
shr eax, 1
mov ecx, dword [ebp - 0x14]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x47f4fa
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x51db80], ecx
jmp 0x47f4d9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489920
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x308], 2
jne 0x489932
jmp fcn.004898c0
mov eax, 1
ret

Function at 0x48ab70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x48aba2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x48ad00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x368], 0
push edi
je case.default.0x48ad60
test eax, eax
je case.default.0x48ad60
mov eax, dword [eax + 0x9c]
test eax, eax
je case.default.0x48ad60
lea edx, [ebx - 1]
mov ecx, str.Data
cmp edx, 3
ja case.default.0x48ad60
jmp dword [edx*4 + 0x48ae7c]
mov ecx, str.Header
mov edx, str.from
jmp 0x48ad7d
mov ecx, str.Header
mov edx, 0x4e531c
push eax
push edx
push ecx
push str.__s__s__s_
lea eax, [esp + 0x20]
push 0xa0
push eax
call fcn.0048e260
lea eax, [esp + 0x28]
add esp, 0x18
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48ada0
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x48adf5
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x48ae60
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x48ae23
mov ecx, dword [esi + 0x134]
mov edx, dword [esp + 0xc4]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
jmp 0x48ae60
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x4e52f8
call fcn.004b5a35
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [esp + 0x28]
push edi
push edx
call fcn.004b5a35
add esp, 0x20
jmp case.default.0x48ad60
test ebx, ebx
js 0x48ae5e
cmp ebx, 2
jg 0x48ae5e
mov eax, dword [esi + 0x130]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0x4e52f8]
push 2
push ecx
call fcn.004b5a35
mov edx, dword [esi + 0x130]
mov eax, dword [esp + 0xd4]
push edx
push 1
push eax
push ebp
call fcn.004b5a35
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ae123
add esp, 0xa4
ret
Function at 0x48af30
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp], eax
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0x6cc]
lea eax, [esp + 0x14]
push eax
push ecx
push 0x4000
push edx
call fcn.0048e200
mov eax, dword [esi + 0x138]
add esp, 0x10
test eax, eax
je 0x48af95
cmp dword [esi + 0x4704], 0
jne 0x48af95
mov ecx, dword [esi + 0x6cc]
push ecx
push 0x502128
push 0x100
push eax
call fcn.0048e260
add esp, 0x10
mov dword [esi + 0x4704], 1
cmp dword [esi + 0x3b4], 0
je 0x48b02c
mov edx, dword [esi + 0x6cc]
mov eax, edx
push edi
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48afb0
sub eax, edi
mov edi, eax
cmp edi, 0x3fff
jae 0x48afd1
mov byte [edx + edi], 0xa
mov edx, dword [esi + 0x6cc]
inc edi
mov byte [edi + edx], cl
mov eax, dword [esi + 0x1a8]
push ebx
mov ebx, dword [esi + 0x6cc]
test eax, eax
je 0x48b002
mov ecx, dword [esi + 0x134]
push ecx
push edi
push ebx
push 0
push esi
call eax
add esp, 0x14
pop ebx
pop edi
pop esi
mov ecx, dword [esp]
xor ecx, esp
call fcn.004ae123
pop ecx
ret
mov edx, dword [esi + 0x130]
push edx
push 1
push 2
push 0x4e52f8
call fcn.004b5a35
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.004b5a35
add esp, 0x20
pop ebx
pop edi
mov ecx, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.004ae123
pop ecx
ret
Function at 0x48b040
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xb8
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0xc4]
push ebx
mov ebx, dword [esp + 0xc4]
push esi
mov esi, dword [ebx]
push edi
lea eax, [esp + 0xd4]
push eax
push ecx
call fcn.0048ed80
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x48b09d
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.004ae123
add esp, 0xb8
ret
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48b0a0
sub eax, edx
mov ecx, eax
mov dword [esp + 0xc], edi
push ebp
mov edx, dword [esp + 0xcc]
xor eax, eax
cmp edx, dword [ebx + 0x194]
lea edx, [esp + 0x18]
push edx
sete al
push ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x24], 0
mov edx, dword [ebx + eax*4 + 0x1b0]
push eax
push ebx
call edx
mov ebp, eax
xor ecx, ecx
add esp, 0x14
cmp ebp, ecx
jge 0x48b106
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x48b1e9
cmp eax, 0x51
jne 0x48b1e3
xor ebp, ebp
mov dword [esp + 0x14], ecx
cmp dword [esi + 0x3b4], ecx
je 0x48b19e
cmp dword [esi + 0x368], ecx
je 0x48b17f
mov eax, dword [ebx + 0x9c]
cmp eax, ecx
je 0x48b17f
push eax
push 0x4e531c
push str.Data
push str.__s__s__s_
lea eax, [esp + 0x34]
push 0xa0
push eax
call fcn.0048e260
lea eax, [esp + 0x3c]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48b151
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x48b1b5
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x48b19e
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x48b19e
mov ecx, dword [esi + 0x134]
mov edx, dword [esp + 0x10]
push ecx
push ebp
push edx
push 4
push esi
call eax
add esp, 0x14
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ebp, ecx
je 0x48b1f1
sub ecx, ebp
add dword [esp + 0x10], ebp
jmp 0x48b0b0
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x4e52f8
call fcn.004b5a35
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [esp + 0x3c]
push edi
push edx
call fcn.004b5a35
add esp, 0x20
jmp 0x48b17f
mov dword [esp + 0x14], eax
jmp 0x48b1f1
mov dword [esp + 0x14], 0x37
push edi
call dword [0x517174]
mov ecx, dword [esp + 0xc8]
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ae123
add esp, 0xb8
ret
Function at 0x48b4f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [eax + ecx*4 + 0x190]
mov edx, ecx
add edx, edx
push esi
lea esi, [eax + edx*8 + 0x1b8]
mov edx, dword [eax + 0x300]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x48b59e
cmp dword [eax + ecx*4 + 0x1a8], 0x48b220
jne 0x48b59e
cmp dword [esi], 0
je 0x48b531
test edi, edi
je 0x48b59e
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00489140
add esp, 0x14
cmp eax, 0xffffffff
je 0x48b59e
test al, 1
je 0x48b59e
cmp dword [esi], 0
jne 0x48b57c
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x517170]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x48b597
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x48b59e
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
ret

Function at 0x48b5b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi + ecx*4 + 0x190]
mov eax, esi
call fcn.0048b4f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x48b634
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x48b60b
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.0048f860
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.0048af30
mov eax, dword [esi]
mov dword [eax + 0x4708], ebp
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret