joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ea60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53467c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x599850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x58]
mov ecx, dword [edi + 0x100]
test ecx, ecx
je 0x46eae3
cmp dword [edi + 0x18], 0
je 0x46eae3
cmp byte [edi + 4], 0
jne 0x46eae3
call fcn.0045aa70
mov esi, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [esi + 0x2c]
cmp ecx, 4
mov bl, byte [esi + 0x90]
setle bh
jle 0x46eacf
test bl, bl
je 0x46eb83
sub esp, 8
mov eax, esp
mov dword [eax], str.LocalSocketServer_already_listening
mov dword [eax + 4], 0x23
jmp 0x46eb2c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x46eb99
call fcn.0045aa70
mov esi, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [esi + 0x2c]
cmp ecx, 4
mov bl, byte [esi + 0x90]
setle bh
jle 0x46eb1a
test bl, bl
je 0x46eb83
sub esp, 8
mov eax, esp
mov dword [eax], str.LocalSocketServer_name_is_empty
mov dword [eax + 4], 0x1f
push 4
sub esp, 8
lea ecx, [esi + 8]
cmp dword [esi + 0x1c], 0x10
mov edx, esp
jb 0x46eb3f
mov ecx, dword [esi + 8]
movq xmm0, qword [ebp - 0x1c]
sub esp, 0xc
mov dword [edx], ecx
lea ecx, [ebp - 0x54]
mov eax, dword [esi + 0x18]
mov dword [edx + 4], eax
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00419680
test bh, bh
je 0x46eb73
mov eax, dword [esi]
lea ecx, [ebp - 0x54]
push ecx
mov ecx, esi
call dword [eax + 8]
test bl, bl
je 0x46eb83
lea eax, [ebp - 0x54]
push eax
lea ecx, [esi + 0x60]
call fcn.0041d530
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test ecx, ecx
je 0x46eba9
cmp dword [edi + 0x18], 0
je 0x46eba9
cmp byte [edi + 4], 0
je 0x46eb83
push eax
mov ecx, edi
call fcn.0046efd0
xor esi, esi
push esi
mov ecx, edi
call fcn.0046dd90
test al, al
je 0x46eb83
inc esi
cmp esi, 8
jb 0x46ebb3
push 8
call fcn.004ff716
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x46ec21
push 8
call fcn.004ff716
add esp, 4
test eax, eax
je 0x46ebf8
mov dword [eax], edi
mov dword [eax + 4], 0x46ec90
jmp 0x46ebfa
xor eax, eax
mov dword [ebp - 0x10], eax
lea ebx, [esi + 4]
mov byte [ebp - 4], 1
push ebx
push 0
push eax
push 0x46cb10
push 0
push 0
call fcn.0050d0fd
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x46ec5a
jmp 0x46ec23
xor esi, esi
mov eax, dword [edi + 0x100]
mov dword [edi + 0x100], esi
test eax, eax
je 0x46ec44
cmp dword [eax + 4], 0
jne 0x46ec67
push 8
push eax
call fcn.004ff746
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 6
mov dword [ebx], 0
call fcn.00501800
call fcn.0050cf65
int3
Function at 0x46fce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5347cd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [edi]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x46fd27
or eax, 0xffffffff
or edx, eax
jmp 0x46fdfd
mov esi, dword [edi + 0xa0]
xorps xmm0, xmm0
add esi, 0x104c
mov ecx, edi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.004469b0
push esi
lea ecx, [ebp - 0x34]
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x46fdf2
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
push 0x20
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
movups xmmword [ebp - 0x2c], xmm0
call fcn.00408dc0
movups xmm0, xmmword [str.LocalSocket:_transmite_error]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0x1c
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x540b60]
movq qword [eax + 0x10], xmm0
mov ecx, dword [0x540b68]
mov dword [eax + 0x18], ecx
mov byte [eax + 0x1c], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], esi
push eax
call fcn.00446360
mov ecx, dword [ebp - 0x18]
add esp, 4
cmp ecx, 0x10
jb 0x46fdf2
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46fde8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46fe1a
push ecx
push edx
call fcn.004ff746
add esp, 8
or eax, 0xffffffff
test esi, esi
cmovne eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret 0xc
call fcn.00508363
int3
Function at 0x470690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5348d4
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x20], 0
je 0x47076a
cmp dword [esi + 0x1c], 0xffffffff
je 0x47076a
call fcn.00470910
test al, al
je 0x470820
push 8
call fcn.004ff716
mov edi, eax
add esp, 4
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 1
test edi, edi
je 0x47073c
push 8
call fcn.004ff716
add esp, 4
test eax, eax
je 0x47070c
mov dword [eax], esi
mov dword [eax + 4], esi
jmp 0x47070e
xor eax, eax
mov dword [ebp - 0x38], eax
lea ecx, [edi + 4]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x46fe20
push 0
push 0
mov dword [ebp - 0x30], ecx
call fcn.0050d0fd
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x47083b
jmp 0x47073e
xor edi, edi
mov eax, dword [esi + 0x1028]
mov dword [esi + 0x1028], edi
test eax, eax
je 0x470763
cmp dword [eax + 4], 0
jne 0x47084b
push 8
push eax
call fcn.004ff746
add esp, 8
mov al, 1
jmp 0x470820
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x40
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
movups xmmword [ebp - 0x28], xmm0
call fcn.00408dc0
movups xmm0, xmmword [str.WindowsPipeReader:_Incorrect_parameters__check_pipe_handle]
mov ecx, eax
mov dword [ebp - 0x18], 0x3a
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x540cb0]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x540cc0]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [0x540cd0]
movq qword [ecx + 0x30], xmm0
mov ax, word [0x540cd8]
mov word [ecx + 0x38], ax
mov byte [ecx + 0x3a], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00446360
mov ecx, dword [ebp - 0x14]
add esp, 4
mov byte [ebp - 0x29], al
cmp ecx, 0x10
jb 0x470820
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x470813
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x470850
push ecx
push edx
call fcn.004ff746
mov al, byte [ebp - 0x29]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
push 6
mov dword [eax], 0
call fcn.00501800
call fcn.0050cf65
call fcn.00508363
int3
Function at 0x470910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5326fd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x1024], 0
jne 0x4709f1
lea eax, [esi + 4]
push eax
push 0
push 0x1000
lea eax, [esi + 0x24]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x470a05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xe9
ja 0x4709f5
je 0x470985
sub eax, 0x6d
je 0x470985
sub eax, 0x7b
jne 0x47099a
mov eax, dword [esi]
mov byte [esi + 0x1024], 1
mov ecx, dword [eax + 0x6c]
test ecx, ecx
je 0x47099a
mov eax, dword [ecx]
call dword [eax + 8]
call fcn.0045aa70
mov esi, eax
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.00470b50
add esp, 8
push eax
push 0x1b
push str.Cannot_start_async_read:_
push 4
sub esp, 0xc
mov dword [ebp - 0x34], 0
mov eax, esp
mov dword [ebp - 0x30], 0
movq xmm0, qword [ebp - 0x34]
mov ecx, esi
mov dword [ebp - 4], 0
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00418350
lea ecx, [ebp - 0x28]
call fcn.004089c0
xor al, al
jmp 0x470a0b
sub eax, 0x3e3
je 0x470985
sub eax, 2
jne 0x47099a
mov al, 1
jmp 0x470a0b
cmp eax, 1
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret

Function at 0x4715e0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
pop ebp
jmp fcn.004715f0
Function at 0x471c30
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx + 4]
push str.Accept:_text_html_application_xhtmlxml_application_xml_q0.9___q0.8
push 0
call fcn.0047f2b0
push str.Content_Type:_application_json__charsetutf_8
push eax
call fcn.0047f2b0
push str.User_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_28.0.1500.71_Safari_537.36
push eax
call fcn.0047f2b0
push str.Connection:_close
push eax
call fcn.0047f2b0
push str.X_Action:_bulk
push eax
call fcn.0047f2b0
add esp, 0x28
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00471c90
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x474300
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8040
call fcn.004ff770
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x53e4d8
push eax
call fcn.00474050
mov edi, eax
push 0x5412ac
push esi
mov dword [ebp - 0x8008], edi
call fcn.00474050
add esp, 0x10
mov ebx, eax
test edi, edi
je 0x474565
test ebx, ebx
je 0x474565
push 0x8000
push edi
call fcn.0050f6f4
add esp, 4
push eax
call fcn.00513bb0
add esp, 8
push 0x8000
push ebx
call fcn.0050f6f4
add esp, 4
push eax
call fcn.00513bb0
push 0x38
lea eax, [ebp - 0x8040]
mov dword [ebp - 0x8020], 0
push str.1.2.11
push eax
mov dword [ebp - 0x801c], 0
mov dword [ebp - 0x8018], 0
mov dword [ebp - 0x803c], 0
mov dword [ebp - 0x8040], 0
call fcn.004fc5a0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4743f0
push edi
call fcn.0050d55b
push ebx
call fcn.0050d55b
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
push edi
push 0x4000
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.0050d7c5
push edi
mov dword [ebp - 0x803c], eax
call fcn.00513b1a
add esp, 0x14
test eax, eax
jne 0x474536
cmp dword [ebp - 0x803c], eax
je 0x4744ca
lea eax, [ebp - 0x4004]
mov dword [ebp - 0x8040], eax
nop dword [eax]
nop word [eax + eax]
lea eax, [ebp - 0x8004]
mov dword [ebp - 0x8030], 0x4000
mov dword [ebp - 0x8034], eax
lea eax, [ebp - 0x8040]
push 0
push eax
call fcn.004fab80
mov esi, eax
add esp, 8
cmp esi, 0xfffffffc
je 0x4744fd
cmp esi, 0xfffffffd
je 0x4744fd
cmp esi, 2
je 0x4744f8
mov edi, 0x4000
lea eax, [ebp - 0x8004]
sub edi, dword [ebp - 0x8030]
push ebx
push edi
push 1
push eax
call fcn.0050ede0
add esp, 0x10
cmp eax, edi
jne 0x474530
push ebx
call fcn.00513b1a
add esp, 4
test eax, eax
jne 0x474530
cmp dword [ebp - 0x8030], eax
je 0x474440
mov edi, dword [ebp - 0x8008]
cmp esi, 1
jne 0x4743f0
lea eax, [ebp - 0x8040]
push eax
call fcn.004fc3d0
push edi
call fcn.0050d55b
push ebx
call fcn.0050d55b
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
mov esi, 0xfffffffd
lea eax, [ebp - 0x8040]
push eax
call fcn.004fc3d0
push dword [ebp - 0x8008]
call fcn.0050d55b
push ebx
call fcn.0050d55b
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x8008]
lea eax, [ebp - 0x8040]
push eax
call fcn.004fc3d0
push edi
call fcn.0050d55b
push ebx
call fcn.0050d55b
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
push edi
call fcn.0050d55b
push ebx
call fcn.0050d55b
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
call fcn.004ff754
mov esp, ebp
pop ebp
ret
Function at 0x4746a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x53e4d8
push dword [ebp + 8]
xor esi, esi
call fcn.00474050
mov edi, eax
add esp, 8
test edi, edi
je 0x474723
push 2
push esi
push edi
call fcn.0050e5a3
add esp, 0xc
test eax, eax
jne 0x474723
push edi
call fcn.0050ebb6
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x474723
lea ecx, [esi + 1]
push ecx
call fcn.0050bafd
mov ebx, dword [ebp + 0xc]
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x474723
push 0
push 0
push edi
call fcn.0050e5a3
add esp, 0xc
test eax, eax
jne 0x474723
push edi
push esi
push 1
push dword [ebx]
call fcn.0050d7c5
add esp, 0x10
cmp eax, esi
jne 0x474723
push edi
call fcn.0050d55b
add esp, 4
test eax, eax
je 0x474735
push str.Couldnt_open_file_for_reading__n
push str.ERROR:__s
call fcn.00474740
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x474770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0x5412dc
push dword [ebp + 8]
call fcn.00474050
mov edi, eax
add esp, 8
test edi, edi
je 0x4747b6
push edi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0050ede0
mov ebx, eax
add esp, 0x10
cmp ebx, dword [ebp + 0x10]
jne 0x4747b6
push edi
call fcn.0050d55b
add esp, 4
test eax, eax
jne 0x4747b6
pop edi
mov eax, ebx
pop ebx
pop ebp
ret
push str.Couldnt_open_file_for_writing__n
push str.ERROR:__s
call fcn.00474740
add esp, 8
or eax, 0xffffffff
pop edi
pop ebx
pop ebp
ret
Function at 0x4878c0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x48799f
lea eax, [ebp - 0x18]
push eax
push edi
push 2
call fcn.004a1de0
add esp, 0xc
test eax, eax
jne 0x48799f
lea eax, [ebp - 0x14]
push eax
push edi
push 0x17
call fcn.004a1de0
add esp, 0xc
test eax, eax
jne 0x48799f
push ebx
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x487913
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.004a1db0
add esp, 0xc
test eax, eax
je 0x487947
sub eax, edi
push eax
push 0x2e
push edi
call fcn.004a1db0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x487949
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov ebx, 0x1505
lea eax, [esi + edi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x48798b
mov al, byte [edi]
push eax
call fcn.00496320
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
add esp, 4
shl eax, 5
add ebx, eax
mov eax, dword [ebp - 0x18]
inc eax
xor ebx, ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
jb 0x487966
pop esi
movzx eax, bl
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004ff754
mov esp, ebp
pop ebp
ret

Function at 0x488580
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [0x599158]
cmp eax, 0xffffffff
jne 0x4885c2
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4885a8
xor eax, eax
test eax, eax
mov dword [0x599158], eax
setg al
ret
push eax
push 0
mov dword [0x599158], 1
call fcn.00492000
mov eax, dword [0x599158]
add esp, 8
test eax, eax
setg al
ret

Function at 0x4885d0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2f0], 2
jne 0x488629
mov eax, dword [0x599158]
cmp eax, 0xffffffff
jne 0x488622
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x488608
xor eax, eax
test eax, eax
mov dword [0x599158], eax
setg al
pop ebp
ret
push eax
push 0
mov dword [0x599158], 1
call fcn.00492000
mov eax, dword [0x599158]
add esp, 8
test eax, eax
setg al
pop ebp
ret
mov al, 1
pop ebp
ret
Function at 0x491490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x608], 0
je 0x4914d4
push esi
push 1
push edi
call fcn.00483800
push dword [edi + 0x59c]
mov eax, dword [edi + 0x608]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00483800
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x49150a
push dword [edi + 0x598]
lea eax, [eax + eax*2]
push 1
add eax, 0x544798
push 2
push eax
call fcn.0050ede0
push dword [edi + 0x598]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0050ede0
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x491b20
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x599850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x8c], eax
xor eax, eax
push esi
mov esi, 0x1e4
mov ecx, dword [ebx + 0x1c4]
cmp edx, ecx
push edi
sete al
lea eax, [eax*4 + 0x1c0]
mov eax, dword [eax + ebx]
mov dword [ebp - 0x88], eax
mov eax, 0x1f4
cmove esi, eax
mov eax, dword [ebx + 0x2e8]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x491c2e
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1d4]
cmp dword [eax + ebx], 0x4917a0
jne 0x491c2e
cmp dword [esi], 0
je 0x491bb4
test edi, edi
je 0x491c2e
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x88]
call fcn.00494890
add esp, 0x14
cmp eax, 0xffffffff
je 0x491c2e
test al, 1
je 0x491c2e
mov ecx, dword [esi]
test ecx, ecx
jne 0x491c09
mov eax, dword [ebx]
mov eax, dword [eax + 0x8fc]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x599144]
mov edi, dword [esi + 4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x491c27
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push dword [ebp - 0x88]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x491c2e
add dword [esi + 8], eax
jmp 0x491c2e
mov dword [esi + 4], 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x90]
push dword [ebp - 0x88]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x491cad
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x491c7c
mov ecx, dword [ebp - 0x8c]
lea eax, [edi + 0x52]
pop edi
pop esi
pop ebx
mov dword [ecx], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff754
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0047fa40
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.00491510
mov eax, dword [ebx]
add esp, 0x18
mov dword [eax + 0xcec], esi
mov eax, 0x37
jmp 0x491caf
xor eax, eax
mov ecx, dword [ebp - 0x8c]
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff754
mov esp, ebp
pop ebp
ret
Function at 0x493e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x544c10
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x493e20
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x544c1c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x544c2c
push esi
mov dword [ebp - 8], ebx
call fcn.0051609e
add esp, 8
test eax, eax
je 0x493e6c
test ebx, ebx
je 0x493e5c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x493e95
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x493e95
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x493f40
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493eb1
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x599144]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x493f36
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x493f36
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493ee2
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x493f00
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x493f10
mov eax, dword [ebp - 8]
test eax, eax
je 0x493f2d
push 8
push 0
push ebx
call eax
jmp 0x493f34
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x599148]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret