joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4270a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x427236
push edi
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x427218
push esi
cmp dword [edi + 4], 2
jne 0x42719c
cmp dword [edi + 0x18], ebx
je 0x42719c
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x42719c
cmp eax, 0x10
jb 0x42719c
push 0x20
call dword [0x5e205c]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4271a9
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x5e205c]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x4271b2
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x427187
push eax
call dword [0x5e2068]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x4271c5
cmp dword [ebp - 4], ebx
jne 0x42718f
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x427199
mov dword [eax + 0x1c], esi
mov dword [ebp - 0xc], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x4270e2
jmp 0x4271e0
mov dword [ebp - 8], 8
jmp 0x4271e0
push esi
mov dword [ebp - 8], 8
call dword [0x5e2060]
add esp, 4
jmp 0x4271e0
mov edx, dword [esi + 0x18]
push edx
mov dword [ebp - 8], 8
call dword [0x5e2060]
push esi
call dword [0x5e2060]
add esp, 8
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, ebx
je 0x4271ef
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], ebx
je 0x427213
mov eax, dword [ebp - 4]
push eax
call fcn.00427060
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, ebx
pop edi
mov dword [ebp - 4], ebx
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], ebx
jne 0x42722a
push 0x2af9
mov dword [ebp - 8], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [edx], ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.005573e8
add esp, 0x18
test eax, eax
je 0x428964
cmp eax, 0xffffffff
jne 0x428966
xor eax, eax
pop ebp
ret
Function at 0x42e690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ee860
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.00562923
add esp, 0x10
pop ebp
ret
Function at 0x435fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x58c41c
push ecx
call fcn.0041a580
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.004350f0
test eax, eax
jne 0x436014
mov eax, esi
pop ebp
jmp fcn.00435580
pop ebp
ret
Function at 0x436410
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
mov esi, dword [eax + 0x518]
push edi
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4364a4
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.0054fa00
mov edx, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x4364d7
push str.Received_too_short_packet
push ebx
call fcn.0041a600
add esp, 8
mov dword [esi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x15c]
call fcn.004352a0
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x4364f4
jmp dword [eax*4 + 0x436630]
cmp edx, 4
jle case.0x4364f4.4
lea eax, [esi + 0x15c]
call fcn.004352b0
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne case.0x4364f4.4
mov eax, dword [ebp - 0x8c]
add edx, 0xfffffffc
push edx
mov edx, dword [esi + 0x15c]
add edx, 4
push edx
push 1
push eax
call fcn.0041a9b0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x436561
mov ecx, 5
mov eax, esi
call fcn.00436390
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
mov ecx, dword [ebx + 0x94]
mov edx, dword [ebx + 0x90]
push ecx
push edx
push ebx
call fcn.0042d840
jmp 0x4365f1
lea eax, [esi + 0x15c]
call fcn.004352b0
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
movzx eax, ax
push 0x58c41c
push ebx
mov dword [esi + 8], eax
call fcn.0041a580
jmp 0x4365f1
add edx, 0xfffffffe
push edx
mov edx, dword [esi + 0x15c]
add edx, 2
push edx
push esi
call fcn.00435340
add esp, 0xc
test eax, eax
je case.0x4364f4.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x5d22f4
push ebx
call fcn.0041a600
add esp, 0xc
mov eax, dword [ebp - 0x8c]
push eax
call fcn.0042da20
add esp, 4
test eax, eax
je 0x4364c4
mov ecx, 5
mov eax, esi
call fcn.00436390
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x2a
pop ebx
call fcn.00550759
mov esp, ebp
pop ebp
ret
Function at 0x438040
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x438088
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.0041a600
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4380af
shr eax, 8
test al, al
jne 0x4380af
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.0041a600
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
mov eax, 2
call fcn.00550759
mov esp, ebp
pop ebp
ret

Function at 0x438240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edi + 0x198]
push ebx
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [ebp - 4]
mov ebx, eax
mov al, byte [ebp + 8]
push ecx
push edx
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], al
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x438285
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0041a600
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ebx
mov ebx, str.SENT
call fcn.00438140
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439050
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
mov edi, dword [eax + 0x144]
mov dword [ebp - 4], eax
jne 0x4391a1
push ebx
push esi
lea ebx, [edi + 0x1cb0]
lea esi, [edi + 0x1eb0]
mov dword [esi], ebx
cmp ebx, esi
jae 0x439086
mov byte [ebx], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x439091
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x43909c
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [edi + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
movzx eax, word [edi + 0x1caa]
push eax
mov dword [ebp + 0xc], edx
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x4390ce
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4390db
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4390e5
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4390ef
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4390fa
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x439105
mov byte [eax], 0xf0
inc dword [esi]
mov eax, dword [esi]
mov dword [edi + 0x1eb4], eax
sub eax, ebx
sub eax, 2
push eax
mov dword [esi], ebx
mov esi, dword [ebp - 4]
lea eax, [edi + 0x1cb2]
push 0x3e
call fcn.004385b0
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 8
push 0
push 3
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x198]
push edx
call esi
test eax, eax
jns 0x43915b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.0041a600
add esp, 0xc
lea ecx, [edi + 0x1cb3]
push ecx
mov eax, 4
call fcn.00438eb0
mov edx, dword [ebx + 0x198]
add esp, 4
push 0
push 2
add edi, 0x1cb7
push edi
push edx
call esi
pop esi
pop ebx
test eax, eax
jns 0x4391a1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.0041a600
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x439bc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 0x19c]
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x439c15
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.0041d550
add esp, 8
cmp edi, 0xffffffff
jne 0x439c4b
mov edx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push edx
call fcn.0041a600
add esp, 8
pop edi
pop esi
mov eax, 0x1e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push ebx
call fcn.0041a580
push 1
push edi
mov dword [esi + 0x2d0], 0
mov dword [esi + 0x19c], edi
call fcn.004484e0
mov dword [esi + 0x1ac], 1
mov eax, dword [ebx + 0x1c8]
add esp, 0x10
test eax, eax
je 0x439cb6
mov ecx, dword [ebx + 0x1cc]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x439cb6
call fcn.00439af0
pop edi
pop esi
mov eax, 0x2a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00550759
mov esp, ebp
pop ebp
ret
Function at 0x43d430
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x43d464
push str.Couldnt_set_desired_mode
push ebx
call fcn.0041a600
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x43d47b
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0041a580
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x43d492
push edi
call fcn.0043d3c0
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x43d4a6
push edi
call fcn.0043a770
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x43d4b8
mov eax, edi
call fcn.0043d410
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x43d4c6
mov eax, edi
call fcn.0043d420
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x444740
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00555f83
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4447a4
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4447a4
lea edx, [ebp - 0x108]
push edx
call dword [0x5e2068]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00550759
mov esp, ebp
pop ebp
ret

Function at 0x4447c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00444740

Function at 0x4483a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.kernel32
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4483c4
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [ebp + 8]
mov edi, eax
push 0x59505c
push ebx
mov dword [ebp - 8], edi
call fcn.00557e2e
add esp, 8
test eax, eax
je 0x448412
test edi, edi
je 0x448401
push 8
push 0
push ebx
call edi
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x44843a
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44843a
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x4484d6
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448453
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x5e205c]
mov esi, eax
add esp, 4
test esi, esi
je 0x4484cc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4484cc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448481
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448498
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4484a8
mov eax, dword [ebp - 8]
test eax, eax
je 0x4484c2
push 8
push 0
push esi
call eax
jmp 0x4484c9
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
push esi
call dword [0x5e2060]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44b410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.00551a10
mov eax, dword [0x5ea6f0]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x44b457
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00550759
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.00557f0f
add esp, 8
test eax, eax
js 0x44b440
mov eax, 8
call fcn.00551a10
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004207b0
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x44b440
push 0x58b430
push esi
call fcn.00551f32
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x44b531
jmp 0x44b4b4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x44b4c2
mov esi, ebx
cmp ebx, 0x400
jl 0x44b4c7
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.00552151
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x44b515
fild dword [esp + 0x44]
mov eax, 8
call fcn.00551a10
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004207b0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x44b4b0
sub ebx, esi
test ebx, ebx
jg 0x44b4b0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00551d87
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004cd6d0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00550759
mov esp, ebp
pop ebp
ret

Function at 0x45e8e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebx + 0x204]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x45e901
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0041a010
push edx
push eax
call fcn.0041a040
mov ecx, eax
mov eax, esi
mov dword [ebp + 8], edx
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov esi, edx
sbb esi, dword [ebp + 8]
cmp dword [ebx + 0x1f8], 0
je 0x45e96d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18c]
mov eax, dword [eax + 0x188]
push edx
push eax
call fcn.0041a010
push edx
push eax
call fcn.0041a040
mov ecx, eax
mov eax, dword [ebx + 0x1f8]
mov dword [ebp + 8], edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, dword [ebp + 8]
cmp esi, edx
jl 0x45e96d
jg 0x45e971
cmp edi, eax
jae 0x45e971
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45fa50
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x45fa83
push 0x2e
push esi
call fcn.00554fb0
add esp, 8
test eax, eax
je 0x45fa81
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x462f30
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x462f52
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x462f46
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x462f82
cmp dword [esi + 8], 0
jne 0x462f75
mov ecx, dword [eax + 8]
push 0x58b430
push ecx
call fcn.00551f32
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x462f75
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.00552151
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x462fa4
mov eax, dword [esi + 8]
test eax, eax
je 0x462f9e
push eax
call fcn.00551d87
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x481530
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + 0x20]
cmp dword [esi], 6
je 0x481547
call fcn.00480ef0
test eax, eax
jle 0x481590
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push ebx
mov esi, eax
call fcn.00404a20
add esp, 8
test esi, esi
jg 0x48158e
push esi
call fcn.00465fe0
add esp, 4
test eax, eax
je 0x48158e
push 0xa
push ebx
call fcn.00404a40
add esp, 8
mov eax, esi
pop esi
pop ebx
ret

Function at 0x48bcf0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00550bc0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x48c600
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5e205c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x48c62b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x48c672
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x48c675
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x48c6d6
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x48c6a0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x48c70f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x5b3f04
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x5b3f05
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x48c6e0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48d6d0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.00550bc0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret