joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f4cb
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x43f4df
xor eax, eax
jmp 0x43f61d
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x43f508
dec edx
sub edx, 1
jne 0x43f50a
add eax, 2
jmp 0x43f50a
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x43f51d
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x43f61c
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x43f5b3
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x5ad9b0]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x5ad9b0]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x5ad9b0]
mov byte [edi + 2], al
mov al, byte [esi + 0x5ad9b0]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x43f548
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x43f5b6
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x43f60f
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x43f5cb
movzx ecx, byte [eax + 1]
jmp 0x43f5cd
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x5ad9b0]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x5ad9b0]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x43f604
and ecx, 0xf
mov al, byte [ecx*4 + 0x5ad9b0]
mov byte [edi + 2], al
jmp 0x43f608
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f7e5
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5ada80
call fcn.00454a97
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00455382
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.004463a0
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.004463a0
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.004463a0
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43f8e3
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.00409dd0
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00407060
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4

Function at 0x4409d9
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x89], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x44129c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [eax + 0x210]
mov dword [ebp - 8], eax
mov esi, dword [ecx]
push edi
mov dword [ebp - 0xc], ecx
cmp esi, dword [eax + 0x214]
je 0x44136a
lea edi, [esi + 0x28]
mov dword [ebp + 8], edi
lea ecx, [ebx + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a9aa4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a9aa4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a9aa4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a9aa4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.004554e0
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x44134a
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.004554e0
pop ecx
pop ecx
test eax, eax
je 0x441366
mov eax, 0x1b0
add edi, eax
add esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
je 0x44136a
jmp 0x4412ce
mov byte [ebp - 1], 1
call fcn.004259be
test al, al
je 0x441383
sar eax, cl
cmpsb byte [esi], byte es:[edi]
lcall 0x9c06, 0xc898a1b8
mov al, cl
movsb byte es:[edi], byte [esi]
invalid
cmp byte [ebp - 1], 0
jne 0x4413a7
lea edx, [ebx + 0xa8]
push edx
call fcn.00454b10
pop ecx
test eax, eax
je 0x4413a7
mov ecx, dword [ebp - 0xc]
push ebx
call fcn.004420da
mov al, 1
jmp 0x4413a9
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441fa7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x210]
push ebx
push esi
push edi
mov dword [ebp - 0x11c], ecx
mov dword [ecx + 0x214], eax
call fcn.00425d3f
test al, al
je 0x441fec
push edx
ret
call fcn.00425b5c
test al, al
je 0x442013
inc edi
sti
cmp ch, cl
mov bl, byte [edx + 5]
cmc
jo 0x442068
mov ch, bl
invalid
call fcn.00425c2b
test al, al
je 0x44203b
jg 0x442061
pop edx
add dword [ecx + 0x63], eax
push ebx
xchg edx, eax
retf
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
adc eax, sym.imp.KERNEL32.dll_GetVersionExW
cmp dword [ebp - 0x108], 2
mov esi, dword [ebp - 0x11c]
jne 0x44207e
clc
invalid
mov ecx, esi
call fcn.00441867
jmp 0x442093
mov edi, ebx
test ebx, ebx
jne 0x442093
mov ecx, esi
call fcn.004416be
inc edi
mov ebx, eax
cmp edi, 0xa
jl 0x442080
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret

Function at 0x442540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.00443880
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.00443830
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.004438d0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x44257c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x4425d0
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x4425c0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4425c0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x4427e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a64a6
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x44283a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x442857
mov eax, dword [esi + 0x20]
jmp 0x44285a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x442874
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x44288e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4428a8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.00449ca1
push eax
call fcn.004553e6
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004463a0
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x442967
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x442958
test eax, eax
je 0x442958
add eax, eax
cmp eax, 0x412
jae 0x442953
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x44295e
call fcn.0043bb12
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.004038f0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x442993
cmp dword [esi + 0x34], 8
jb 0x442979
mov ecx, dword [esi + 0x20]
jmp 0x44297c
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x442993
push 1
push 0x5a7cc8
lea ecx, [esi + 0x20]
call fcn.00405220
cmp dword [esi + 0x30], 0
jne 0x4429a8
push 3
push 0x5ada80
lea ecx, [esi + 0x20]
call fcn.00402100
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x4429d0
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x4429ec
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x4429e5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x442a09
push eax
call fcn.0043ae6f
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x442a1f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402250
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x442a35
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x442a50
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402250
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x442a66
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x442a81
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402250
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x442a97
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x442ab2
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402250
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x442ac8
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x442ae2
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00402250
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x442b01
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x444160
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x44419e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x44419e
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x45d851
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045d6d0

Function at 0x45fe80
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fb40
Function at 0x46a150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x46a17c
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x46a16d
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x46a1b0
cmp dword [esi + 8], 0
jne 0x46a1a0
push 0x5a9ab0
push dword [eax + 8]
call fcn.00453558
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x46a1a0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00453a0a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x46a1d2
mov eax, dword [esi + 8]
test eax, eax
je 0x46a1cc
push eax
call fcn.0045333f
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x46a5f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x46a640
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x46a63a
shr eax, 8
cmp al, 2
jne 0x46a63a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x46b6a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047c480

Function at 0x46c6c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x168]
call fcn.0046c9a0
add esp, 8
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x46c744
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x46c71c
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0x51
xor eax, eax
pop ebp
ret
push esi
push edi
call fcn.0046a740
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.0046c380
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x85b8], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x46c9a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, edx
push ebx
push esi
shl eax, 4
lea esi, [ecx + 0x18c]
mov ebx, dword [ecx + edx*4 + 0x168]
add esi, eax
mov eax, dword [ecx + 0x248]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x46ca50
cmp dword [ecx + edx*4 + 0x17c], 0x46c610
jne 0x46ca50
cmp dword [esi], 0
je 0x46c9e8
test edi, edi
je 0x46ca50
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.0047aa50
add esp, 0x10
cmp eax, 0xffffffff
je 0x46ca50
test al, 1
je 0x46ca50
cmp dword [esi], 0
jne 0x46ca39
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x62eb24]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x46ca39
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x46ca50
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x46ca60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x46ca89
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x46cabf
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x5b6460
push 2
push eax
call fcn.004549db
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004549db
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x472a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x472a4e
cmp dword [esi + 0x48], 0
je 0x472a4e
push 2
push 3
push esi
call fcn.004804d0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00480ca0
add esp, 4
test esi, esi
je 0x472a6e
cmp dword [esi + 0x48], 0
je 0x472a6e
push 3
push esi
call fcn.00480510
add esp, 8
pop esi
pop ebp
ret
Function at 0x47afa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x578]
test esi, esi
je 0x47aff4
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x47afc1
cmp dword [edi + 0x40], eax
je 0x47aff4
mov dword [ebp - 8], esi
mov byte [ebp - 4], 0
test eax, eax
jne 0x47afcf
mov eax, dword [edi + 0x40]
push 0x47bde0
lea ecx, [ebp - 8]
add eax, 0x68
push ecx
push eax
call fcn.004856d0
add esp, 0xc
cmp byte [ebp - 4], 0
jne 0x47affd
mov dword [edi + 0x578], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x47b006
mov dword [eax], esi
cmp byte [esi + 0x1ac], 0
mov edi, dword [esi + 0x168]
je 0x47b02b
push esi
call fcn.0046b6a0
add esp, 4
test eax, eax
jne 0x47b043
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
je 0x47b043
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x47aff4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47b490
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x634928]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x47b4e1
push 3
push 2
push eax
push 6
call fcn.0049aaf0
add esp, 0x10
test al, al
je 0x47b4d5
mov dword [0x634928], 2
mov esp, ebp
pop ebp
ret
mov dword [0x634928], 1
jmp 0x47b4e6
cmp eax, 2
je 0x47b526
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x47b50d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x47b526
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret

Function at 0x47b5f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x47b638
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0046a740
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0046c420
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0046c420
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x47b720
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x47b8fa
cmp byte [edi + 0x21a], 0
push esi
jne 0x47b8f0
cmp byte [edi + 0x234], 0
jne 0x47b8f0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x47b7b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0046a740
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.0046c380
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push 0
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x47b821
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0046a740
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.0046c380
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xfc]
push eax
lea esi, [edi + 0xcc]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0047be00
add esp, 0xc
test al, al
jne 0x47b872
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0046a740
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0046c380
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x130]
push eax
lea eax, [edi + 0x100]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0047be00
add esp, 0xc
test al, al
jne 0x47b8f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0046a740
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.0046c380
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
push edi
call fcn.0047b3d0
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret