joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aae90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax + 8]
push edi
test eax, eax
je 0x4aaeb3
push eax
call fcn.004bbad0
add esp, 4
mov byte [ebp + 0xb], 1
test al, al
jne 0x4aaeb7
mov byte [ebp + 0xb], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x18]
xor ebx, ebx
cmp ecx, dword [esi + 0xa8]
mov dword [edx], 0
sete bl
cmp byte [ebp + 0xb], 0
je 0x4aaf32
mov ecx, dword [esi + 0x174]
mov edi, dword [esi + 0x178]
mov eax, dword [ebp + 0x14]
sub edi, ecx
cmp edi, eax
jb 0x4aaeeb
mov edi, eax
test edi, edi
je 0x4aaf1e
mov eax, dword [esi + 0x170]
add eax, ecx
mov ecx, dword [ebp + 0x10]
push edi
push eax
push ecx
call fcn.005905c0
add dword [esi + 0x174], edi
mov edx, dword [ebp + 0x18]
add esp, 0xc
mov byte [esi + 0x12c], 0
mov dword [edx], edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 0x4000
jb 0x4aaf2a
mov eax, 0x4000
mov ecx, dword [esi + 0x170]
jmp 0x4aaf5c
mov eax, dword [esi]
mov eax, dword [eax + 0x22c]
mov ecx, eax
test eax, eax
jne 0x4aaf45
mov ecx, 0x4000
mov edx, dword [ebp + 0x14]
cmp edx, ecx
jge 0x4aaf50
mov eax, edx
jmp 0x4aaf59
test eax, eax
jne 0x4aaf59
mov eax, 0x4000
mov ecx, dword [ebp + 0x10]
lea edx, [ebx + ebx*2]
cmp dword [esi + edx*8 + 0xb0], 2
jne 0x4aaf83
push eax
push ecx
push ebx
push esi
call fcn.004a2060
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
jne 0x4aafb6
pop edi
pop esi
or eax, eax
pop ebx
pop ebp
ret
cmp dword [esi + 0x15c], 0
jne 0x4aafa1
push 0
push eax
mov eax, dword [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4aafb6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4aafe5
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
test edi, edi
js 0x4aafe5
cmp byte [ebp + 0xb], 0
je 0x4aafe0
mov ecx, dword [esi + 0x170]
mov edx, dword [ebp + 0x10]
push edi
push ecx
push edx
call fcn.005905c0
add esp, 0xc
mov dword [esi + 0x178], edi
mov dword [esi + 0x174], edi
mov eax, dword [ebp + 0x18]
add dword [eax], edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4aaff0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esi + 0x140]
test eax, eax
je 0x4ab00b
mov edx, dword [esi + 0xe4]
push edx
push edi
push ebx
push ecx
push esi
call eax
add esp, 0x14
ret
test ecx, ecx
js 0x4ab03f
cmp ecx, 2
jg 0x4ab03f
mov eax, dword [esi + 0xe0]
mov ecx, dword [ecx*4 + 0x691b88]
push eax
push 1
push 2
push ecx
call fcn.0058ed44
mov edx, dword [esi + 0xe0]
push edx
push 1
push edi
push ebx
call fcn.0058ed44
add esp, 0x20
xor eax, eax
ret

Function at 0x4ab250
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [edi + eax*4 + 0xa4]
push esi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ab295
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4ab27b
xor eax, eax
pop esi
ret
push eax
push edi
call fcn.004c1590
push eax
mov eax, dword [edi]
push str.Send_failure:__s
push eax
call fcn.004ab1b0
add esp, 0x14
mov eax, esi
pop esi
ret
Function at 0x4abb40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
movzx eax, byte [esi + 0x27a]
push 4
lea ecx, [ebp - 4]
push ecx
push 1
push 6
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4abb87
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004c1590
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004ab130
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004ab130
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4abfc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x448]
cmp eax, 0xffffffff
je 0x4ac031
mov ecx, dword [ecx + 0x43c]
mov edx, dword [ecx]
cmp dword [edx + eax*4], 0
lea eax, [edx + eax*4]
je 0x4ac031
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax]
test ecx, ecx
je 0x4abfed
mov dword [ecx], eax
mov ecx, dword [eax + 0xa4]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi], ecx
cmp byte [eax + 0xac], 0
je 0x4ac01a
push eax
call fcn.004a2100
add esp, 4
test eax, eax
jne 0x4ac015
mov dword [esi], 0xffffffff
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [eax + 0xa4]
push 2
push 1
lea edx, [ebp + 0xb]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x4ac00b
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
xor eax, eax
pop ebp
ret
Function at 0x4b0650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 1
push 0x24
call dword [0x75f010]
xor ebx, ebx
mov esi, eax
add esp, 8
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp esi, ebx
je 0x4b06a4
lea eax, [edi + 0x2ac]
mov dword [ebp - 4], eax
mov eax, dword [eax]
push eax
call fcn.004a2820
mov ecx, dword [ebp + 8]
push ecx
call dword [0x75f00c]
mov edx, dword [ebp - 4]
add esp, 8
mov dword [edx], eax
cmp eax, ebx
jne 0x4b06b4
push esi
call dword [0x75f004]
add esp, 4
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push ebx
push 1
mov dword [edi + 0x2b0], eax
mov byte [edi + 0x2b8], bl
mov dword [edi + 0x2bc], ebx
mov dword [edi + 0x2b4], ebx
mov dword [edi + 0x2c0], esi
push ebx
mov dword [esi + 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x10], eax
cmp eax, ebx
jne 0x4b0709
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b0570
add esp, 4
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x4b0721
mov edx, dword [ebp - 4]
push edx
jmp 0x4b06f1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x1c], eax
cmp eax, ebx
jne 0x4b0737
mov eax, dword [ebp - 4]
push eax
jmp 0x4b06f1
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x20], eax
cmp eax, ebx
je 0x4b06ed
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x4b071b
lea eax, [esi + 4]
push eax
push ebx
push edi
push 0x4b04a0
push ebx
push ebx
call fcn.0058e2b3
add esp, 0x18
mov dword [esi], eax
cmp eax, ebx
jne 0x4b0798
call fcn.0059272f
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp - 4]
push edx
call fcn.004b0570
add esp, 4
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
push ecx
push 2
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push ebx
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xc], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b07d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x174]
mov esi, dword [edi + 0x2c0]
mov dword [ebp + 8], ecx
test eax, eax
jne 0x4b07fc
mov eax, dword [ecx + 0x170]
test eax, eax
jne 0x4b07fc
mov eax, 0x493e0
push ebx
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x10]
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x14]
push eax
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x4b0859
mov ecx, dword [esi]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4b08ac
mov edx, dword [esi]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ebx, [esi + 8]
mov byte [edi + 0x2b8], 1
mov dword [ebx], 0xffffffff
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4b0878
mov edx, dword [edi + 0x2b4]
mov dword [eax], edx
xor esi, esi
cmp dword [edi + 0x2b4], esi
jne 0x4b0951
mov ebx, dword [ebx]
cmp ebx, 0x1b
jne 0x4b08c8
push ebx
mov esi, ebx
call fcn.004c0b50
push eax
mov eax, dword [ebp + 8]
push str.Could_not_resolve_host:__s
push eax
call fcn.004ab1b0
add esp, 0x10
jmp 0x4b0951
mov eax, dword [edi + 0x2bc]
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esi]
lea ebx, [esi + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x4b0869
cmp byte [edi + 0x2b8], 0
je 0x4b0926
cmp byte [edi + 0x11b], 0
mov ecx, dword [edi + 0x2bc]
push ecx
push edi
je 0x4b0904
call fcn.004c1590
mov edx, dword [edi + 0x74]
push eax
mov eax, dword [ebp + 8]
push edx
push str.Could_not_resolve_proxy:__s___s
push eax
call fcn.004ab1b0
add esp, 0x18
mov esi, 5
jmp 0x4b0951
call fcn.004c1590
mov edx, dword [edi + 0x60]
push eax
mov eax, dword [ebp + 8]
push edx
push str.Could_not_resolve_host:__s___s
push eax
call fcn.004ab1b0
add esp, 0x18
mov esi, 6
jmp 0x4b0951
cmp ebx, 0xffffffff
je 0x4b0937
cmp dword [edi + 0x2bc], 0x2afc
jne 0x4b094c
mov ecx, dword [edi + 0x60]
mov edx, dword [ebp + 8]
push ecx
push str.Resolving_host_timed_out:__s
push edx
call fcn.004ab1b0
add esp, 0xc
mov esi, 0x1c
lea eax, [edi + 0x2ac]
push eax
call fcn.004b0570
add esp, 4
cmp dword [edi + 0x2b4], 0
pop ebx
mov eax, esi
jne 0x4b0973
mov byte [edi + 0x118], 1
pop edi
pop esi
pop ebp
ret
Function at 0x4b0a20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi]
push esi
mov dword [eax], 0
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4b0a56
mov ecx, dword [ebp + 0x10]
push ecx
push esi
push eax
call fcn.004a2750
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
push edx
push esi
call fcn.004b0650
add esp, 8
test al, al
je 0x4b0a77
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], 1
xor eax, eax
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.004c1590
push eax
push esi
push str.init_resolve_thread___failed_for__s___s_n
push ebx
call fcn.004ab130
add esp, 0x18
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4b0ac7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004c1590
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push esi
push str.gethostbyname_2__failed_for__s:_d___s_n
push ebx
call fcn.004ab130
add esp, 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
push edx
push eax
call fcn.004a2490
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b0cd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0xc]
push ebx
mov ebx, dword [eax]
mov eax, dword [ebp + 8]
sub eax, 3
push edi
je 0x4b0d8d
sub eax, 2
je 0x4b0d2e
dec eax
je 0x4b0d0a
push str.tftp_rx:_internal_error
push 0x690c2c
push ebx
call fcn.004ab1b0
add esp, 0xc
pop edi
mov eax, 0x47
pop ebx
pop ebp
ret
inc dword [esi + 0x14]
mov eax, dword [esi + 0x14]
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.004ab130
mov ecx, dword [esi + 0x14]
add esp, 0xc
cmp ecx, dword [esi + 0x1c]
jle 0x4b0d3a
mov dword [esi + 8], 0xffffff9d
pop edi
mov dword [esi], 3
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [esi + 0x138]
push edx
mov edx, dword [esi + 0x10]
lea eax, [esi + 0xb8]
push eax
push 0
push 4
lea ecx, [esi + 0x348]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x4b0e5d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [esi + 0xc]
push eax
call fcn.004c1590
push eax
push 0x690c2c
push ebx
call fcn.004ab1b0
add esp, 0x14
pop edi
mov eax, 0x37
pop ebx
pop ebp
ret
lea ecx, [esi + 0x144]
call fcn.004b0cc0
movzx ecx, word [esi + 0x30]
movzx edi, ax
inc ecx
cmp ecx, edi
je 0x4b0ddb
push edi
push str.Received_unexpected_DATA_packet_block__d_n
push ebx
call fcn.004ab130
inc dword [esi + 0x14]
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp eax, dword [esi + 0x1c]
jle 0x4b0ddb
movzx edx, word [esi + 0x30]
inc edx
push edx
push str.tftp_rx:_giving_up_waiting_for_block__d
push ebx
call fcn.004ab1b0
add esp, 0xc
pop edi
mov eax, 0x47
pop ebx
pop ebp
ret
lea ecx, [esi + 0x348]
mov eax, 4
mov word [esi + 0x30], di
mov dword [esi + 0x14], 0
call fcn.004b0c90
mov ax, word [esi + 0x30]
call fcn.004b0ca0
mov eax, dword [esi + 0x138]
push eax
mov eax, dword [esi + 0x10]
lea edx, [esi + 0xb8]
push edx
push 0
push 4
push ecx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x4b0e48
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.004c1590
push eax
push 0x690c2c
push ebx
call fcn.004ab1b0
add esp, 0x14
pop edi
mov eax, 0x37
pop ebx
pop ebp
ret
xor edx, edx
cmp dword [esi + 0x13c], 0x204
setl dl
lea edx, [edx + edx + 1]
mov dword [esi], edx
pop edi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4b1460
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
mov ecx, dword [esi]
push edi
xor edi, edi
cmp ecx, 3
ja case.default.0x4b1472
jmp dword [ecx*4 + 0x4b14d0]
pop edi
mov ecx, esi
pop esi
jmp fcn.004b1230
push eax
call fcn.004b0cd0
add esp, 4
pop edi
pop esi
ret
push eax
call fcn.004b0e70
add esp, 4
pop edi
pop esi
ret
push str.TFTP_finished
push 0x691aec
push edx
call fcn.004ab130
add esp, 0xc
mov eax, edi
pop edi
pop esi
ret
push str.Internal_state_machine_error
push 0x690c2c
push edx
call fcn.004ab1b0
add esp, 0xc
pop edi
mov eax, 0x47
pop esi
ret
Function at 0x4b2e70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x76c12c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4b2eb8
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.004ab1b0
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058cf08
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4b2edf
shr eax, 8
test al, al
jne 0x4b2edf
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058cf08
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.004ab1b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
mov eax, 2
call fcn.0058cf08
mov esp, ebp
pop ebp
ret

Function at 0x4b3060
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edi + 0xa4]
push ebx
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [ebp - 4]
mov ebx, eax
mov al, byte [ebp + 8]
push ecx
push edx
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], al
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4b30a5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004ab1b0
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ebx
mov ebx, str.SENT
call fcn.004b2f60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4520
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x76c12c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [esi]
push edi
mov edi, dword [esi + 0xa8]
push 1
push 0
push esi
mov dword [ebp - 0x1c], ebx
call fcn.004ab5b0
add esp, 0xc
test eax, eax
jns 0x4b4571
push str.Timed_out_before_server_could_connect_to_us
push ebx
call fcn.004ab1b0
add esp, 8
pop edi
mov eax, 0x1c
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058cf08
mov esp, ebp
pop ebp
ret
push eax
push 0xffffffffffffffff
push edi
call fcn.004bb350
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b460e
test eax, eax
je 0x4b4607
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edi
or ebx, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4b45bf
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp ebx, 0xffffffff
jne 0x4b45d6
mov ecx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push ecx
jmp 0x4b4614
mov edx, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push edx
call fcn.004ab130
push 1
push ebx
mov dword [esi + 0xa8], ebx
call fcn.004ab660
add esp, 0x10
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058cf08
mov esp, ebp
pop ebp
ret
push str.Timeout_while_waiting_for_server_connect
jmp 0x4b4613
push str.Error_while_waiting_for_server_connect
push ebx
call fcn.004ab1b0
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
xor ecx, ebp
mov eax, 0x1e
pop ebx
call fcn.0058cf08
mov esp, ebp
pop ebp
ret
Function at 0x4b6680
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
push edi
mov edi, dword [ebx]
cmp eax, 2
je 0x4b66b8
push str.Couldnt_set_desired_mode
push edi
call fcn.004ab1b0
add esp, 8
pop edi
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x4b66cf
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edi
call fcn.004ab130
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x11
jne 0x4b66e5
mov eax, ebx
call fcn.004b5da0
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x12
jne 0x4b66f6
call fcn.004b5df0
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x13
jne 0x4b6709
mov eax, ebx
call fcn.004b4bb0
pop edi
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x4b6717
mov eax, ebx
call fcn.004b4bc0
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4bd7a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [eax], 0
call fcn.004be520
mov ecx, dword [esi + 0xa0]
push ecx
mov ecx, dword [esi + 0x9c]
push ecx
push edx
push eax
call fcn.004be550
add esp, 0x10
cmp eax, ebx
jg 0x4bd845
lea ebx, [ebx]
mov edx, ebx
sub edx, eax
mov eax, dword [ebp + 8]
push edx
push 0xffffffffffffffff
push eax
call fcn.004bb350
add esp, 0xc
test eax, eax
jle 0x4bd845
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
push esi
call fcn.004aae90
add esp, 0x14
test eax, eax
jne 0x4bd848
mov eax, dword [ebp - 8]
cmp edi, eax
je 0x4bd84d
test eax, eax
je 0x4bd845
add dword [ebp + 0xc], eax
add dword [ebp - 4], eax
sub edi, eax
call fcn.004be520
mov ecx, dword [esi + 0xa0]
push ecx
mov ecx, dword [esi + 0x9c]
push ecx
push edx
push eax
call fcn.004be550
add esp, 0x10
cmp eax, ebx
jle 0x4bd7e0
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4be640
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x76c12c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00593753
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4be6a4
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4be6a4
lea edx, [ebp - 0x108]
push edx
call dword [0x75f00c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058cf08
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0058cf08
mov esp, ebp
pop ebp
ret

Function at 0x4be6c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004be640
Function at 0x4c2610
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
sete cl
mov byte [ebp - 1], cl
test cl, cl
je 0x4c2636
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0xc]
push eax
push ebx
push 1
push edi
call ecx
jmp 0x4c2669
cmp dword [esi + 8], 0
jne 0x4c265c
mov edx, dword [eax + 8]
push 0x696b08
push edx
call fcn.00591eb3
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4c265c
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
push eax
push ebx
push 1
push edi
call fcn.005905a1
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4c2676
cmp edi, ebx
jbe 0x4c2695
cmp byte [ebp - 1], 0
jne 0x4c268f
mov ecx, dword [esi + 8]
push ecx
call fcn.0058eb79
add esp, 4
mov dword [esi + 8], 0
mov edx, dword [esi]
mov eax, dword [edx]
mov dword [esi], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4c3750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.00593d40
mov eax, dword [0x76c12c]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x4c3797
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0058cf08
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.00593e45
add esp, 8
test eax, eax
jl 0x4c3780
mov eax, 8
call fcn.00593d40
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004c35c0
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4c3780
push 0x696b08
push esi
call fcn.00591eb3
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x4c3871
jmp 0x4c37f4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x4c3802
cmp ebx, 0x400
mov esi, ebx
jl 0x4c3807
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.005905a1
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x4c3855
fild dword [esp + 0x44]
mov eax, 8
call fcn.00593d40
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004c35c0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4c37f0
sub ebx, esi
test ebx, ebx
jg 0x4c37f0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0058eb79
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004d0f10
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0058cf08
mov esp, ebp
pop ebp
ret