joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c224
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push edi
cmp dword [0x667120], 0
jne 0x41c34e
call fcn.0041c1e9
push dword [0x667150]
call fcn.0045f808
push str.XML_DEBUG_CATALOG
call sub.msvcrt.dll_getenv
pop ebx
test eax, eax
pop esi
je 0x41c262
mov dword [0x667130], 1
cmp dword [0x667110], 0
jne 0x41c343
push str.XML_CATALOG_FILES
call sub.msvcrt.dll_getenv
pop ecx
mov ebx, eax
test eax, eax
jne 0x41c285
mov ebx, str.file:___etc_xml_catalog
mov edx, dword [0x4fa2b0]
mov eax, 1
call fcn.00419524
mov edi, eax
test eax, eax
je 0x41c343
lea eax, [eax + 0x3c]
mov dword [ebp - 0x10], eax
cmp byte [ebx], 0
je 0x41c33d
mov cl, byte [ebx]
cmp cl, 0x20
lea eax, [ecx - 9]
sete dl
cmp al, 1
setbe al
or eax, edx
test al, 1
jne 0x41c2c9
cmp cl, 0xd
jne 0x41c2cc
inc ebx
jmp 0x41c2ae
mov cl, byte [ebx]
test cl, cl
je 0x41c33d
mov esi, ebx
jmp 0x41c2e2
cmp cl, 0xd
je 0x41c2f7
inc ebx
mov cl, byte [ebx]
test cl, cl
je 0x41c2f7
lea eax, [ecx - 9]
cmp cl, 0x20
setne dl
cmp al, 1
seta al
movzx eax, al
test eax, edx
jne 0x41c2d6
mov eax, ebx
sub eax, esi
push eax
push esi
call fcn.00449b00
mov esi, eax
pop eax
test esi, esi
pop edx
je 0x41c2a5
push 0
xor edx, edx
push dword [0x4fa2b0]
mov eax, 1
push esi
push 0
call fcn.00419318
mov edx, dword [ebp - 0x10]
add esp, 0x10
test eax, eax
mov dword [edx], eax
je 0x41c330
mov dword [ebp - 0x10], eax
push esi
call dword [0x4fa8e0]
pop esi
jmp 0x41c2a5
mov dword [0x667110], edi
push dword [0x667150]
call fcn.0045f80d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x426ad9
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
or eax, 0xffffffff
push ebx
test edx, edx
push ebx
mov dword [ebp - 0x10], edx
je 0x426cb0
mov esi, dword [edx]
jmp 0x426aff
cmp byte [esi], 0x25
jne 0x426afe
add esi, 3
jmp 0x426aff
inc esi
mov cl, byte [esi]
lea eax, [ecx - 0x61]
cmp al, 0x19
lea eax, [ecx - 0x41]
setbe dl
cmp al, 0x19
setbe al
or eax, edx
test al, 1
jne 0x426af4
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x426af4
cmp cl, 0x2d
sete dl
cmp cl, 0x5f
sete al
or eax, edx
test al, 1
jne 0x426af4
cmp cl, 0x2e
je 0x426af4
cmp cl, 0x21
je 0x426af4
cmp cl, 0x7e
je 0x426af4
cmp cl, 0x2a
je 0x426af4
cmp cl, 0x27
je 0x426af4
cmp cl, 0x28
je 0x426af4
cmp cl, 0x29
je 0x426af4
cmp cl, 0x25
jne 0x426ba0
mov bl, byte [esi + 1]
lea eax, [ebx - 0x30]
cmp al, 9
lea eax, [ebx - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
jne 0x426b78
lea eax, [ebx - 0x41]
cmp al, 5
ja 0x426ba0
mov bl, byte [esi + 2]
lea eax, [ebx - 0x30]
cmp al, 9
lea eax, [ebx - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
jne 0x426af4
lea eax, [ebx - 0x41]
cmp al, 5
jbe 0x426af4
cmp cl, 0x3b
sete dl
cmp cl, 0x2f
sete al
or eax, edx
test al, 1
jne 0x426af4
cmp cl, 0x3f
je 0x426af4
cmp cl, 0x3a
je 0x426af4
cmp cl, 0x40
je 0x426af4
cmp cl, 0x26
je 0x426af4
cmp cl, 0x3d
je 0x426af4
cmp cl, 0x2b
je 0x426af4
cmp cl, 0x24
je 0x426af4
cmp cl, 0x2c
je 0x426af4
cmp cl, 0x5b
je 0x426af4
cmp cl, 0x5d
je 0x426af4
test edi, edi
je 0x426ca9
test byte [edi + 0x24], 1
je 0x426c6a
cmp cl, 0x7b
sete dl
cmp cl, 0x7d
sete al
or eax, edx
test al, 1
jne 0x426af4
cmp cl, 0x7c
je 0x426af4
cmp cl, 0x5c
je 0x426af4
cmp cl, 0x5e
je 0x426af4
cmp cl, 0x5b
je 0x426af4
cmp cl, 0x5d
je 0x426af4
cmp cl, 0x60
je 0x426af4
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x426c79
push eax
call dword [0x4fa8e0]
pop ecx
mov eax, dword [ebp - 0x10]
test byte [edi + 0x24], 2
mov edx, dword [eax]
je 0x426c96
mov eax, esi
sub eax, edx
push eax
push edx
call fcn.00449b00
mov dword [edi + 0x1c], eax
pop eax
pop edx
jmp 0x426ca9
mov eax, esi
push 0
sub eax, edx
push eax
push edx
call fcn.0042681b
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42e137
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x25
jne 0x42e2ca
push ebx
call fcn.0044aa83
push ebx
call fcn.0042db23
mov edi, eax
pop eax
test edi, edi
pop edx
jne 0x42e17d
mov dword [ebp + 8], str.xmlParsePEReference:_no_name_n
mov eax, ebx
lea esp, [ebp - 0xc]
mov edx, 0x44
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00429123
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3b
jne 0x42e2b0
push ebx
call fcn.0044aa83
pop eax
mov eax, dword [ebx]
test eax, eax
je 0x42e1ae
cmp dword [eax + 0x60], 0
je 0x42e1ae
push edi
push dword [ebx + 4]
call dword [eax + 0x60]
pop ecx
mov esi, eax
pop eax
test esi, esi
jne 0x42e1f1
cmp dword [ebx + 0x1c], 1
je 0x42e1c0
cmp dword [ebx + 0x58], 0
jne 0x42e1d4
cmp dword [ebx + 0x5c], 0
jne 0x42e1d4
mov edx, 0x1a
mov eax, ebx
push edi
push str.PEReference:____s__not_found_n
call fcn.0042934c
jmp 0x42e234
mov edx, 0x1b
mov eax, ebx
push 0
push edi
push str.PEReference:____s__not_found_n
call fcn.0042918c
mov dword [ebx + 0x64], 0
jmp 0x42e210
mov eax, dword [esi + 0x30]
sub eax, 4
cmp eax, 1
jbe 0x42e218
mov edx, 0x1b
mov eax, ebx
push 0
push edi
push str.Internal:____s__is_not_a_parameter_entity_n
call fcn.0042918c
add esp, 0xc
jmp 0x42e2a7
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x28], 0x429d0f
je 0x42e238
mov edx, esi
mov eax, ebx
call fcn.00429d1b
push eax
push ebx
call fcn.00429c7e
pop eax
pop edx
jmp 0x42e2a7
push esi
push ebx
call fcn.0044b7d3
push eax
push ebx
call fcn.00429c7e
add esp, 0x10
cmp dword [esi + 0x30], 5
jne 0x42e2a7
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x42e2a7
cmp byte [eax + 1], 0x3f
jne 0x42e2a7
cmp byte [eax + 2], 0x78
jne 0x42e2a7
cmp byte [eax + 3], 0x6d
jne 0x42e2a7
cmp byte [eax + 4], 0x6c
jne 0x42e2a7
mov cl, byte [eax + 5]
cmp cl, 0x20
lea eax, [ecx - 9]
sete dl
cmp al, 1
setbe al
or eax, edx
test al, 1
jne 0x42e28e
cmp cl, 0xd
jne 0x42e2a7
push ebx
call fcn.0042b609
pop edi
cmp dword [ebx + 0x54], 0x20
jne 0x42e2a7
mov dword [ebx + 0xac], 0xffffffff
jmp 0x42e2ca
mov dword [ebx + 0x5c], 1
jmp 0x42e2ca
mov dword [ebp + 8], 0
mov eax, ebx
lea esp, [ebp - 0xc]
mov edx, 0x17
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00428ea9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x444361
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
test esi, esi
je 0x4443b1
test eax, eax
je 0x4443b1
push 0
push edx
push eax
call fcn.004484fe
add esp, 0xc
test eax, eax
je 0x4443b1
mov edx, dword [ebp - 0x10]
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edi
mov edx, eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00443cad
lea esp, [ebp - 0xc]
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x444695
Capabilities:
Query environment variable

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
cmp dword [0x6679a8], 0
jne 0x4446fe
mov dword [0x6679a8], 1
call fcn.0045f7c0
push str.XML_MEM_BREAKPOINT
mov dword [0x667998], eax
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
je 0x4446da
push 0x6679c8
push 0x642031
push eax
call sub.msvcrt.dll_sscanf
add esp, 0xc
push str.XML_MEM_TRACE
call sub.msvcrt.dll_getenv
pop ecx
test eax, eax
je 0x4446fc
push 0x6679b8
push 0x642043
push eax
call sub.msvcrt.dll_sscanf
add esp, 0xc
xor eax, eax
leave
ret
Function at 0x492f49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, edx
mov dword [ebp - 0x10], eax
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
test byte [edx + 0x20], 1
je 0x492f99
mov eax, dword [edx + 0xc]
test eax, eax
je 0x492f81
push eax
call dword [0x4fa8e0]
mov dword [edi + 0xc], 0
pop ecx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x492fa7
push eax
call dword [0x4fa8e0]
pop edx
mov dword [edi + 0x10], 0
jmp 0x492fa7
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
test byte [edi + 0x20], 2
je 0x492fc5
mov eax, dword [edi + 0x14]
test eax, eax
je 0x492fcc
push eax
call dword [0x4fa8e0]
pop eax
mov dword [edi + 0x14], 0
jmp 0x492fcc
mov dword [edi + 0x14], 0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x492fe1
push eax
call fcn.0046f3b3
mov dword [edi + 0x18], 0
pop eax
mov eax, dword [edi + 0x38]
test eax, eax
je 0x49309c
mov esi, eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
cmp dword [esi + 0x18], 0
je 0x493020
xor ebx, ebx
cmp ebx, dword [esi + 0x1c]
jge 0x493020
mov eax, dword [esi + 0x18]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x49301d
push eax
call dword [0x4fa8e0]
pop eax
mov eax, dword [esi + 0x18]
mov dword [eax + ebx*4], 0
inc ebx
jmp 0x492ffc
mov eax, dword [esi + 0x20]
test eax, eax
je 0x493070
cmp dword [esi + 0x14], 0x18
jne 0x493061
mov dword [ebp - 0x18], 0
xor edx, edx
cmp edx, dword [eax + 4]
jge 0x493061
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
mov ebx, dword [eax + edx*4]
push dword [ebx + 4]
call dword [0x4fa8e0]
mov dword [esp], ebx
call dword [0x4fa8e0]
inc dword [ebp - 0x18]
pop eax
mov edx, dword [ebp - 0x18]
mov eax, dword [esi + 0x20]
jmp 0x493036
mov eax, dword [esi + 0x20]
call fcn.00487972
mov dword [esi + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [esi + 8], 0
mov eax, dword [edx + 0x78]
test eax, eax
je 0x493084
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x78], esi
mov esi, dword [ebp - 0x14]
test esi, esi
jne 0x492fee
mov dword [edi + 0x38], 0
mov eax, dword [edi + 0x34]
test eax, eax
je 0x4930b9
mov ebx, eax
mov eax, ebx
mov ebx, dword [ebx]
call fcn.00492157
test ebx, ebx
jne 0x4930a5
mov dword [edi + 0x34], 0
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4930ce
push eax
call fcn.0047fa17
mov dword [edi + 0x3c], 0
pop eax
mov eax, dword [edi + 0x40]
test eax, eax
je 0x4930f2
push eax
call dword [0x4fa8e0]
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
pop eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a1656
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp dword [0x668368], 0
jne 0x4a16d9
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
jne 0x4a16d9
cmp dword [0x668358], 0
jne 0x4a16cf
push 0x65bbe3
mov dword [0x668378], 0x50
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
je 0x4a16aa
cmp byte [eax], 0x2a
jne 0x4a16aa
cmp byte [eax + 1], 0
je 0x4a16cf
push str.http_proxy
call sub.msvcrt.dll_getenv
pop ecx
test eax, eax
jne 0x4a16c8
push str.HTTP_PROXY
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
je 0x4a16cf
push eax
call fcn.004a15b4
pop eax
mov dword [0x668368], 1
leave
ret

Function at 0x4a18f0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
xor eax, eax
sub esp, 0x11c
xor ebx, ebx
test edx, edx
mov dword [ebp - 0x128], edx
setne al
mov edi, dword [ebp + 8]
test dword [esi + 0x18], eax
je 0x4a19ba
cmp ebx, edi
jge 0x4a19ba
mov eax, edi
push 0
sub eax, ebx
push eax
mov eax, dword [ebp - 0x128]
add eax, ebx
push eax
push dword [esi + 0x14]
call sub.WSOCK32.DLL_send
test eax, eax
jle 0x4a1941
add ebx, eax
jmp 0x4a1919
inc eax
jne 0x4a1974
call fcn.004a1573
cmp eax, 0xb
je 0x4a1974
call fcn.004a1573
cmp eax, 0x2733
je 0x4a1974
push str.send_failed_n
push 0
push 0xa
call fcn.004472ec
add esp, 0xc
test ebx, ebx
jne 0x4a19ba
or ebx, 0xffffffff
jmp 0x4a19ba
mov eax, dword [0x4fab00]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], eax
mov edx, dword [esi + 0x14]
lea eax, [ebp - 0x124]
mov dword [ebp - 0x118], edx
push eax
inc edx
lea eax, [ebp - 0x11c]
push 0
mov dword [ebp - 0x11c], 1
push eax
push 0
push edx
call sub.WSOCK32.DLL_select
jmp 0x4a1919
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a19c4
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x124
mov esi, eax
test byte [esi + 0x18], 2
je 0x4a1b87
cmp dword [esi + 0x24], 0
jne 0x4a1a14
push 0xfde8
call dword [0x4fa8d8]
pop ebx
test eax, eax
mov dword [esi + 0x24], eax
jne 0x4a1a04
mov eax, str.allocating_input
call fcn.004a1560
jmp 0x4a1aa4
mov dword [esi + 0x34], 0xfde8
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x30]
lea eax, [ecx + 0x1000]
cmp edx, eax
jbe 0x4a1a41
mov ebx, edx
mov eax, dword [esi + 0x2c]
sub ebx, ecx
sub eax, edx
push eax
push edx
push ecx
call sub.msvcrt.dll_memmove
sub dword [esi + 0x30], ebx
add esp, 0xc
sub dword [esi + 0x28], ebx
sub dword [esi + 0x2c], ebx
mov eax, dword [esi + 0x34]
mov ebx, dword [esi + 0x24]
mov ecx, dword [esi + 0x2c]
mov dword [ebp - 0x128], eax
lea edx, [ebx + eax]
lea eax, [ecx + 0x1000]
cmp edx, eax
jae 0x4a1acb
sub ecx, ebx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x12c], ecx
mov ecx, dword [esi + 0x30]
sub ecx, ebx
add eax, eax
mov dword [ebp - 0x130], ecx
mov dword [esi + 0x34], eax
push eax
mov edi, dword [esi + 0x28]
push ebx
call dword [0x4fa8d4]
mov edx, eax
sub edi, ebx
mov dword [esi + 0x24], eax
test edx, edx
pop eax
pop ecx
jne 0x4a1aad
mov eax, str.allocating_input_buffer
call fcn.004a1560
push ebx
call dword [0x4fa8e0]
mov dword [esi + 0x38], 0xffffffff
jmp 0x4a1b2b
mov ecx, dword [ebp - 0x12c]
lea eax, [edx + ecx]
mov ecx, dword [ebp - 0x130]
mov dword [esi + 0x2c], eax
lea eax, [edx + edi]
mov dword [esi + 0x28], eax
lea eax, [edx + ecx]
mov dword [esi + 0x30], eax
push 0
push 0x1000
push dword [esi + 0x2c]
push dword [esi + 0x14]
call sub.WSOCK32.DLL_recv
test eax, eax
mov dword [esi + 0x38], eax
jle 0x4a1aec
add dword [esi + 0x2c], eax
jmp 0x4a1b89
je 0x4a1b87
inc eax
jne 0x4a1b30
call fcn.004a1573
cmp eax, 0x2734
jg 0x4a1b0f
cmp eax, 0x2733
jge 0x4a1b30
cmp eax, 0xb
je 0x4a1b30
jmp 0x4a1b1d
cmp eax, 0x2746
je 0x4a1b87
cmp eax, 0x274a
je 0x4a1b87
push str.recv_failed_n
push 0
push 0xa
call fcn.004472ec
or eax, 0xffffffff
jmp 0x4a1b89
mov eax, dword [0x4fab00]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], eax
mov edx, dword [esi + 0x14]
lea eax, [ebp - 0x124]
mov dword [ebp - 0x118], edx
push eax
inc edx
lea eax, [ebp - 0x11c]
push 0
mov dword [ebp - 0x11c], 1
push 0
push eax
push edx
call sub.WSOCK32.DLL_select
test eax, eax
jg 0x4a19d2
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x4a19d2
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a30a3
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp dword [0x6683d8], 0
jne 0x4a315d
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
jne 0x4a315d
push str.no_proxy
mov dword [0x6683b8], 0x15
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
je 0x4a30f6
cmp byte [eax], 0x2a
jne 0x4a30f6
cmp byte [eax + 1], 0
je 0x4a315d
push str.ftp_proxy
call sub.msvcrt.dll_getenv
pop ecx
test eax, eax
jne 0x4a3114
push str.FTP_PROXY
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
je 0x4a311b
push eax
call fcn.004a3001
pop ecx
push str.ftp_proxy_user
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
je 0x4a3137
push eax
call dword [0x4fa8d0]
pop ecx
mov dword [0x6683a8], eax
push str.ftp_proxy_password
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
je 0x4a3153
push eax
call dword [0x4fa8d0]
mov dword [0x668398], eax
pop eax
mov dword [0x6683d8], 1
leave
ret
Function at 0x4a3282
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
or ecx, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, eax
mov dword [ebp - 0x10], 0xffffffff
test eax, eax
je 0x4a347b
jmp 0x4a32b2
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x440], eax
test ebx, ebx
je 0x4a337f
mov edx, dword [ebx + 0x440]
cmp edx, 0x400
ja 0x4a337f
mov eax, dword [ebx + 0x444]
cmp eax, 0x400
ja 0x4a337f
cmp edx, eax
jg 0x4a337f
test edx, edx
jle 0x4a3311
sub eax, edx
push eax
lea eax, [ebx + edx + 0x3c]
push eax
lea eax, [ebx + 0x3c]
push eax
call sub.msvcrt.dll_memmove
mov eax, dword [ebx + 0x444]
add esp, 0xc
sub eax, dword [ebx + 0x440]
mov dword [ebx + 0x440], 0
mov dword [ebx + 0x444], eax
mov eax, 0x400
xor edx, edx
sub eax, dword [ebx + 0x444]
je 0x4a3372
push 0
push eax
mov eax, ebx
add eax, dword [ebx + 0x440]
add eax, 0x3c
push eax
push dword [ebx + 0x2c]
call sub.WSOCK32.DLL_recv
mov edx, eax
test eax, eax
jns 0x4a335f
push str.recv_failed
push 0
push 9
call fcn.004472ec
add esp, 0xc
push dword [ebx + 0x2c]
call sub.WSOCK32.DLL_closesocket
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x4a337f
mov eax, dword [ebx + 0x444]
add eax, edx
mov dword [ebx + 0x444], eax
mov byte [ebx + eax + 0x3c], 0
mov eax, dword [ebx + 0x444]
mov dword [ebp - 0x14], eax
or edx, eax
jne 0x4a3387
or ecx, 0xffffffff
jmp 0x4a347b
mov eax, ebx
add eax, dword [ebx + 0x440]
lea ecx, [eax + 0x3c]
mov eax, dword [ebp - 0x14]
lea edi, [ebx + eax + 0x3c]
cmp ecx, edi
jae 0x4a3457
mov eax, edi
sub eax, ecx
cmp eax, 2
jle 0x4a3430
mov dl, byte [ecx]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x4a3430
movzx esi, byte [ecx + 1]
movsx eax, dl
lea edx, [eax - 0x30]
lea eax, [esi - 0x30]
cmp al, 9
ja 0x4a3430
imul edx, edx, 0xa
mov dword [ebp - 0x18], edx
mov eax, esi
movzx esi, byte [ecx + 2]
movsx edx, al
mov eax, dword [ebp - 0x18]
lea edx, [eax + edx - 0x30]
lea eax, [esi - 0x30]
cmp al, 9
ja 0x4a3430
imul edx, edx, 0xa
mov eax, esi
movsx esi, al
cmp byte [ecx + 3], 0x2d
lea edx, [edx + esi - 0x30]
mov eax, edx
jne 0x4a33fb
neg eax
test eax, eax
jle 0x4a3430
add ecx, 3
mov dword [ebp - 0x10], eax
mov eax, ecx
sub eax, ebx
sub eax, 0x3c
mov dword [ebx + 0x448], eax
jmp 0x4a341a
cmp byte [ecx], 0xa
je 0x4a341e
inc ecx
cmp ecx, edi
jb 0x4a3414
xor eax, eax
cmp byte [ecx], 0xa
sete al
add ecx, eax
cmp byte [ecx], 0xd
jne 0x4a3457
inc ecx
jmp 0x4a3457
cmp ecx, edi
jae 0x4a32a1
cmp byte [ecx], 0xa
je 0x4a3440
inc ecx
jmp 0x4a3430
cmp ecx, edi
jae 0x4a32a1
xor eax, eax
cmp byte [ecx], 0xd
setne al
add ecx, eax
jmp 0x4a3399
cmp dword [ebp - 0x10], 0
js 0x4a32aa
sub ecx, ebx
mov edx, 0x64
lea eax, [ecx - 0x3c]
mov dword [ebx + 0x440], eax
mov eax, dword [ebp - 0x10]
mov ebx, edx
cdq
idiv ebx
mov ecx, eax
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4a3485
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.004a3282
Function at 0x4a3515
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xd4
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a3575
lea esi, [ebp - 0xdc]
push str.QUIT_r_n
push 0xc8
push esi
call sub.msvcrt.dll__snprintf
mov edi, esi
cld
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
push ecx
push esi
push dword [ebx + 0x2c]
call sub.WSOCK32.DLL_send
mov edi, eax
add esp, 0xc
xor eax, eax
test edi, edi
jns 0x4a3575
push str.send_failed
push 0
push 9
call fcn.004472ec
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a3ea6
Capabilities:
Get socket status

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push ebx
sub esp, 0x228
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a3f5b
push dword [ebx + 0x30]
call sub.WSOCK32.DLL_closesocket
mov dword [ebx + 0x30], 0xffffffff
mov dword [ebp - 0x22c], 0xf
mov dword [ebp - 0x228], 0
mov edx, dword [ebx + 0x2c]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x220], edx
lea eax, [ebp - 0x22c]
inc edx
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x114]
push 0
mov dword [ebp - 0x224], 1
push eax
push edx
call sub.WSOCK32.DLL_select
test eax, eax
jl 0x4a3f45
jne 0x4a3f39
push dword [ebx + 0x2c]
call sub.WSOCK32.DLL_closesocket
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x4a3f59
push ebx
call fcn.004a3485
pop edx
cmp eax, 2
je 0x4a3f59
push dword [ebx + 0x2c]
call sub.WSOCK32.DLL_closesocket
or eax, 0xffffffff
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x4a3f5b
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4a45dd
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
or edx, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x130
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a46f0
cmp dword [ebp + 0xc], 0
jne 0x4a4607
cmp dword [ebx + 0xc], 0
je 0x4a46f0
push ebx
call fcn.004a3bee
or edx, 0xffffffff
mov dword [ebx + 0x30], eax
inc eax
pop ecx
je 0x4a46f0
lea esi, [ebp - 0x13c]
push str.TYPE_I_r_n
push 0x12c
push esi
call sub.msvcrt.dll__snprintf
mov edi, esi
cld
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push 0
lea eax, [ecx - 1]
push eax
push esi
push dword [ebx + 0x2c]
call sub.WSOCK32.DLL_send
add esp, 0xc
mov edi, eax
test eax, eax
js 0x4a46a9
mov eax, ebx
call fcn.004a3282
mov edi, eax
cmp eax, 2
jne 0x4a46d8
cmp dword [ebp + 0xc], 0
jne 0x4a466e
push dword [ebx + 0xc]
jmp 0x4a4671
push dword [ebp + 0xc]
push str.RETR__s_r_n
push 0x12c
push esi
call sub.msvcrt.dll__snprintf
cld
mov byte [ebp - 0x11], 0
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
add esp, 0x10
lea eax, [ecx - 1]
push 0
push eax
push esi
push dword [ebx + 0x2c]
call sub.WSOCK32.DLL_send
mov edi, eax
test eax, eax
jns 0x4a46ca
push str.send_failed
push 0
push 9
call fcn.004472ec
push dword [ebx + 0x30]
call sub.WSOCK32.DLL_closesocket
mov edx, edi
mov dword [ebx + 0x30], 0xffffffff
jmp 0x4a46f0
mov eax, ebx
call fcn.004a3282
mov edi, eax
cmp eax, 1
je 0x4a46ed
push dword [ebx + 0x30]
call sub.WSOCK32.DLL_closesocket
mov edx, edi
neg edx
mov dword [ebx + 0x30], 0xffffffff
jmp 0x4a46f0
mov edx, dword [ebx + 0x30]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret