joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428c10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
mov eax, dword [0x78d3c0]
test eax, eax
je 0x428c20
leave
ret
sub esp, 0xc
push str.XML_DEBUG_CATALOG
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x428c3e
mov dword [0x78d3d0], 1
call fcn.00468af0
mov dword [0x78d3c0], 1
mov dword [0x78d3f0], eax
leave
ret

Function at 0x428c60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [0x78d3c0]
test edi, edi
je 0x428c7b
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00428c10
sub esp, 0xc
mov esi, dword [0x78d3f0]
push esi
call fcn.00468b30
mov dword [esp], str.XML_DEBUG_CATALOG
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
jne 0x428cc2
mov ebx, dword [0x78d3b0]
test ebx, ebx
je 0x428cce
sub esp, 0xc
mov eax, dword [0x78d3f0]
push eax
call fcn.00468b40
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x78d3d0], 1
jmp 0x428ca2
sub esp, 0xc
push str.XML_CATALOG_FILES
call sub.msvcrt.dll_getenv
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x428dc8
mov edx, dword [0x69a2f0]
mov eax, 1
call fcn.00425420
mov edi, eax
test eax, eax
je 0x428cac
lea eax, [eax + 0x3c]
mov dword [ebp - 0x10], eax
mov al, byte [ebx]
test al, al
je 0x428dbd
mov cl, al
lea eax, [ecx - 9]
cmp cl, 0x20
sete dl
cmp al, 1
setbe al
or eax, edx
test al, 1
je 0x428d3b
inc ebx
mov cl, byte [ebx]
cmp cl, 0x20
lea eax, [ecx - 9]
sete dl
cmp al, 1
setbe al
or eax, edx
test al, 1
jne 0x428d24
cmp cl, 0xd
je 0x428d24
test cl, cl
je 0x428dbd
mov esi, ebx
lea eax, [ecx - 9]
cmp cl, 0x20
setne dl
cmp al, 1
seta al
and eax, 0xff
test edx, eax
je 0x428d69
cmp cl, 0xd
je 0x428d69
inc ebx
mov cl, byte [ebx]
test cl, cl
jne 0x428d46
mov eax, ebx
sub eax, esi
push ecx
push ecx
push eax
push esi
call fcn.00462260
add esp, 0x10
mov esi, eax
test eax, eax
je 0x428db3
push 0
mov edx, dword [0x69a2f0]
push edx
xor edx, edx
push eax
mov eax, 1
push 0
call fcn.004251a0
mov edx, dword [ebp - 0x10]
add esp, 0x10
test eax, eax
mov dword [edx], eax
je 0x428da6
mov dword [ebp - 0x10], eax
sub esp, 0xc
push esi
call dword [0x69a2d0]
add esp, 0x10
mov cl, byte [ebx]
test cl, cl
jne 0x428d10
mov dword [0x78d3b0], edi
jmp 0x428cac
mov ebx, str.file:___etc_xml_catalog
jmp 0x428ce8
Function at 0x42f030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
test esi, esi
je 0x42f085
test eax, eax
je 0x42f085
push ecx
push 0
push edx
push eax
call fcn.0041f900
add esp, 0x10
test eax, eax
je 0x42f085
mov edx, dword [ebp - 0x10]
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0042e7a0
lea esp, [ebp - 0xc]
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42f320
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push esi
mov ebx, dword [eax]
mov byte [ebp - 0xd], dl
mov edi, eax
mov cl, byte [ebx]
lea eax, [ecx - 0x61]
cmp al, 0x19
lea eax, [ecx - 0x41]
seta dl
cmp al, 0x19
seta al
and eax, 0xff
test edx, eax
je 0x42f354
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x42f3fa
lea eax, [ecx - 0x61]
cmp al, 0x19
lea eax, [ecx - 0x41]
setbe dl
cmp al, 0x19
setbe al
or eax, edx
test al, 1
jne 0x42f3e0
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x42f3e0
cmp cl, 0x2d
je 0x42f3e0
cmp cl, 0x2e
je 0x42f3e0
cmp cl, 0x5f
je 0x42f3e0
cmp cl, 0x7e
je 0x42f3e0
cmp cl, 0x25
je 0x42f4c6
cmp cl, 0x21
sete dl
cmp cl, 0x24
sete al
or eax, edx
test al, 1
jne 0x42f3e0
cmp cl, 0x26
je 0x42f3e0
cmp cl, 0x28
je 0x42f3e0
cmp cl, 0x29
je 0x42f3e0
cmp cl, 0x2a
je 0x42f3e0
cmp cl, 0x2b
je 0x42f3e0
cmp cl, 0x2c
je 0x42f3e0
cmp cl, 0x3b
je 0x42f3e0
cmp cl, 0x3d
je 0x42f3e0
cmp cl, 0x27
je 0x42f3e0
cmp cl, 0x3a
je 0x42f3e0
cmp cl, 0x40
jne 0x42f4bc
nop
lea esi, [esi]
cmp cl, byte [ebp - 0xd]
je 0x42f4bc
cmp cl, 0x25
je 0x42f4b2
inc ebx
mov cl, byte [ebx]
jmp 0x42f354
cmp cl, 0x2d
je 0x42f354
cmp cl, 0x2e
je 0x42f354
cmp cl, 0x5f
je 0x42f354
cmp cl, 0x7e
je 0x42f354
cmp cl, 0x25
je 0x42f51b
cmp cl, 0x21
setne dl
cmp cl, 0x24
setne al
and eax, 0xff
test edx, eax
je 0x42f354
cmp cl, 0x26
je 0x42f354
cmp cl, 0x28
je 0x42f354
cmp cl, 0x29
je 0x42f354
cmp cl, 0x2a
je 0x42f354
cmp cl, 0x2b
je 0x42f354
cmp cl, 0x2c
je 0x42f354
cmp cl, 0x3b
je 0x42f354
cmp cl, 0x3d
je 0x42f354
cmp cl, 0x27
je 0x42f354
cmp cl, 0x3a
je 0x42f354
cmp cl, 0x40
je 0x42f354
mov ebx, dword [ebp + 8]
test ebx, ebx
sete al
and eax, 0xff
jmp 0x42f4c0
add ebx, 3
mov cl, byte [ebx]
jmp 0x42f354
mov dword [edi], ebx
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx esi, byte [ebx + 1]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
je 0x42f50e
movzx esi, byte [ebx + 2]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
jne 0x42f3e0
lea eax, [esi - 0x41]
cmp al, 5
jbe 0x42f3e0
jmp 0x42f38e
lea eax, [esi - 0x41]
cmp al, 5
ja 0x42f38e
jmp 0x42f4e0
movzx esi, byte [ebx + 1]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
seta dl
cmp al, 5
seta al
and eax, 0xff
test edx, eax
je 0x42f543
lea eax, [esi - 0x41]
cmp al, 5
ja 0x42f427
movzx esi, byte [ebx + 2]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
seta dl
cmp al, 5
seta al
and eax, 0xff
test edx, eax
je 0x42f354
lea eax, [esi - 0x41]
cmp al, 5
jbe 0x42f354
jmp 0x42f427
Function at 0x430f60
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, eax
mov dword [ebp - 0x10], edx
or eax, 0xffffffff
test edx, edx
je 0x43116f
mov ebx, dword [edx]
mov dword [ebp - 0x14], ebx
mov esi, esi
mov cl, byte [ebx]
lea eax, [ecx - 0x61]
cmp al, 0x19
lea eax, [ecx - 0x41]
setbe dl
cmp al, 0x19
setbe al
or eax, edx
test al, 1
jne 0x431080
lea esi, [esi]
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x431080
cmp cl, 0x2d
je 0x431080
cmp cl, 0x2e
je 0x431080
cmp cl, 0x5f
je 0x431080
cmp cl, 0x7e
je 0x431080
cmp cl, 0x25
je 0x4310af
cmp cl, 0x21
sete dl
cmp cl, 0x24
sete al
or eax, edx
test al, 1
jne 0x431080
cmp cl, 0x26
je 0x431080
cmp cl, 0x28
je 0x431080
cmp cl, 0x29
je 0x431080
cmp cl, 0x2a
je 0x431080
cmp cl, 0x2b
je 0x431080
cmp cl, 0x2c
je 0x431080
cmp cl, 0x3b
je 0x431080
cmp cl, 0x3d
je 0x431080
cmp cl, 0x27
je 0x431080
cmp cl, 0x3a
je 0x431080
cmp cl, 0x40
je 0x431080
cmp cl, 0x2f
je 0x431080
cmp cl, 0x3f
je 0x431080
test edi, edi
je 0x431168
test byte [edi + 0x24], 1
je 0x431101
cmp cl, 0x7b
sete dl
cmp cl, 0x7d
sete al
or eax, edx
test al, 1
jne 0x431080
cmp cl, 0x7c
je 0x431080
cmp cl, 0x5c
je 0x431080
cmp cl, 0x5e
je 0x431080
cmp cl, 0x5b
je 0x431080
cmp cl, 0x5d
je 0x431080
cmp cl, 0x60
jne 0x431101
lea esi, [esi]
cmp cl, 0x25
je 0x4310a7
inc ebx
mov cl, byte [ebx]
lea eax, [ecx - 0x61]
cmp al, 0x19
lea eax, [ecx - 0x41]
setbe dl
cmp al, 0x19
setbe al
or eax, edx
test al, 1
je 0x430fa0
cmp cl, 0x25
jne 0x431085
add ebx, 3
jmp 0x430f80
movzx esi, byte [ebx + 1]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
jne 0x4310d4
lea eax, [esi - 0x41]
cmp al, 5
ja 0x430fd8
movzx esi, byte [ebx + 2]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
jne 0x4310a7
lea eax, [esi - 0x41]
cmp al, 5
ja 0x430fd8
add ebx, 3
jmp 0x430f80
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x43111d
sub esp, 0xc
push eax
call dword [0x69a2d0]
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
test byte [edi + 0x24], 2
je 0x431177
mov eax, ebx
mov edx, dword [ebp - 0x14]
sub eax, edx
mov esi, dword [ebp - 0x14]
push ecx
push ecx
push eax
push esi
call fcn.00462260
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
add esp, 0x10
test eax, eax
je 0x431150
sub esp, 0xc
push eax
call dword [0x69a2d0]
add esp, 0x10
mov edx, dword [ebp - 0x10]
push esi
push esi
mov eax, dword [edx]
mov edx, ebx
sub edx, eax
push edx
push eax
call fcn.00462260
add esp, 0x10
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
mov edx, dword [ebp - 0x14]
sub eax, edx
push ecx
push 0
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00430850
jmp 0x431136
Function at 0x431190
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, eax
mov dword [ebp - 0x10], edx
or eax, 0xffffffff
test edx, edx
je 0x431383
mov ebx, dword [edx]
mov dword [ebp - 0x14], ebx
mov esi, esi
mov cl, byte [ebx]
lea eax, [ecx - 0x61]
cmp al, 0x19
lea eax, [ecx - 0x41]
setbe dl
cmp al, 0x19
setbe al
or eax, edx
test al, 1
jne 0x4312c0
lea esi, [esi]
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x4312c0
cmp cl, 0x2d
je 0x4312c0
cmp cl, 0x2e
je 0x4312c0
cmp cl, 0x5f
je 0x4312c0
cmp cl, 0x7e
je 0x4312c0
cmp cl, 0x25
je 0x4312ef
cmp cl, 0x21
sete dl
cmp cl, 0x24
sete al
or eax, edx
test al, 1
jne 0x4312c0
cmp cl, 0x26
je 0x4312c0
cmp cl, 0x28
je 0x4312c0
cmp cl, 0x29
je 0x4312c0
cmp cl, 0x2a
je 0x4312c0
cmp cl, 0x2b
je 0x4312c0
cmp cl, 0x2c
je 0x4312c0
cmp cl, 0x3b
je 0x4312c0
cmp cl, 0x3d
je 0x4312c0
cmp cl, 0x27
je 0x4312c0
cmp cl, 0x3a
je 0x4312c0
cmp cl, 0x40
je 0x4312c0
cmp cl, 0x2f
je 0x4312c0
cmp cl, 0x3f
je 0x4312c0
cmp cl, 0x5b
je 0x4312c0
cmp cl, 0x5d
je 0x4312c0
test edi, edi
je 0x43137c
test byte [edi + 0x24], 1
je 0x431341
cmp cl, 0x7b
sete dl
cmp cl, 0x7d
sete al
or eax, edx
test al, 1
jne 0x4312c0
cmp cl, 0x7c
je 0x4312c0
cmp cl, 0x5c
je 0x4312c0
cmp cl, 0x5e
je 0x4312c0
cmp cl, 0x5b
je 0x4312c0
cmp cl, 0x5d
je 0x4312c0
cmp cl, 0x60
jne 0x431341
nop
cmp cl, 0x25
je 0x4312e7
inc ebx
mov cl, byte [ebx]
lea eax, [ecx - 0x61]
cmp al, 0x19
lea eax, [ecx - 0x41]
setbe dl
cmp al, 0x19
setbe al
or eax, edx
test al, 1
je 0x4311d0
cmp cl, 0x25
jne 0x4312c5
add ebx, 3
jmp 0x4311b0
movzx esi, byte [ebx + 1]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
jne 0x431314
lea eax, [esi - 0x41]
cmp al, 5
ja 0x431208
movzx esi, byte [ebx + 2]
lea eax, [esi - 0x30]
cmp al, 9
lea eax, [esi - 0x61]
setbe dl
cmp al, 5
setbe al
or eax, edx
test al, 1
jne 0x4312e7
lea eax, [esi - 0x41]
cmp al, 5
ja 0x431208
add ebx, 3
jmp 0x4311b0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x43135d
sub esp, 0xc
push eax
call dword [0x69a2d0]
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
test byte [edi + 0x24], 2
je 0x43138b
mov eax, ebx
mov edx, dword [ebp - 0x14]
sub eax, edx
mov esi, dword [ebp - 0x14]
push ecx
push ecx
push eax
push esi
call fcn.00462260
mov dword [edi + 0x20], eax
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
mov edx, dword [ebp - 0x14]
sub eax, edx
mov esi, dword [ebp - 0x14]
push ecx
push 0
push eax
push esi
call fcn.00430850
jmp 0x431376
Function at 0x431a80
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.004313b0

Function at 0x437aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov edi, eax
mov ebx, dword [ebp + 8]
mov esi, edx
cmp ecx, ebx
jge 0x437adb
mov byte [ebp + ecx*2 - 0x87], 0x20
mov byte [ebp + ecx*2 - 0x88], 0x20
inc ecx
cmp ecx, ebx
setl dl
cmp ecx, 0x18
setle al
and eax, 0xff
test edx, eax
jne 0x437ab6
mov byte [ebp + ecx*2 - 0x87], 0
mov byte [ebp + ecx*2 - 0x88], 0
test esi, esi
je 0x437b51
mov ecx, dword [esi + 4]
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x437b1d
cmp ecx, 2
je 0x437b46
push eax
push ebx
push esi
push edi
call fcn.004b51d0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
lea eax, [ebp - 0x88]
push edi
push eax
call sub.msvcrt.dll_fputs
push edi
push 3
push 1
push 0x7441f0
call sub.msvcrt.dll_fwrite
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push ebx
push esi
push edi
call fcn.004b5050
jmp 0x437b12
push eax
push eax
lea eax, [ebp - 0x88]
push edi
push eax
call sub.msvcrt.dll_fputs
push edi
push 0xf
push 1
push str.Node_is_NULL___n
call sub.msvcrt.dll_fwrite
jmp 0x437b15

Function at 0x437b2f
Capabilities:
Write file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov edi, eax
mov ebx, dword [ebp + 8]
mov esi, edx
cmp ecx, ebx
jge 0x437adb
mov byte [ebp + ecx*2 - 0x87], 0x20
mov byte [ebp + ecx*2 - 0x88], 0x20
inc ecx
cmp ecx, ebx
setl dl
cmp ecx, 0x18
setle al
and eax, 0xff
test edx, eax
jne 0x437ab6
mov byte [ebp + ecx*2 - 0x87], 0
mov byte [ebp + ecx*2 - 0x88], 0
test esi, esi
je 0x437b51
mov ecx, dword [esi + 4]
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x437b1d
cmp ecx, 2
je 0x437b46
push eax
push ebx
push esi
push edi
call fcn.004b51d0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
lea eax, [ebp - 0x88]
push edi
push eax
call sub.msvcrt.dll_fputs
push edi
push 3
push 1
push 0x7441f0
call sub.msvcrt.dll_fwrite
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push ebx
push esi
push edi
call fcn.004b5050
jmp 0x437b12
push eax
push eax
lea eax, [ebp - 0x88]
push edi
push eax
call sub.msvcrt.dll_fputs
push edi
push 0xf
push 1
push str.Node_is_NULL___n
call sub.msvcrt.dll_fwrite
jmp 0x437b15
Function at 0x4682a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or eax, 0xffffffff
mov edx, dword [0x78dcd0]
test edx, edx
jne 0x468318
mov dword [0x78dcd0], 1
call fcn.00468a90
sub esp, 0xc
mov dword [0x78dcc0], eax
push str.XML_MEM_BREAKPOINT
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4682ee
push ecx
push 0x78dcf0
push 0x7493b6
push eax
call sub.msvcrt.dll_sscanf
add esp, 0x10
sub esp, 0xc
push str.XML_MEM_TRACE
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x468316
push edx
push 0x78dce0
push 0x7493c8
push eax
call sub.msvcrt.dll_sscanf
add esp, 0x10
xor eax, eax
leave
ret
Function at 0x48cad0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x78e2a0]
test eax, eax
je 0x48cae4
leave
ret
push eax
push eax
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.ws2_32.dll_WSAStartup
pop edx
test eax, eax
pop ecx
jne 0x48cae2
mov eax, dword [0x78e290]
test eax, eax
je 0x48cb12
mov dword [0x78e2a0], 1
leave
ret
sub esp, 0xc
mov dword [0x78e2b0], 0x50
push 0x757997
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x48cb35
cmp byte [eax], 0x2a
je 0x48cb6d
sub esp, 0xc
push str.http_proxy
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x48cb57
sub esp, 0xc
push eax
call fcn.0048ca00
add esp, 0x10
jmp 0x48cb06
sub esp, 0xc
push str.HTTP_PROXY
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x48cb06
jmp 0x48cb49
cmp byte [eax + 1], 0
jne 0x48cb35
jmp 0x48cb06

Function at 0x48cee0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov esi, eax
xor ebx, ebx
test edx, edx
setne al
and eax, 0xff
mov dword [ebp - 0x134], edx
mov edi, dword [ebp + 8]
test dword [esi + 0x18], eax
je 0x48cf33
cmp ebx, edi
jge 0x48cf33
lea esi, [esi]
mov eax, edi
push 0
sub eax, ebx
push eax
mov eax, dword [ebp - 0x134]
add eax, ebx
push eax
mov eax, dword [esi + 0x14]
push eax
call sub.ws2_32.dll_send
test eax, eax
jle 0x48cf40
add ebx, eax
cmp ebx, edi
jl 0x48cf10
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
inc eax
je 0x48cf92
mov eax, dword [0x69a7e0]
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], eax
mov edx, dword [esi + 0x14]
xor eax, eax
sub esp, 0xc
mov dword [ebp - 0x128], 1
mov dword [ebp + eax*4 - 0x124], edx
lea eax, [ebp - 0x130]
push eax
inc edx
lea eax, [ebp - 0x128]
push 0
push eax
push 0
push edx
call sub.ws2_32.dll_select
add esp, 0xc
jmp 0x48cf08
call fcn.0048c990
cmp eax, 0xb
je 0x48cf43
call fcn.0048c990
cmp eax, 0x2733
je 0x48cf43
push ecx
push str.send_failed_n
push 0
push 0xa
call fcn.0041e020
add esp, 0x10
test ebx, ebx
jne 0x48cf33
or ebx, 0xffffffff
jmp 0x48cf33
Function at 0x48cfd0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov esi, eax
mov esi, esi
test byte [esi + 0x18], 2
je 0x48d0f6
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x48d100
mov edi, dword [esi + 0x30]
lea eax, [ecx + 0x1000]
cmp edi, eax
ja 0x48d140
mov eax, dword [esi + 0x34]
mov ebx, dword [esi + 0x2c]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], ecx
lea edx, [ecx + eax]
lea eax, [ebx + 0x1000]
cmp edx, eax
jae 0x48d071
mov eax, dword [ebp - 0x138]
sub ebx, ecx
add eax, eax
mov dword [ebp - 0x13c], ebx
mov dword [esi + 0x34], eax
mov ebx, dword [esi + 0x28]
sub ebx, ecx
push edx
sub edi, ecx
push edx
push eax
push ecx
call dword [0x69a2c4]
add esp, 0x10
mov edx, eax
mov dword [esi + 0x24], eax
test eax, eax
je 0x48d1b9
mov ecx, dword [ebp - 0x13c]
lea eax, [eax + ecx]
mov dword [esi + 0x2c], eax
lea eax, [edx + ebx]
mov dword [esi + 0x28], eax
lea eax, [edx + edi]
mov dword [esi + 0x30], eax
mov ebx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x14]
push 0
push 0x1000
push ebx
push ecx
call sub.ws2_32.dll_recv
test eax, eax
mov dword [esi + 0x38], eax
jg 0x48d1ac
je 0x48d0f6
inc eax
je 0x48d175
mov eax, dword [0x69a7e0]
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], eax
mov edx, dword [esi + 0x14]
sub esp, 0xc
lea eax, [ebp - 0x130]
mov dword [ebp - 0x124], edx
inc edx
push eax
lea eax, [ebp - 0x128]
push 0
mov dword [ebp - 0x128], 1
push 0
push eax
push edx
call sub.ws2_32.dll_select
add esp, 0xc
test eax, eax
jg 0x48cfe0
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x48cfe0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push 0xfde8
call dword [0x69a2c8]
add esp, 0x10
mov ecx, eax
mov dword [esi + 0x24], eax
test eax, eax
je 0x48d1e2
mov edi, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea eax, [ecx + 0x1000]
mov dword [esi + 0x34], 0xfde8
cmp edi, eax
jbe 0x48d006
mov esi, esi
mov eax, dword [esi + 0x2c]
mov ebx, edi
sub eax, edi
sub ebx, ecx
push edx
push eax
push edi
push ecx
call sub.msvcrt.dll_memmove
mov ecx, dword [esi + 0x2c]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x28]
sub ecx, ebx
sub edi, ebx
sub eax, ebx
mov dword [esi + 0x2c], ecx
add esp, 0x10
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], eax
jmp 0x48d006
call fcn.0048c990
cmp eax, 0x2734
jg 0x48d1ee
cmp eax, 0x2733
jge 0x48d099
cmp eax, 0xb
je 0x48d099
push eax
push str.recv_failed_n
push 0
push 0xa
call fcn.0041e020
or eax, 0xffffffff
jmp 0x48d0f8
mov edx, dword [esi + 0x2c]
add edx, eax
mov dword [esi + 0x2c], edx
jmp 0x48d0f8
mov eax, str.allocating_input_buffer
call fcn.0048c970
sub esp, 0xc
mov edi, dword [ebp - 0x134]
push edi
call dword [0x69a2d0]
or eax, 0xffffffff
mov dword [esi + 0x38], 0xffffffff
jmp 0x48d0f8
mov eax, str.allocating_input
call fcn.0048c970
jmp 0x48d1d3
cmp eax, 0x2746
je 0x48d0f6
cmp eax, 0x274a
jne 0x48d195
jmp 0x48d0f6
Function at 0x48ebe0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x78e310]
test eax, eax
je 0x48ebf4
leave
ret
push eax
push eax
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.ws2_32.dll_WSAStartup
pop edx
test eax, eax
pop ecx
jne 0x48ebf2
sub esp, 0xc
mov dword [0x78e2f0], 0x15
push str.no_proxy
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x48ec30
cmp byte [eax], 0x2a
je 0x48eca8
sub esp, 0xc
push str.ftp_proxy
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x48ecb0
sub esp, 0xc
push eax
call fcn.0048eb10
add esp, 0x10
sub esp, 0xc
push str.ftp_proxy_user
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x48ec76
sub esp, 0xc
push eax
call dword [0x69a2c0]
add esp, 0x10
mov dword [0x78e2e0], eax
sub esp, 0xc
push str.ftp_proxy_password
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x48ec9c
sub esp, 0xc
push eax
call dword [0x69a2c0]
add esp, 0x10
mov dword [0x78e2d0], eax
mov dword [0x78e310], 1
leave
ret
cmp byte [eax + 1], 0
jne 0x48ec30
leave
ret
sub esp, 0xc
push str.FTP_PROXY
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
jne 0x48ec44
jmp 0x48ec50
Function at 0x48ee50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, eax
mov dword [ebp - 0x10], 0xffffffff
test eax, eax
je 0x48efde
cmp dword [eax + 0x2c], 0xffffffff
je 0x48efde
test edi, edi
je 0x48efde
cmp dword [edi + 0x2c], 0xffffffff
je 0x48efde
mov eax, dword [edi + 0x440]
cmp eax, 0x400
ja 0x48efde
mov esi, dword [edi + 0x444]
cmp esi, 0x400
ja 0x48efde
cmp eax, esi
jg 0x48efde
test eax, eax
jle 0x48eee8
sub esi, eax
lea eax, [eax + edi + 0x3c]
push edx
push esi
push eax
lea eax, [edi + 0x3c]
push eax
call sub.msvcrt.dll_memmove
mov esi, dword [edi + 0x444]
mov eax, dword [edi + 0x440]
sub esi, eax
add esp, 0x10
mov dword [edi + 0x444], esi
mov dword [edi + 0x440], 0
mov eax, 0x400
xor edx, edx
sub eax, esi
jne 0x48efeb
mov esi, dword [edi + 0x444]
or edx, esi
je 0x48efde
mov eax, dword [edi + 0x440]
lea ebx, [esi + edi + 0x3c]
add eax, edi
lea ecx, [eax + 0x3c]
cmp ecx, ebx
jae 0x48ef94
mov eax, ebx
sub eax, ecx
cmp eax, 2
jle 0x48ef76
mov dl, byte [ecx]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x48ef76
movsx eax, dl
lea edx, [eax - 0x30]
mov al, byte [ecx + 1]
mov byte [ebp - 0x11], al
sub eax, 0x30
cmp al, 9
ja 0x48ef76
lea eax, [edx + edx*4]
movsx edx, byte [ebp - 0x11]
lea edx, [edx + eax*2 - 0x30]
mov al, byte [ecx + 2]
mov byte [ebp - 0x12], al
sub eax, 0x30
cmp al, 9
ja 0x48ef76
movsx eax, byte [ebp - 0x12]
lea edx, [edx + edx*4]
cmp byte [ecx + 3], 0x2d
lea edx, [eax + edx*2 - 0x30]
mov eax, edx
je 0x48f021
test eax, eax
jle 0x48ef76
jmp 0x48f04d
inc ecx
cmp ecx, ebx
jae 0x48efd0
cmp byte [ecx], 0xa
jne 0x48ef75
cmp ecx, ebx
jae 0x48efd0
cmp byte [ecx], 0xd
setne al
and eax, 0xff
add ecx, eax
cmp ecx, ebx
jb 0x48ef18
mov edx, dword [ebp - 0x10]
test edx, edx
js 0x48ee74
sub ecx, edi
lea eax, [ecx - 0x3c]
mov ecx, 0x51eb851f
mov dword [edi + 0x440], eax
mov eax, dword [ebp - 0x10]
imul ecx
mov eax, dword [ebp - 0x10]
mov ecx, edx
sar eax, 0x1f
sar ecx, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
jmp 0x48efe1
mov dword [edi + 0x440], esi
test edi, edi
jne 0x48ee7c
or ecx, 0xffffffff
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
push 0
push eax
mov eax, dword [edi + 0x440]
add eax, edi
add eax, 0x3c
push eax
mov eax, dword [edi + 0x2c]
push eax
call sub.ws2_32.dll_recv
test eax, eax
js 0x48f028
mov esi, dword [edi + 0x444]
mov edx, eax
add esi, eax
mov dword [edi + 0x444], esi
mov byte [edi + esi + 0x3c], 0
jmp 0x48eef7
neg eax
jmp 0x48ef6c
push esi
push str.recv_failed
push 0
push 9
call fcn.0041e020
pop ebx
mov ecx, dword [edi + 0x2c]
push ecx
call sub.ws2_32.dll_closesocket
add esp, 0xc
mov dword [edi + 0x2c], 0xffffffff
jmp 0x48efde
add ecx, 3
mov dword [ebp - 0x10], eax
mov eax, ecx
sub eax, edi
sub eax, 0x3c
cmp ecx, ebx
mov dword [edi + 0x448], eax
jae 0x48f06e
cmp byte [ecx], 0xa
je 0x48f082
inc ecx
cmp ecx, ebx
jb 0x48f064
mov al, byte [ecx]
cmp al, 0xa
je 0x48f082
cmp al, 0xd
jne 0x48ef94
inc ecx
jmp 0x48ef94
inc ecx
mov al, byte [ecx]
jmp 0x48f074