joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5929
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4b594d
cmp dword [esi + 8], edi
jge 0x4b5945
push esi
call fcn.004b121a
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4b5973
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4b5959
mov dword [esi + 8], edx
jmp 0x4b5988
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4b597e
xor dl, dl
jmp 0x4b5983
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4b5973
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4b59c2
push str.zlib_corrupt
call fcn.004b1143
add esp, 4
jmp 0x4b5a02
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4b59d2
push str.read_past_buffer
jmp 0x4b59b8
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4b59ec
push edi
push ecx
push esi
call fcn.004b84dd
add esp, 0xc
test eax, eax
je 0x4b5a02
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0045a590
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x4bb57c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x69c], edi
je 0x4bb5e6
cmp dword [ebp + 8], 0x100
jne 0x4bb5d5
cmp word [ebp + 0xc], 0xd
jne 0x4bb5d5
cmp byte [esi + 0x6a2], 0
je 0x4bb5bc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4bb5d5
cmp byte [esi + 0x6a3], 0
jne 0x4bb5d5
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4bb5d1
push edi
push edi
push edi
push str.return
push esi
call fcn.0048f265
xor eax, eax
jmp 0x4bb5e9
mov eax, dword [esi + 0x69c]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4c861e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x4c86a6
cmp dword [esi + 0x10], 0
je 0x4c86a6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0045be30
mov ebx, esp
test ebx, ebx
je 0x4c86a6
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1c8
call fcn.00488862
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0048f265
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0048b42a
test al, al
je 0x4c86a6
mov ecx, dword [esi + 0x10]
call fcn.004a6474
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4cb2da
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4cb306
xor eax, eax
jmp 0x4cb383
push 0xfe
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.0045abe0
add esp, 0xc
lea eax, [ebp - 0x104]
push 0xff
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4cb302
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.0045a590
mov ecx, dword [ebp - 0x298]
add esp, 0xc
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
Function at 0x4cb480
Capabilities:
Hide graphical window

Disassembly:
push 0xa4
mov eax, 0x515bcd
call fcn.004604b6
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x580], ebx
cmp dword [edi + 4], ebx
jne 0x4cb53d
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 8
push eax
mov dword [ebp - 0x9c], 0x800
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x4cb515
lea eax, [ebp - 0xb0]
mov ecx, edi
push eax
call fcn.004cb05f
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xb0]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40030000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0048b0dc
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.00487f99
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.004c034c
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0048ad32
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00488eb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.004887ca
test bl, bl
je 0x4cb579
call fcn.004cb2da
mov ecx, dword [edi + 0x10]
mov dword [ecx + 0x578], eax
mov eax, dword [edi + 0x10]
push dword [eax + 0x578]
push 0
push 0x465
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.00460474
ret 4

Function at 0x4d3b0a
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [ebp + 0xc]
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov esi, eax
cmp edi, 0x21
jb 0x4d3b58
cmp edi, 0x28
jbe 0x4d3b52
lea eax, [edi - 0x2d]
cmp eax, 1
ja 0x4d3b58
or esi, 0x100
cmp dword [ebp + 0x10], 0
je 0x4d3b64
or esi, 0x1000000
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0045abe0
add esp, 0xc
shl esi, 0x10
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.004886e2
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ed21
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d3e5e
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x51645d
call fcn.004604b6
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4d3f6e
lea eax, [ebp - 0xa4]
push eax
call fcn.004d3654
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0xa4]
xor eax, eax
push eax
sub esp, 0x10
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
mov eax, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0048b0dc
push eax
mov ecx, ebx
call fcn.00487f99
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d3f6e
mov esi, dword [ebx + 0x10]
mov ecx, esi
call fcn.004c034c
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0048ad32
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
movzx eax, word [ecx + 0x796]
push eax
movzx eax, word [ecx + 0x794]
mov ecx, ebx
push eax
call fcn.004d43a4
lea eax, [ebp - 0x94]
mov ecx, ebx
push eax
call fcn.004d3958
mov ecx, dword [ebx + 0x10]
and dword [ebp - 4], 0
add ecx, 0x1c8
push eax
call fcn.00488843
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004887ca
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x100]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x18], 1
call fcn.00460474
ret 4

Function at 0x4d5410
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4d5460
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4d545a
shr eax, 8
cmp al, 2
jne 0x4d545a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
Function at 0x4e0980
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x134]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x4e09fe
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4e09ce
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.004ebd80
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.004e0670
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x85cc], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4e0be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1a0]
test eax, eax
je 0x4e0c09
push dword [esi + 0x12c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4e0c3f
push dword [esi + 0x128]
lea eax, [eax + eax*2]
push 1
add eax, 0x52b670
push 2
push eax
call fcn.004575ca
push dword [esi + 0x128]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004575ca
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4e0e30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x590]
test esi, esi
je 0x4e0e7a
mov eax, dword [edi + 0x44]
test eax, eax
je 0x4e0e7a
push 0x4e1a90
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
push ecx
mov dword [ebp - 4], 0
push dword [eax + 0x30]
call fcn.004e92f0
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4e0e83
mov dword [edi + 0x590], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4e0e8c
mov dword [eax], esi
cmp dword [esi + 0x154], 0
mov edi, dword [esi + 0x134]
jne 0x4e0e7a
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
or ecx, 0xffffffff
test eax, eax
cmove edi, ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e1180
Capabilities:
Check os version
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x57b258]
mov dword [ebp - 0x9c], 0x4020
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 4
test eax, eax
jne 0x4e121a
push 0x94
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0045abe0
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
mov dword [0x57b258], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4e1215
cmp dword [ebp - 0x94], 6
jb 0x4e1215
mov dword [0x57b258], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
mov eax, dword [0x57b258]
cmp eax, 2
je 0x4e126e
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4e1252
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x9c]
jg 0x4e126e
push 4
lea eax, [ebp - 0x9c]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
Function at 0x4e13f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1a8], 0
mov ebx, dword [edi]
jne 0x4e1563
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4e146e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.004ebd80
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.004e0670
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x80
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4e14c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.004ebd80
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.004e0670
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0x9e]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004e1ab0
add esp, 0xc
test eax, eax
jne 0x4e1512
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.004ebd80
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004e0670
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x100]
push eax
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004e1ab0
add esp, 0xc
test eax, eax
jne 0x4e1563
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.004ebd80
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004e0670
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
push edi
call fcn.004e10c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
Function at 0x4e1dc0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp dword [esi + 0x448], eax
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4e1e1d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004e0710
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
push dword [esi + 0x44c]
mov dword [ebp - 0x10], 1
call fcn.004e9070
push dword [esi + 0x450]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.004e9070
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4e1e8d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004e0710
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044ed21
mov esp, ebp
pop ebp
ret

Function at 0x4e1ea0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
mov eax, dword [esi + 0x34c]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4e1eea
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004ebd80
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004e0710
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004e0710
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x4eb830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x4eb841
jmp dword [eax*4 + 0x4eb8b4]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret

Function at 0x4eb9d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4ebb4d
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x4ebb39
push esi
lea esp, [esp]
cmp dword [edi + 4], 2
jne 0x4ebaca
cmp dword [edi + 0x18], 0
je 0x4ebaca
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4ebaca
cmp eax, 0x10
jb 0x4ebaca
push 0x20
call dword [0x5739a0]
mov esi, eax
add esp, 4
test esi, esi
je 0x4ebb2e
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x5739a0]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4ebb1d
mov ecx, dword [edi + 0x18]
movdqu xmm0, xmmword [ecx]
movdqu xmmword [eax], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4ebab8
push eax
call dword [0x5739ac]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4ebb03
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x4ebac7
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4eba10
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x4ebae7
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x4ebb35
push ebx
call fcn.004eb980
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x5739a4]
push esi
call dword [0x5739a4]
add esp, 8
jmp 0x4ebad8
push esi
mov edi, 8
call dword [0x5739a4]
add esp, 4
jmp 0x4ebad8
mov edi, 8
jmp 0x4ebad8
test ebx, ebx
jne 0x4ebb45
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ec670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0044ed30
add esp, 0x18
test eax, eax
je 0x4ec692
cmp eax, 0xffffffff
jne 0x4ec694
xor eax, eax
pop ebp
ret

Function at 0x4ed330
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4ed37d
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.004e0670
add esp, 0xc
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4ed3a5
shr eax, 8
test al, al
jne 0x4ed3a5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.004e0670
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 2
pop esi
call fcn.0044ed21
mov esp, ebp
pop ebp
ret

Function at 0x4edbc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x134]
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4edc08
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004e0670
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push dword [esi]
call fcn.004ed4c0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret