joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c90
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x402cbb
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov byte [ebp - 0xd], 1
jmp 0x402cd0
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x402cf5
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
push eax
call fcn.004be243
add esp, 4
test eax, eax
jne 0x402cf3
mov byte [ebp - 0xd], 0
jmp 0x402cf5
jmp 0x402cc7
movzx ecx, byte [0x56b19b]
test ecx, ecx
jne 0x402df3
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x402df3
push 0x64
push 0
lea eax, [ebp - 0x78]
push eax
call fcn.004bf170
add esp, 0xc
mov dword [ebp - 0x7c], 0
push 0x4cd958
push 0
lea ecx, [ebp - 0x7c]
push ecx
call fcn.00402750
add esp, 0xc
mov dword [ebp - 0x84], eax
push 0x2e
mov edx, dword [ebp - 0x84]
push edx
call fcn.004bf0b0
add esp, 8
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x402d6e
push 0x2e
mov eax, dword [ebp - 0x80]
add eax, 1
push eax
call fcn.004bf0b0
add esp, 8
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x402d88
push 0x2e
mov ecx, dword [ebp - 0x80]
add ecx, 1
push ecx
call fcn.004bf0b0
add esp, 8
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x402df3
mov edx, dword [ebp - 0x80]
sub edx, dword [ebp - 0x84]
add edx, 1
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x84]
push ecx
lea edx, [ebp - 0x78]
push edx
call fcn.004bed60
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x88]
lea edx, [ebp + ecx - 0x78]
push edx
call fcn.004be6f0
add esp, 8
movzx eax, byte [0x56b205]
test eax, eax
je 0x402ded
lea ecx, [ebp - 0x78]
push ecx
push str._nopre___using__s__n
call fcn.0040ceb0
add esp, 8
lea edx, [ebp - 0x78]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_gethostbyname
mov esp, ebp
pop ebp
ret

Function at 0x403ba0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403bcd
mov eax, 9
jmp 0x403bf6
mov edx, dword [ebp - 0x28]
and edx, 0xfffffffe
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403bf4
mov eax, 9
jmp 0x403bf6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4091e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call fcn.00408a30
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
call fcn.004842c0
movzx eax, al
test eax, eax
je 0x409207
mov al, 1
jmp 0x409244
mov ecx, dword [ebp - 0xc]
call fcn.00478e70
test eax, eax
je 0x409217
mov al, 1
jmp 0x409244
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40922e
xor al, al
jmp 0x409244
movzx edx, byte [ebp + 8]
test edx, edx
jne 0x409242
mov eax, dword [ebp - 8]
and eax, 0x10
je 0x409242
xor al, al
jmp 0x409244
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x409f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov eax, dword [0x5290f4]
movzx ecx, byte [eax + 0x400]
mov edx, dword [0x5290f4]
mov dword [edx + ecx*4], 0x19a20000
mov eax, dword [0x5290f4]
mov cl, byte [eax + 0x400]
add cl, 1
mov edx, dword [0x5290f4]
mov byte [edx + 0x400], cl
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + 0x38]
test ecx, ecx
je 0x409f85
mov edx, dword [ebp + 0xc]
and edx, 1
je 0x409f85
mov eax, dword [ebp + 0xc]
xor eax, 1
mov dword [ebp + 0xc], eax
jne 0x409f85
mov ecx, dword [ebp - 0x28]
call fcn.00408a30
push eax
push str.cannot_read_ucs_2__buffer_too_small:__s
call fcn.0040cc80
add esp, 8
jmp 0x40a0e5
mov ecx, dword [ebp - 0x28]
call fcn.00408b90
movzx ecx, byte [eax + 0x58]
neg ecx
sbb ecx, ecx
inc ecx
mov byte [ebp - 1], cl
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.0040a0f0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x28]
call fcn.00408b90
mov byte [eax + 0x58], 1
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + 0x38]
test eax, eax
je 0x40a0e2
mov ecx, dword [ebp + 0xc]
and ecx, 1
je 0x409ff0
mov ecx, dword [ebp - 0x28]
call fcn.00408a30
push eax
push str.cannot_read_ucs_2__uneven_buffer_size:__s
call fcn.0040cc80
add esp, 8
jmp 0x40a0e5
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0x38]
cmp edx, 0xfe
jne 0x40a04a
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax]
cmp ecx, 0xff
jne 0x40a04a
mov edx, dword [ebp - 0x18]
movzx eax, byte [edx + 1]
cmp eax, 0xfe
jne 0x40a04a
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
jmp 0x40a07e
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + 0x38]
cmp eax, 0xef
jne 0x40a07e
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ecx]
cmp edx, 0xfe
jne 0x40a07e
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 1]
cmp ecx, 0xff
jne 0x40a07e
mov edx, dword [ebp - 0x18]
add edx, 2
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + 0x38]
xor edx, edx
cmp ecx, 0xfe
setne dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jae 0x40a0c4
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x10]
jae 0x40a0c4
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov cl, byte [edx]
mov byte [eax], cl
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
jmp 0x40a093
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
movzx edx, byte [ebp - 1]
test edx, edx
je 0x40a0e2
mov eax, dword [0x568904]
add eax, 1
mov dword [0x568904], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x4120c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x134], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 0x10
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x40
mov eax, dword [ebp - 4]
add eax, 0x1c
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
add edx, 0x80
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xe4], 0x67452301
mov edx, dword [ebp - 4]
mov dword [edx + 0xe8], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0xec], 0x98badcfe
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xf0], 0x10325476
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41c370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [0x566f64]
test eax, eax
je 0x41c3b4
push 0x4d1434
mov ecx, dword [ebp + 8]
push ecx
call fcn.004bfdc0
add esp, 8
test eax, eax
jne 0x41c39b
mov eax, 1
jmp 0x41c3f0
push 0x4d1438
mov edx, dword [ebp + 8]
push edx
call fcn.004bfe50
add esp, 8
neg eax
sbb eax, eax
neg eax
jmp 0x41c3f0
mov eax, dword [ebp + 8]
push eax
call fcn.00419270
add esp, 4
test eax, eax
je 0x41c3c8
xor eax, eax
jmp 0x41c3f0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41c3df
xor eax, eax
jmp 0x41c3f0
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x41c3ee
mov eax, 1
jmp 0x41c3f0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41c400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41c41b
xor eax, eax
jmp 0x41c434
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x41c42f
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x41c42f
xor eax, eax
jmp 0x41c434
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41c9d0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0xffffffff
mov edx, dword [ebp + 0x14]
mov byte [edx], 0
mov eax, dword [ebp + 0x1c]
mov byte [eax], 0
mov ecx, dword [ebp + 0x24]
mov dword [ecx], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xdc]
push edx
lea eax, [ebp - 0xe0]
push eax
push 0xbe
lea ecx, [ebp - 0xd8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x41ca76
mov eax, dword [ebp + 8]
push eax
push str.unable_to_get_volume_information_for__s_n
call fcn.0040cc80
add esp, 8
add eax, 9
jmp 0x41cb1a
mov byte [ebp - 0x1a], 0
lea ecx, [ebp - 0xd8]
push ecx
mov edx, dword [ebp - 0xe0]
push edx
push str._08lX__s
push 0x55dcf8
call fcn.004be348
add esp, 0x10
mov eax, dword [ebp + 0x20]
push eax
push 0x55dcf8
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00401d50
add esp, 0xc
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp - 0xe0]
mov dword [edx], eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xe8]
push edx
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x41caf0
mov edx, dword [ebp + 8]
push edx
push str.unable_to_get_free_space_of__s_n
call fcn.0040cc80
add esp, 8
add eax, 9
jmp 0x41cb1a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xe8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xe4]
mov dword [eax + 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xf0]
mov dword [eax], ecx
mov edx, dword [ebp - 0xec]
mov dword [eax + 4], edx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41f2b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0x144], 0
mov eax, dword [0x5294e8]
mov dword [ebp - 0x14c], eax
cmp dword [0x567108], 0
jne 0x41f305
push 4
push 0x1000
mov ecx, dword [ebp - 0x14c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x567108], eax
cmp dword [0x567108], 0
jne 0x41f305
mov eax, 0xb
jmp 0x41f488
mov edx, dword [0x567108]
mov dword [ebp - 0x150], edx
push 0
push 0x20000000
push 3
push 0
push 0
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41f33d
mov eax, 9
jmp 0x41f488
lea ecx, [ebp - 0x140]
call fcn.004120c0
mov dword [ebp - 4], 0
mov ecx, 1
test ecx, ecx
je 0x41f3fe
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x14c]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41f391
mov dword [ebp - 0x144], 0xa
jmp 0x41f3fe
cmp dword [ebp - 4], 0
ja 0x41f399
jmp 0x41f3fe
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
lea ecx, [ebp - 0x140]
call fcn.00412170
mov edx, dword [ebp - 4]
xor eax, eax
add edx, dword [0x566fe0]
mov ecx, dword [0x566fe4]
adc ecx, eax
mov dword [0x566fe0], edx
mov dword [0x566fe4], ecx
push 0
mov dl, byte [ebp + 0x10]
push edx
call fcn.004237b0
add esp, 8
movzx eax, al
test eax, eax
je 0x41f3ef
mov dword [ebp - 0x144], 8
jmp 0x41f3fe
mov ecx, 0x56b6c8
call fcn.0040c1c0
jmp 0x41f34f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x144], 0xa
jne 0x41f445
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41f445
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041f1a0
add esp, 8
mov dword [ebp - 0x154], eax
lea ecx, [ebp - 0x140]
call fcn.00412160
mov eax, dword [ebp - 0x154]
jmp 0x41f488
lea ecx, [ebp - 0x140]
call fcn.00413330
mov dword [ebp - 0x148], eax
push 0x10
mov ecx, dword [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004bed60
add esp, 0xc
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x158], eax
lea ecx, [ebp - 0x140]
call fcn.00412160
mov eax, dword [ebp - 0x158]
mov esp, ebp
pop ebp
ret
Function at 0x4351d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5290f4]
movzx ecx, byte [eax + 0x400]
mov edx, dword [0x5290f4]
mov dword [edx + ecx*4], 0x5f4b0000
mov eax, dword [0x5290f4]
mov cl, byte [eax + 0x400]
add cl, 1
mov edx, dword [0x5290f4]
mov byte [edx + 0x400], cl
movzx eax, byte [0x568e89]
test eax, eax
je 0x43521c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
jmp 0x435222
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
movzx ecx, byte [0x56b0e0]
test ecx, ecx
je 0x435239
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
movzx eax, byte [0x56b056]
test eax, eax
je 0x43528f
push 4
push 0x4d5c78
mov ecx, dword [ebp - 0x10]
push ecx
push 0x4d5c7e
mov ecx, 0x56b6c8
call fcn.0040bf50
movzx edx, byte [0x56b059]
test edx, edx
jne 0x435279
mov eax, dword [0x52916c]
push eax
mov ecx, 0x56b6c8
call fcn.0040c290
mov ecx, dword [0x56afe8]
add ecx, 1
mov dword [0x56afe8], ecx
xor eax, eax
jmp 0x4353bc
push 0
push 0x4d5c80
mov edx, dword [ebp + 8]
push edx
push 0x4d5c84
mov ecx, 0x56b6c8
call fcn.0040c230
mov dword [ebp - 8], 0
movzx eax, byte [0x56b194]
test eax, eax
je 0x4352c7
mov ecx, dword [ebp - 8]
or ecx, 0x800
mov dword [ebp - 8], ecx
movzx edx, byte [0x56b195]
test edx, edx
je 0x4352dd
mov eax, dword [ebp - 8]
or eax, 0x1000
mov dword [ebp - 8], eax
movzx ecx, byte [0x56b196]
test ecx, ecx
je 0x4352f1
mov edx, dword [ebp - 8]
or edx, 8
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x435110
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov byte [ebp - 9], al
movzx ecx, byte [ebp - 9]
test ecx, ecx
jne 0x43538f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 5
je 0x435340
cmp dword [ebp - 0x1c], 0x4d3
je 0x435364
jmp 0x435378
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push str.copy_failed__access_denied__rc_u_:__s_n
call fcn.0040cc80
add esp, 0xc
push str.make_sure_you_have_full_access_rights._maybe_you_have_to_be_administrator._n
call fcn.0040ceb0
add esp, 4
jmp 0x43538d
push 0x4d5d04
call fcn.0040cd70
add esp, 4
mov eax, 0x13
jmp 0x4353bc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
push str.copy_failed__rc_u:__s_n
call fcn.0040cc80
add esp, 0xc
jmp 0x4353ae
mov ecx, dword [0x56afe8]
add ecx, 1
mov dword [0x56afe8], ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00421e10
add esp, 8
movzx eax, byte [ebp - 9]
neg eax
sbb eax, eax
and eax, 0xfffffff7
add eax, 9
mov esp, ebp
pop ebp
ret
Function at 0x438430
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
jle 0x4384a3
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_recv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x43848f
cmp dword [ebp + 0x14], 0
je 0x43848a
push 0xffffffffffffffff
call fcn.004847a0
add esp, 4
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push str.failed_to_receive__s___s_n
call fcn.0040cc80
add esp, 0xc
or eax, 0xffffffff
jmp 0x4384a5
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x438443
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4384b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xff6
mov eax, dword [ebp + 0xc]
push eax
push 0x55dcf8
call fcn.004bfc60
add esp, 0xc
mov byte [0x55ecee], 0
push 0x4d66bc
push 0x55dcf8
call fcn.004be700
add esp, 8
cmp dword [0x56afc8], 0
je 0x4384fe
push 0x55dcf8
push str.___s
call fcn.0044d350
add esp, 8
push 0
push 0x55dcf8
call fcn.004be7f0
add esp, 4
push eax
push 0x55dcf8
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 4], eax
push 0x55dcf8
call fcn.004be7f0
add esp, 4
cmp dword [ebp - 4], eax
je 0x438538
mov eax, 9
jmp 0x43853a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x438540
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x1000
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
cmp dword [ebp - 4], 0xa
jle 0x4385c5
push 0
push 1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x438584
mov eax, 1
jmp 0x4385c7
cmp dword [ebp - 0xc], 0
jge 0x438591
mov eax, 9
jmp 0x4385c7
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
cmp dword [ebp - 8], 0
jle 0x4385c3
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
movsx ecx, byte [eax - 1]
cmp ecx, 0xa
jne 0x4385c3
jmp 0x4385c5
jmp 0x43855a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4385d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
and eax, 1
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
mov ecx, dword [ebp + 0x10]
and ecx, 4
neg ecx
sbb ecx, ecx
neg ecx
mov byte [ebp - 2], cl
movzx edx, byte [0x566fd4]
test edx, edx
jne 0x4387c1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x1000
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
cmp dword [ebp - 8], 0xa
jle 0x438678
push 0
push 1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x438644
mov eax, 9
jmp 0x4387c3
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], 0
cmp dword [ebp - 0xc], 0
jle 0x438676
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax - 1]
cmp ecx, 0xa
jne 0x438676
jmp 0x438678
jmp 0x438617
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + 3]
cmp eax, 0x2d
je 0x43868f
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
cmp edx, 0x2d
jne 0x4386de
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041af70
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4386b7
push 0
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
mov ecx, 0x567230
call fcn.004103f0
jmp 0x4386d9
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4386c8
cmp dword [0x56afc8], 0
je 0x4386d9
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4d66c8
call fcn.0044d350
add esp, 8
jmp 0x4387bc
push 5
push 0x4d66cc
mov edx, dword [ebp + 0xc]
push edx
call fcn.004bebf0
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 0xc]
push eax
call fcn.004be87b
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1f4
setge cl
mov byte [ebp - 0x16], cl
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x226
je 0x438727
jmp 0x43872b
mov byte [ebp - 0x16], 0
movzx eax, byte [ebp - 0x15]
test eax, eax
jne 0x4387ba
cmp dword [0x56afc8], 0
jne 0x438748
movzx ecx, byte [ebp - 0x16]
test ecx, ecx
je 0x4387ba
mov edx, dword [ebp + 0xc]
push edx
call fcn.004be7f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
jmp 0x438769
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x1c]
jge 0x4387a0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x20]
movsx eax, byte [edx]
push eax
call fcn.004be31a
add esp, 4
test eax, eax
je 0x43879e
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x20]
movsx edx, byte [ecx]
push edx
push 0x4d66d4
call fcn.0044d350
add esp, 8
jmp 0x438760
push 0x4d66d8
call fcn.0044d350
add esp, 4
push 0x52ba40
call fcn.004c052b
add esp, 4
jmp 0x4387c1
jmp 0x4385f4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x438ab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
shr eax, 0x18
mov byte [0x53481b], al
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
mov byte [0x53481a], cl
mov edx, dword [ebp + 0xc]
shr edx, 8
mov byte [0x534819], dl
mov al, byte [ebp + 0xc]
mov byte [0x534818], al
push 0
push 4
push 0x534818
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
je 0x438b1b
push 0xffffffffffffffff
call fcn.004847a0
add esp, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
push 0x4d672c
call fcn.0040cc80
add esp, 0xc
add eax, 9
jmp 0x438b1d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x438c40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 7
jmp 0x438c58
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x438c8b
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
mov edx, dword [ebp + 0x10]
and edx, 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x534818], cl
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov cl, 8
call fcn.004c05e0
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
jmp 0x438c4f
push 0
push 8
push 0x534818
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
je 0x438cc7
push 0xffffffffffffffff
call fcn.004847a0
add esp, 4
push eax
mov edx, dword [ebp + 0x14]
push edx
push str.failed_to_send__s___s_n
call fcn.0040cc80
add esp, 0xc
add eax, 9
jmp 0x438cc9
xor eax, eax
mov esp, ebp
pop ebp
ret