joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b6c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x408
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
je 0x47b7ac
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x659a18]
push eax
call edi
mov ecx, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push ebx
call ebp
mov edx, dword [0x659a18]
lea esi, [ebx + 4]
push edx
push 1
push 4
push esi
call ebp
mov eax, dword [0x659a18]
lea ecx, [esp + 0x40]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x50], 0
call ebp
mov edx, dword [esp + 0x50]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call edi
mov edx, dword [esi]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x64]
mov dword [esp + 0x60], 0
add esp, 0x48
rep stosd dword es:[edi], eax
mov ecx, dword [0x659a18]
lea eax, [esp + 0x18]
push ecx
push edx
push 4
push eax
call ebp
mov eax, dword [esi]
lea ecx, [eax + eax*2]
shl ecx, 5
push ecx
call fcn.00470b90
mov dword [ebx + 8], eax
mov eax, dword [esi]
xor edi, edi
add esp, 0x14
cmp eax, edi
jle 0x47b7ac
mov dword [esp + 0x10], edi
lea ebp, [esp + 0x18]
mov edx, dword [ebp]
mov ecx, dword [ebx + 8]
push edx
mov edx, dword [esp + 0x14]
add ecx, edx
call fcn.0047ac50
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
inc edi
add ebp, 4
add ecx, 0x60
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x47b785
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 4

Function at 0x47b9b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x47ba48
push ebx
push ebp
push edi
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push esi
call edi
mov edx, dword [0x659a18]
lea ebx, [esi + 4]
push edx
push 1
push 4
push ebx
call edi
mov eax, dword [0x659a18]
lea ebp, [esi + 8]
push eax
push 1
push 4
push ebp
call edi
mov ecx, dword [ebp]
push ecx
call fcn.00470b90
mov ecx, dword [ebp]
add esp, 0x40
mov dword [esi + 0xc], eax
mov edx, dword [0x659a18]
push edx
push ecx
push 1
push eax
call edi
mov edx, dword [ebx]
shl edx, 2
push edx
call fcn.00470b90
mov edx, dword [ebx]
mov dword [esi + 0x10], eax
mov ecx, dword [0x659a18]
push ecx
push edx
push 4
push eax
call edi
add esp, 0x24
pop edi
pop ebp
pop ebx
pop esi
ret 4
Function at 0x47ba90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x47bb41
push edi
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
push ecx
push 1
push 0x1bc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
lea eax, [esi + 0xac]
xor edx, edx
mov ecx, 0x40
lea edi, [esi + 0xb4]
mov dword [eax], edx
add esp, 0x1c
mov dword [eax + 4], edx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esi + 0x1b4], eax
mov al, byte [esi]
test al, 0x10
pop edi
je 0x47bb18
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x47bb10
lea ecx, [esi + 0x98]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x47bb12
xor eax, eax
mov dword [esi + 0x1b4], eax
test byte [esi], 0x20
jne 0x47bb29
lea edx, [esi + 0xa8]
mov dword [edx], 0
mov eax, dword [0x6b5f20]
mov dword [esi + 0x1b8], eax
mov al, byte [esi]
test al, 1
je 0x47bb41
mov ecx, esi
call fcn.0047bc30
pop esi
ret 4

Function at 0x47bec0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2000
call fcn.0051c710
mov eax, dword [esp + 0x2004]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebx, ecx
je 0x47bfc9
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push ebx
call esi
mov edx, dword [0x659a18]
lea eax, [ebx + 4]
push edx
push 1
push 2
push eax
call esi
mov ecx, dword [0x659a18]
lea edi, [ebx + 6]
push ecx
push 1
push 2
push edi
call esi
movsx eax, word [edi]
mov edx, dword [0x659a18]
lea ecx, [esp + 0x4c]
push edx
push eax
push 8
push ecx
call esi
xor ebp, ebp
add esp, 0x4c
cmp word [edi], bp
jle 0x47bfc9
lea esi, [esp + 0x14]
mov eax, dword [esi - 4]
sub eax, 0xff01
je 0x47bf94
dec eax
je 0x47bf77
dec eax
jne 0x47bfbe
push 0x21c
call fcn.00470250
add esp, 4
test eax, eax
je 0x47bfbe
mov edx, dword [esi]
mov ecx, eax
push edx
call fcn.0046ee80
jmp 0x47bfaf
push 0x208
call fcn.00470250
add esp, 4
test eax, eax
je 0x47bfbe
mov ecx, dword [esi]
push ecx
mov ecx, eax
call fcn.0046ed10
jmp 0x47bfaf
push 0x220
call fcn.00470250
add esp, 4
test eax, eax
je 0x47bfbe
mov edx, dword [esi]
mov ecx, eax
push edx
call fcn.0046e7b0
test eax, eax
je 0x47bfbe
lea ecx, [ebx + 8]
push ecx
mov ecx, eax
call fcn.0041d1d0
movsx edx, word [edi]
inc ebp
add esi, 8
cmp ebp, edx
jl 0x47bf4a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 4

Function at 0x47c0b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x47c0df
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
push ecx
push 1
push 0x58
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
pop esi
ret 4
Function at 0x47c360
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x50008
call fcn.0051c710
mov eax, dword [esp + 0x5000c]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebx, ecx
je 0x47c470
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x659a18]
push eax
call edi
mov ecx, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push ebx
call ebp
mov edx, dword [0x659a18]
lea eax, [ebx + 4]
push edx
push 1
push 2
push eax
call ebp
mov ecx, dword [0x659a18]
lea esi, [ebx + 6]
push ecx
push 1
push 2
push esi
call ebp
mov edx, dword [0x659a18]
lea eax, [esp + 0x50]
push edx
push 1
push 4
push eax
mov dword [esp + 0x60], 0
call ebp
mov ecx, dword [esp + 0x60]
mov edx, dword [0x659a18]
add esp, 0x4c
push 0
push ecx
push edx
call edi
mov ecx, 0x13fff
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov eax, dword [0x659a18]
xor ecx, ecx
mov cx, word [esi]
push eax
push ecx
lea edx, [esp + 0x2c]
push 4
push edx
call ebp
xor eax, eax
mov ax, word [esi]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*2]
shl edx, 3
push edx
call fcn.00470b90
xor edi, edi
add esp, 0x20
cmp word [esi], di
mov dword [ebx + 8], eax
jbe 0x47c470
mov dword [esp + 0x10], edi
lea ebp, [esp + 0x18]
mov eax, dword [ebp]
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x10]
push eax
add ecx, edx
call fcn.0047c0b0
mov ecx, dword [esp + 0x10]
inc edi
add ecx, 0x58
add ebp, 4
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov cx, word [esi]
cmp edi, ecx
jl 0x47c446
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50008
ret 4

Function at 0x47c640
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x408
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
je 0x47c72c
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x659a18]
push eax
call edi
mov ecx, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push ebx
call ebp
mov edx, dword [0x659a18]
lea esi, [ebx + 4]
push edx
push 1
push 4
push esi
call ebp
mov eax, dword [0x659a18]
lea ecx, [esp + 0x40]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x50], 0
call ebp
mov edx, dword [esp + 0x50]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call edi
mov edx, dword [esi]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x64]
mov dword [esp + 0x60], 0
add esp, 0x48
rep stosd dword es:[edi], eax
mov ecx, dword [0x659a18]
lea eax, [esp + 0x18]
push ecx
push edx
push 4
push eax
call ebp
mov eax, dword [esi]
lea ecx, [eax + eax*2]
shl ecx, 2
push ecx
call fcn.00470b90
mov dword [ebx + 8], eax
mov eax, dword [esi]
xor edi, edi
add esp, 0x14
cmp eax, edi
jle 0x47c72c
mov dword [esp + 0x10], edi
lea ebp, [esp + 0x18]
mov edx, dword [ebp]
mov ecx, dword [ebx + 8]
push edx
mov edx, dword [esp + 0x14]
add ecx, edx
call fcn.0047c360
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
inc edi
add ebp, 4
add ecx, 0xc
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x47c705
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 4
Function at 0x47c750
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x659a18]
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push 0
mov esi, ecx
push eax
call edi
mov ecx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 0x20
push 0x659950
call ebx
mov edx, dword [0x659964]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call edi
mov ecx, dword [0x659a18]
push ecx
push 1
push 0x14
push 0x659938
call ebx
mov edx, dword [0x659938]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call edi
mov ecx, dword [0x659a18]
add esp, 0x44
lea edx, [esp + 0xc]
push ecx
push 1
push 0x14
push edx
call ebx
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call edi
mov edx, dword [0x659a18]
push edx
push 1
push 0x340
push 0x675aa8
call ebx
add esp, 0x2c
mov ecx, 0x675aa8
call fcn.004a1e00
push eax
mov ecx, esi
call fcn.0047c830
mov eax, dword [esi + 4]
mov cx, word [esi + 8]
cmp ax, 1
jb 0x47c825
cmp cx, 1
jb 0x47c825
mov dword [0x57def0], eax
mov eax, dword [esi + 8]
mov dword [0x57def4], eax
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x47c830
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x47c880
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
push ecx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 4]
mov cx, word [esi + 8]
add esp, 0x1c
cmp ax, 1
jb 0x47c880
cmp cx, 1
jb 0x47c880
mov dword [0x659a20], eax
mov edx, dword [esi + 8]
mov dword [0x659a24], edx
pop esi
ret 4

Function at 0x47c8a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x47c953
push edi
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
push ecx
push 1
push 0x90
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov edx, dword [0x659a34]
mov eax, dword [esi]
add esp, 0x1c
test edx, eax
je 0x47c93e
mov edi, dword [esi + 0x88]
test edi, edi
je 0x47c948
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 4
test eax, eax
je 0x47c91f
mov ecx, eax
call fcn.00479c30
push edi
mov ecx, eax
mov dword [esi + 0x88], eax
call fcn.00479800
mov dword [esi + 0x8c], 0
pop edi
pop esi
ret 4
xor eax, eax
push edi
mov ecx, eax
mov dword [esi + 0x88], eax
call fcn.00479800
mov dword [esi + 0x8c], 0
pop edi
pop esi
ret 4
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
pop edi
pop esi
ret 4
Function at 0x47cb30
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1000
call fcn.0051c710
mov eax, dword [esp + 0x1004]
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov esi, ecx
je 0x47cbf5
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push ebp
push eax
mov eax, dword [0x659a18]
push eax
call edi
mov ecx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 0xc
push esi
call ebx
mov eax, dword [esi + 4]
add esp, 0x1c
cmp eax, ebp
jle 0x47cbf5
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x47cbf5
mov edx, dword [0x659a18]
push ebp
push eax
push edx
call edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebp
rep stosd dword es:[edi], eax
mov eax, dword [0x659a18]
mov ecx, dword [esi + 4]
push eax
push ecx
lea edx, [esp + 0x24]
push 4
push edx
call ebx
mov eax, dword [esi + 4]
lea eax, [eax + eax*8]
shl eax, 4
push eax
call fcn.00470b90
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
add esp, 0x20
xor edi, edi
cmp eax, ebp
jle 0x47cbf5
lea ebx, [esp + 0x10]
mov ecx, dword [ebx]
push ecx
mov ecx, dword [esi + 8]
add ecx, ebp
call fcn.0047c8a0
mov eax, dword [esi + 4]
inc edi
add ebx, 4
add ebp, 0x90
cmp edi, eax
jl 0x47cbd7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret 4

Function at 0x47dcb0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, 0x40000000
je 0x47dcf6
push edi
call fcn.0047de10
test eax, eax
je 0x47dcef
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea esi, [eax + edx]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret 0x10
pop edi
xor eax, eax
pop esi
ret 0x10
mov esi, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], 7
push 0
push ebx
push edi
call dword [sym.imp.MSVCRT.dll__lseek]
push esi
push ebp
push edi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
cmp eax, esi
je 0x47dd3b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
dec eax
test eax, eax
mov dword [esp + 0x14], eax
jg 0x47dd0c
mov ecx, dword [esp + 0x14]
mov eax, 1
test ecx, ecx
jg 0x47dd59
push esi
push ebx
push str.read_0X_X___d__d_error_
call fcn.00402b00
add esp, 0xc
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret 0x10

Function at 0x47e530
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [ecx + 4]
xor eax, eax
test ecx, ecx
je 0x47e54f
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret 8
Function at 0x47e600
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x510
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x47e69e
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0xc]
xor edx, edx
mov ecx, 5
div ecx
cmp edx, 1
jne 0x47e658
push 0
call fcn.004ae7d0
add esp, 4
mov ecx, eax
call fcn.004ae6b0
test eax, eax
je 0x47e658
cmp byte [eax], 0
jne 0x47e66b
mov edx, dword [esi + 0xc]
inc edx
mov eax, edx
mov dword [esi + 0xc], edx
and eax, 3
mov eax, dword [eax*4 + 0x56dd58]
push str._tmp_ping.txt
push eax
lea edx, [esp + 0x28]
push str.ping__s__c_1____s_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esi + 8], 2
mov eax, dword [0x6b5f20]
mov dword [esi + 0x10], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x510
ret
mov ebx, 2
cmp eax, ebx
jne 0x47e7c3
mov eax, dword [0x6b5f20]
mov edi, dword [esi + 0x10]
mov ecx, eax
sub ecx, edi
cmp ecx, 0x64
jb 0x47e6d8
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.0047e7d0
mov eax, dword [esi + 0x18]
pop edi
inc eax
mov dword [esi + 0x18], eax
pop esi
pop ebp
pop ebx
add esp, 0x510
ret
push 0x56c118
push str._tmp_ping.txt
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x47e7c3
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebp
push 0x400
lea edx, [esp + 0x128]
push 1
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [esp + 0x134]
add esp, 0x14
test eax, eax
je 0x47e7c0
mov al, byte [esp + 0x120]
test al, al
je 0x47e7c0
mov dword [esp + 0x14], ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov dword [esp + 0x18], str.ttl
mov dword [esp + 0x1c], str.error
mov dword [esp + 0x10], 1
xor edi, edi
lea ebp, [esp + 0x18]
mov ecx, dword [ebp]
lea edx, [esp + 0x120]
push ecx
push edx
call ebx
add esp, 8
test eax, eax
je 0x47e78c
cmp byte [eax], 0
jne 0x47e797
inc edi
add ebp, 4
cmp edi, 2
jae 0x47e7c3
jmp 0x47e772
mov ecx, esi
call fcn.0047e7d0
mov edi, dword [esp + edi*4 + 0x10]
cmp edi, 1
mov dword [esi + 4], edi
jne 0x47e6c6
mov dword [esi + 0x18], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x510
ret
mov dword [esi + 4], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x510
ret

Function at 0x47ea90
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0xffffffff
shl eax, 0xa
add eax, esi
mov esi, dword [esp + 0xc]
shl eax, 2
push eax
push esi
call fcn.0047e980
add esp, 8
test eax, eax
jl 0x47eacd
lea ecx, [esp + 4]
push 4
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
Function at 0x47eb60
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
mov eax, 1
mov dword [esp + 0x20], ecx
jle 0x47ebd9
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
push ebp
push ebx
call fcn.0047eae0
add esp, 8
test eax, eax
jl 0x47ebd7
mov edx, ebp
mov esi, 0x1000
and edx, 0xfff
sub esi, edx
cmp esi, edi
jl 0x47eba4
mov esi, edi
push eax
push ebx
call fcn.0047e980
mov eax, dword [esp + 0x28]
push esi
push eax
push ebx
call dword [sym.imp.MSVCRT.dll__read]
mov edx, dword [esp + 0x34]
sub edi, esi
add esp, 0x14
add ebp, esi
add edx, esi
test edi, edi
mov dword [esp + 0x20], edx
jg 0x47eb81
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x47ebe0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push 0
push eax
push ecx
call fcn.0047e9b0
mov esi, eax
add esp, 0xc
xor eax, eax
test esi, esi
jle 0x47ec3b
push 0xfffffffffffffffc
push esi
mov dword [esp + 0x14], eax
call fcn.0047e980
lea edx, [esp + 0x14]
push 4
push edx
push esi
call dword [sym.imp.MSVCRT.dll__read]
mov eax, dword [esp + 0x20]
add esp, 0x14
cmp eax, 1
jne 0x47ec3b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
push esi
call fcn.0047eb60
add esp, 0x10
pop esi
ret
Function at 0x47eff0
Capabilities:
Create tcp socket
Create udp socket
Get hostname
Initialize winsock library
Set socket configuration

Disassembly:
mov eax, 0x11b4
call fcn.0051c710
push ebp
push esi
lea eax, [esp + 0x2c]
push edi
push eax
mov edi, ecx
push 0x101
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x47f02a
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x11b4
ret 0xc
mov eax, dword [0x65a634]
mov ebp, dword [esp + 0x11c4]
cmp eax, 0x20
jne 0x47f04c
cmp byte [edi], 0
jne 0x47f04c
push 0x80
push ebp
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [esp + 0x1c0]
push 0x1000
lea edx, [esp + 0x24]
push ecx
push edx
push ebp
call fcn.004c42d0
add esp, 0x10
test eax, eax
jne 0x47f07a
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x11b4
ret 0xc
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov word [esp + 0x10], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov dx, word [edi + 2]
push edx
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47f0cf
pop edi
pop esi
or eax, eax
pop ebp
add esp, 0x11b4
ret 0xc
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0047fb40
add esp, 8
test eax, eax
push esi
jne 0x47f116
xor ecx, ecx
mov cx, word [edi + 2]
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [eax]
push edx
push str.Error:_d__IP:_s_PORT:_x_Descrip:_d
call fcn.00402b00
push esi
call fcn.004c1040
mov eax, dword [esp + 0x24]
add esp, 0x18
pop edi
pop esi
pop ebp
add esp, 0x11b4
ret 0xc
xor eax, eax
mov ax, word [edi + 2]
push eax
push ebp
push str.Connect_OK__IP:_s_PORT:_x_Descrip:_d
call fcn.00402b00
mov eax, dword [esp + 0x11d8]
add esp, 0x10
mov dword [edi + 0x158], 0
mov dword [edi + 0x164], 0
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jle 0x47f167
lea ecx, [esp + 0x11c8]
push 4
push ecx
push 0x1001
push 0xffff
push esi
call edi
mov eax, dword [esp + 0x11cc]
test eax, eax
jle 0x47f189
lea edx, [esp + 0x11cc]
push 4
push edx
push 0x1002
push 0xffff
push esi
call edi
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x11b4
ret 0xc

Function at 0x47fb40
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push 0x10
push eax
push ecx
xor esi, esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov eax, 1
je 0x47fb60
mov eax, esi
pop esi
ret

Function at 0x481c30
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
xor esi, esi
push edi
test ebx, ebx
jle 0x481c6e
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, ebx
sub eax, esi
cmp eax, 0x1000
jl 0x481c56
mov eax, 0x1000
push eax
push edi
push ebp
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x481c6e
add esi, eax
add edi, eax
cmp esi, ebx
jl 0x481c46
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4820f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
xor esi, esi
mov dword [esp + 8], esi
call fcn.00481be0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4822b6
mov esi, dword [esp + 0x14]
push ebx
push edi
mov edi, dword [esp + 0x20]
movsx ebx, word [esi + 0xc]
mov al, byte [esi + 4]
mov dword [esp + 0x20], edi
test al, al
mov dword [esp + 0x14], ebx
jne 0x48221f
mov eax, dword [esi + 8]
mov ecx, 0x659a20
mov esi, eax
and eax, 7
shr esi, 3
add esi, 0x400
mov edi, eax
mov dword [esp + 0x1c], 0
call fcn.00475680
cmp esi, eax
jae 0x482296
mov ecx, 0x659a20
shr ebx, 3
call fcn.00475680
lea ecx, [ebx + 1]
cmp ecx, eax
jae 0x482296
mov ecx, 0x659a20
call fcn.00475680
lea edx, [ebx + esi + 1]
cmp edx, eax
ja 0x482296
push 0
push esi
push ebp
call dword [sym.imp.MSVCRT.dll__lseek]
mov esi, dword [sym.imp.MSVCRT.dll__read]
lea eax, [esp + 0x28]
push 4
push eax
push ebp
call esi
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor ebx, ebx
test eax, eax
jbe 0x48228c
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi*4 + 0x659a34]
test ecx, eax
mov edx, ebx
je 0x4821d7
mov eax, dword [esp + 0x20]
and edx, 7
mov cl, byte [edx*4 + 0x659a34]
mov dl, byte [eax]
or dl, cl
jmp 0x4821eb
mov eax, dword [esp + 0x20]
and edx, 7
mov cl, byte [edx*4 + 0x659a34]
mov dl, byte [eax]
not cl
and dl, cl
inc ebx
inc edi
test bl, 7
mov byte [eax], dl
jne 0x4821f8
inc dword [esp + 0x20]
cmp edi, 0x20
jne 0x48220c
lea edx, [esp + 0x1c]
push 4
push edx
push ebp
call esi
add esp, 0xc
xor edi, edi
cmp ebx, dword [esp + 0x14]
jb 0x4821b2
mov dword [esp + 0x10], 1
jmp 0x4822a0
cmp al, 2
jne 0x4822a0
mov eax, dword [esi + 8]
lea ecx, [eax + eax + 0x400]
mov dword [esp + 0x20], ecx
mov ecx, 0x659a20
call fcn.00475680
cmp dword [esp + 0x20], eax
jae 0x482296
mov ecx, 0x659a20
add ebx, ebx
call fcn.00475680
cmp ebx, eax
jae 0x482296
mov ecx, 0x659a20
call fcn.00475680
mov ecx, dword [esp + 0x20]
lea edx, [ebx + ecx]
cmp edx, eax
ja 0x482296
push 0
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__lseek]
push ebx
push edi
push ebp
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
mov ecx, esi
push edi
call fcn.004b5660
push edi
mov ecx, esi
call fcn.004b56e0
mov dword [esp + 0x10], 1
jmp 0x4822a0
push 0xe
call fcn.0049bfc0
add esp, 4
push ebp
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
mov eax, esi
pop esi
pop ebp
add esp, 8
ret