joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d4a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fb4cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x54a020]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xc], 0
jne 0x42d511
push 0x10
call sub.MFC80.DLL_Ordinal_265
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x42d504
push 0x42c460
push 0x42c450
push 3
lea esi, [eax + 4]
push 4
push esi
mov dword [eax], 3
call fcn.0042bcac
jmp 0x42d506
xor esi, esi
mov dword [esp + 0x18], 0xffffffff
mov dword [edi + 0xc], esi
mov eax, dword [esp + 0x24]
test eax, eax
mov ecx, dword [esp + 0x20]
jbe 0x42d527
cmp byte [ecx + eax - 1], 0xa
jne 0x42d527
sub eax, 1
push eax
mov eax, dword [edi + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
lea ecx, [eax + ecx*4]
call fcn.0042cdc0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x4320d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4fbb69
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54a020]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x74], bl
jne 0x432104
xor al, al
jmp 0x432108
mov al, byte [esp + 0x58]
mov ecx, dword [esp + 0x50]
mov ebp, dword [esp + 0x4c]
mov dword [esi + 0x48], ecx
lea ecx, [esi + 0x58]
push 0x533e66
mov dword [esi + 0x44], ebp
mov byte [esi + 0x78], al
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea ecx, [esi + 0x14]
call fcn.00406740
cmp dword [esi + 0x10], ebx
je 0x432159
lea ecx, [ecx]
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x432154
add eax, 0xffffffff
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x432154
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x10], ebx
jne 0x432140
mov edi, dword [esp + 0x54]
lea edx, [esp + 0x58]
push edx
mov ecx, esi
mov dword [esp + 0x5c], edi
call fcn.00430000
mov ecx, esi
mov dword [0x55d928], ebx
call fcn.00431ae0
cmp byte [esi + 0x74], bl
mov byte [esp + 0x58], al
je 0x4321a0
mov ebp, 0xc
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.0042f5e0
cmp dword [esp + 0x14], ebp
je 0x432188
mov ebp, dword [esp + 0x4c]
jmp 0x4321ac
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0042f5e0
cmp byte [esi + 0x78], bl
je 0x4321c3
cmp dword [esi + 0x6c], ebx
je 0x4321c3
push 2
lea eax, [esi + 0x58]
push eax
mov ecx, edi
call fcn.0042d550
cmp byte [esi + 0x75], bl
je 0x43222d
mov ecx, edi
call fcn.0042c640
test al, al
jne 0x43222d
mov ecx, edi
call fcn.0042c650
test al, al
jne 0x43222d
mov edx, dword [esp + 0x50]
push str.A_valid_JSON_document_must_be_either_an_array_or_an_object_value.
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xd
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], edx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x50], ebx
call fcn.004309a0
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
jmp 0x432231
mov al, byte [esp + 0x58]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0x10
Function at 0x4328b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x432900
mov ax, word [esp]
cmp al, 2
jne 0x4328fa
cmp ah, al
jne 0x4328fa
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x194
ret
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.0042b7d2
add esp, 0x194
ret
Function at 0x434e50
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x445630
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 0x168]
push 2
push 1
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
je 0x4456a8
cmp eax, 1
jne 0x445659
mov eax, 1
ret
cmp eax, 0xffffffff
jne 0x4456ab
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x445653
cmp eax, 0xb
je 0x445653
cmp eax, 0x2733
je 0x445653
cmp eax, 0x2746
je 0x4456a8
cmp eax, 0x2745
je 0x4456a8
cmp eax, 0x2742
je 0x4456a8
cmp eax, 0x2744
je 0x4456a8
cmp eax, 0x274a
je 0x4456a8
cmp eax, 0x274c
je 0x4456a8
cmp eax, 0x2749
jne 0x4456ab
xor eax, eax
ret
or eax, 0xffffffff
ret
Function at 0x43f6f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x43f722
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x43f880
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
push ebp
mov ebp, dword [esp + 8]
je 0x43f8a1
mov edx, dword [esi + 0x134]
push edx
push ebx
push ebp
push eax
push esi
call ecx
add esp, 0x14
pop ebp
ret
test eax, eax
jl 0x43f8d7
cmp eax, 2
jg 0x43f8d7
mov ecx, dword [esi + 0x130]
push edi
mov edi, dword [sym.imp.MSVCR80.dll_fwrite]
push ecx
push 1
lea edx, [eax + eax*2 + 0x504d10]
push 2
push edx
call edi
mov eax, dword [esi + 0x130]
push eax
push 1
push ebx
push ebp
call edi
add esp, 0x20
pop edi
xor eax, eax
pop ebp
ret

Function at 0x43f8e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x2f0], 0
push edi
je case.default.0x43f944
test eax, eax
je case.default.0x43f944
mov eax, dword [eax + 0x9c]
test eax, eax
je case.default.0x43f944
mov edx, dword [esp + 0xbc]
add edx, 0xffffffff
cmp edx, 3
mov ecx, str.Data
ja case.default.0x43f944
jmp dword [edx*4 + 0x43fa10]
mov ecx, str.Header
mov edx, str.from
jmp 0x43f961
mov ecx, str.Header
mov edx, 0x504d34
push eax
push edx
push ecx
push str.__s__s__s_
lea eax, [esp + 0x20]
push 0xa0
push eax
call fcn.00443970
lea eax, [esp + 0x28]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43f982
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x43f9e2
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x43f9c9
mov ebx, dword [esp + 0xc4]
mov eax, dword [esp + 0xbc]
push ebp
call fcn.0043f880
add esp, 4
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042b7d2
add esp, 0xa4
ret
mov eax, dword [esi + 0x130]
mov ebx, dword [sym.imp.MSVCR80.dll_fwrite]
push eax
push 1
push 2
push 0x504d10
call ebx
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [esp + 0x28]
push edi
push edx
call ebx
add esp, 0x20
jmp case.default.0x43f944
Function at 0x43ff00
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [eax + 0x2b8]
push ebx
mov ebx, dword [eax + ecx*4 + 0x168]
push esi
lea esi, [ecx + 0x19]
shl esi, 4
add esi, eax
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x43ffa9
cmp dword [eax + ecx*4 + 0x180], 0x43fc40
jne 0x43ffa9
cmp dword [esi], 0
je 0x43ff3e
test edi, edi
je 0x43ffa9
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00433e40
add esp, 0x10
cmp eax, 0xffffffff
je 0x43ffa9
test al, 1
je 0x43ffa9
cmp dword [esi], 0
jne 0x43ff87
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x54a0e0]
mov edi, dword [esi + 4]
add esp, 4
test eax, eax
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x43ffa2
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jle 0x43ffa9
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
ret

Function at 0x43ffb0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi + ecx*4 + 0x168]
mov eax, esi
call fcn.0043ff00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WSOCK32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebx], 0
jne 0x440034
push ebp
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x44000b
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.004335e0
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.0043fab0
mov eax, dword [esi]
mov dword [eax + 0x8630], ebp
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x441cb0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x47c], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jge 0x441cee
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0043fa20
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x480]
push edx
mov dword [esp + 0xc], 1
call fcn.00444500
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x484]
push eax
call fcn.00444500
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x441d67
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0043fa20
add esp, 0x10
add esp, 0x14
ret
Function at 0x442350
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x8c], 2
push edi
mov edi, dword [ebp]
mov dword [esp + 0xc], edi
je 0x4424d2
cmp dword [ebp + 0x234], 0
push ebx
push esi
jne 0x4424c7
cmp dword [ebp + 0x29c], 0
jne 0x4424c7
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WSOCK32.dll_getpeername]
test eax, eax
je 0x4423e9
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.004335e0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.0043fab0
add esp, 0x18
jmp 0x4424d0
push ebx
lea edx, [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x1c], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
je 0x442436
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.004335e0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.0043fab0
add esp, 0x18
jmp 0x4424d0
lea edi, [ebp + 0xcc]
lea ebx, [ebp + 0xfc]
lea esi, [esp + 0x98]
call fcn.00442310
test eax, eax
jne 0x442477
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.004335e0
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.0043fab0
add esp, 0x18
jmp 0x4424d0
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0xcc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x130]
lea edi, [ebp + 0x100]
lea esi, [esp + 0x18]
call fcn.00442310
test eax, eax
jne 0x4424c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.004335e0
push eax
mov eax, dword [esp + 0x20]
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.0043fab0
add esp, 0x18
jmp 0x4424d0
push ebp
call fcn.004422b0
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.0042b7d2
add esp, 0x10c
ret

Function at 0x4424f0
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jge 0x442539
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push edi
call fcn.004335e0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0043fa20
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0043fa20
add esp, 8
pop edi
pop esi
ret
Function at 0x442550
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x55da94]
test eax, eax
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
jne 0x4425a0
push 3
push 2
push eax
push 6
call fcn.00462510
add esp, 0x10
test eax, eax
je 0x442594
mov dword [0x55da94], 2
add esp, 0xc
ret
mov dword [0x55da94], 1
jmp 0x4425a5
cmp eax, 2
je 0x4425ec
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WSOCK32.dll_getsockopt]
test eax, eax
jne 0x4425d3
mov edx, dword [esp + 4]
cmp edx, dword [esp + 8]
jg 0x4425eb
push 4
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
pop esi
add esp, 0xc
ret

Function at 0x442610
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x5f0]
test esi, esi
je 0x442669
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x44262f
cmp dword [edi + 0x40], eax
je 0x442669
test eax, eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
jne 0x442642
mov eax, dword [edi + 0x40]
push 0x4425f0
lea ecx, [esp + 0xc]
add eax, 0x68
push ecx
push eax
call fcn.0045f6b0
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x442672
mov dword [edi + 0x5f0], 0
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44267c
mov dword [eax], esi
cmp dword [esi + 0x1b0], 0
mov edi, dword [esi + 0x168]
je 0x4426a1
push esi
call fcn.00434e50
add esp, 4
test eax, eax
jne 0x4426ba
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
cmp edi, 0xffffffff
je 0x4426ba
push 2
push 1
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
je 0x442669
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x449790
Capabilities:
Resolve dns

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [esp + 8]
push eax
push esi
push 2
xor edi, edi
call fcn.00461ce0
add esp, 0xc
test eax, eax
jle 0x4497c6
mov ecx, dword [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push 2
call fcn.00449680
add esp, 0x10
pop edi
pop esi
pop ecx
ret
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x4497e1
mov ecx, dword [esp + 0x14]
push ecx
push eax
call fcn.00449550
add esp, 8
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x450f60
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x533ed8
push ecx
call fcn.0043fa20
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.004500f0
test eax, eax
jne 0x450f90
mov eax, esi
jmp fcn.00450530
ret
Function at 0x452650
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x168]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jge 0x452694
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0043fab0
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.00452540
add esp, 4
pop esi
pop ecx
ret
Function at 0x453360
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [esp + 4], eax
jne 0x4534d2
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
cmp edi, ebp
mov dword [ebp], edi
jae 0x45339a
mov byte [edi], 0xff
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4533a8
mov byte [eax], 0xfa
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4533b6
mov byte [eax], 0x1f
add dword [ebp], 1
movzx ecx, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WSOCK32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4533eb
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4533fc
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x453409
mov byte [eax], cl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x453416
mov byte [eax], ch
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x453424
mov byte [eax], 0xff
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x453432
mov byte [eax], 0xf0
add dword [ebp], 1
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov ecx, eax
sub ecx, edi
sub ecx, 2
push ecx
mov dword [ebx + 0x1eb4], eax
lea eax, [ebx + 0x1cb2]
push 0x3e
mov dword [ebp], edi
call fcn.004528b0
mov ebp, dword [sym.imp.WSOCK32.dll_send]
add esp, 8
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov edx, dword [edi + 0x168]
push edx
call ebp
test eax, eax
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jge 0x453491
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.0043fab0
add esp, 0xc
lea ecx, [ebx + 0x1cb3]
push 4
push ecx
call fcn.00453140
mov edx, dword [edi + 0x168]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push edx
call ebp
test eax, eax
jge 0x4534cf
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.0043fab0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x454080
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 0x16c]
mov ebp, dword [esi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
or edi, 0xffffffff
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x4540d7
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.004426d0
add esp, 8
cmp edi, 0xffffffff
jne 0x45410c
push str.Error_accept__ing_server_connect
push ebp
call fcn.0043fab0
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1e
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x18
ret
push str.Connection_accepted_from_server_n
push ebp
call fcn.0043fa20
push 1
push edi
mov dword [esi + 0x258], 0
mov dword [esi + 0x16c], edi
call fcn.004627c0
mov dword [esi + 0x17c], 1
mov eax, dword [ebp + 0x1b0]
add esp, 0x10
test eax, eax
je 0x454176
mov ecx, dword [ebp + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x454176
call fcn.00453fb0
pop edi
pop esi
pop ebp
mov eax, 0x2a
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042b7d2
add esp, 0x18
ret
Function at 0x457b30
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x457b66
push str.Couldnt_set_desired_mode
push ebx
call fcn.0043fab0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x457b7d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0043fa20
add esp, 0xc
cmp ebp, 0x13
jne 0x457b91
push edi
call fcn.00457ab0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x457ba5
push edi
call fcn.00454ba0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x457bbd
push 0xd
push 1
push edi
call fcn.00456e00
add esp, 0xc
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x457bd1
push 0xe
push 1
push edi
call fcn.00456e00
add esp, 0xc
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x45ea90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call dword [sym.imp.MSVCR80.dll_getenv]
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x45eaf6
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x45eaf6
lea edx, [esp]
push edx
call dword [0x54a0ec]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0042b7d2
add esp, 0x108
ret
jmp 0x45ea90

Function at 0x45eb10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call dword [sym.imp.MSVCR80.dll_getenv]
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x45eaf6
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x45eaf6
lea edx, [esp]
push edx
call dword [0x54a0ec]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0042b7d2
add esp, 0x108
ret
jmp 0x45ea90
Function at 0x4629b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x4629c9
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0043f510
push edx
push eax
call fcn.0043f540
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x462a16
mov eax, dword [ebx + 0x15c]
mov ecx, dword [ebx + 0x158]
push eax
push ecx
call fcn.0043f510
push edx
push eax
call fcn.0043f540
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x462a18
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x463a60
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x463a93
push 0x2e
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
add esp, 8
test eax, eax
je 0x463a91
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret