joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d5b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2ede
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x28]
push 0x4cd56c
push eax
call fcn.00431ef0
add esp, 8
push 7
push 0
push str.Global_
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00409330
cmp eax, 0xffffffff
jne 0x43d670
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x60]
push str.Global_
push eax
call fcn.00414c50
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x43d65b
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x43d63e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00406ec0
xor eax, eax
mov dword [ebp - 0x14], 7
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00409420
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x43d670
inc eax
lea ecx, [ebp - 0x60]
push eax
push dword [ebp - 0x60]
call fcn.00406ec0
push 1
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
push eax
mov dword [ebp - 0x40], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43d712
mov eax, dword [esi + 0x18]
test eax, eax
je 0x43d6dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
xor bl, bl
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x43d6f4
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00406ec0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 0
je 0x43d6dd
mov bl, 1
jmp 0x43d6df
Function at 0x440b28
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4a3461
call fcn.00442c66
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x440c45
cmp byte [ebx + 0x3e], 0
je 0x440c45
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.00442bd7
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x440b74
xor al, al
jmp 0x440c47
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00413270
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x440ba4
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.00442bd7
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x440bd9
sub eax, 1
je 0x440bdd
dec eax
sub eax, 1
je 0x440c33
xor bl, bl
jmp 0x440c35
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x440bed
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x440c15
cmp eax, 0x10
jae 0x440bfc
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00481803
add esp, 0x10
cmp esi, eax
jne 0x440bd5
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x440c33
test esi, esi
jne 0x440b98
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00413340
jmp 0x440b92
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00409490
mov al, bl
jmp 0x440c47
mov al, 1
call fcn.00442c21
ret
Function at 0x44114c
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x4a34b6
call fcn.00442c66
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x441171
xor eax, eax
jmp 0x4412ea
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x44119d
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x44119d
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4412ea
cmp dword [esi + 0x4c], 0
je 0x4412e7
mov ecx, esi
call fcn.00440d75
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4411d0
push dword [esi + 0x4c]
push edi
call fcn.004406fe
pop ecx
pop ecx
test al, al
je 0x4412e7
movzx ebx, di
jmp 0x4412e7
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00413270
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x441208
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.00442bd7
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x4412db
cmp eax, 1
jg 0x4412b6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x441251
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x44127e
cmp eax, 0x10
jae 0x441260
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.00481803
add esp, 0x10
cmp edi, eax
jne 0x4412b1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x441281
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x4412ab
test edi, edi
jne 0x4411fc
cmp dword [ebp - 0x18], 0x20
jae 0x4412d5
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.00413340
jmp 0x4411f6
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4412d5
cmp eax, 3
jne 0x4412db
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.004406fe
pop ecx
pop ecx
test al, al
je 0x4412d5
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00409490
mov ax, bx
call fcn.00442c21
ret 4
Function at 0x443750
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4437a3
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x44379d
shr eax, 8
cmp al, 2
jne 0x44379d
call fcn.00447480
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret

Function at 0x447de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x447dfe
cmp dword [esi + 0x48], 0
je 0x447dfe
push 2
push 3
push esi
call fcn.0045bc50
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00452160
add esp, 4
test esi, esi
je 0x447e1e
cmp dword [esi + 0x48], 0
je 0x447e1e
push 3
push esi
call fcn.0045bc90
add esp, 8
pop esi
pop ebp
ret
Function at 0x4505b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x154]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x45062e
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4505fe
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.0045cab0
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.004502a0
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x8584], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x450810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x450839
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x45086f
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x4aa318
push 2
push eax
call fcn.00481803
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00481803
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4509e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x548]
test esi, esi
je 0x450a34
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x450a01
cmp dword [edi + 0x40], eax
je 0x450a34
mov dword [ebp - 8], esi
mov byte [ebp - 4], 0
test eax, eax
jne 0x450a0f
mov eax, dword [edi + 0x40]
push 0x451820
lea ecx, [ebp - 8]
add eax, 0x68
push ecx
push eax
call fcn.00456b40
add esp, 0xc
cmp byte [ebp - 4], 0
jne 0x450a3d
mov dword [edi + 0x548], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x450a46
mov dword [eax], esi
cmp byte [esi + 0x178], 0
mov edi, dword [esi + 0x154]
je 0x450a6b
push esi
call fcn.00412a40
add esp, 4
test eax, eax
jne 0x450a7e
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x450a34
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x450eb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4ce038]
mov dword [ebp - 0xa8], 0x4020
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xac], 4
push esi
test eax, eax
jne 0x450f7a
push 0x9c
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004797f0
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
mov dword [ebp - 0x9c], 6
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x450f6e
mov dword [0x4ce038], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
mov dword [0x4ce038], 1
jmp 0x450f7f
cmp eax, 2
je 0x450fcd
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x450fb3
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa8]
jg 0x450fcd
push 4
lea eax, [ebp - 0xa8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00442377
mov esp, ebp
pop ebp
ret
Function at 0x451170
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x45133d
cmp byte [edi + 0x251], 0
push esi
jne 0x451333
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4511fb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0045cab0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.004502a0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push 0
push eax
call fcn.004797f0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x451264
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0045cab0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.004502a0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xe8]
push eax
lea esi, [edi + 0xb8]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00451840
add esp, 0xc
test al, al
jne 0x4512b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0045cab0
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004502a0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x11c]
push eax
lea eax, [edi + 0xec]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00451840
add esp, 0xc
test al, al
jne 0x451333
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0045cab0
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004502a0
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
push edi
call fcn.00450df0
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00442377
mov esp, ebp
pop ebp
ret
Function at 0x451bb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x3ec], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x451c0d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00450340
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
push dword [esi + 0x3f0]
mov dword [ebp - 0x10], 1
call fcn.004597b0
push dword [esi + 0x3f4]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.004597b0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x451c7d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00450340
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00442377
mov esp, ebp
pop ebp
ret

Function at 0x451c90
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
movzx eax, byte [esi + 0x2e6]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x451cdb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0045cab0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00450340
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00450340
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x459770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00459790
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.004948d3

Function at 0x45bdd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x45bde1
jmp dword [eax*4 + 0x45be54]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret
Function at 0x45c050
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x45c1cb
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x45c1b7
push esi
nop dword [eax]
cmp dword [edi + 4], 2
jne 0x45c148
cmp dword [edi + 0x18], 0
je 0x45c148
mov eax, dword [edi + 0x10]
test eax, eax
je 0x45c148
cmp eax, 0x10
jb 0x45c148
push 0x20
call dword [0x4cc0d0]
mov esi, eax
add esp, 4
test esi, esi
je 0x45c1ac
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x4cc0d0]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x45c19b
mov ecx, dword [edi + 0x18]
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x45c136
push eax
call dword [0x4cc0dc]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x45c181
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x45c145
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x45c090
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x45c165
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x45c1b3
push ebx
call fcn.0045c010
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x4cc0d4]
push esi
call dword [0x4cc0d4]
add esp, 8
jmp 0x45c156
push esi
mov edi, 8
call dword [0x4cc0d4]
add esp, 4
jmp 0x45c156
mov edi, 8
jmp 0x45c156
test ebx, ebx
jne 0x45c1c3
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45d2d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.004886d0
add esp, 0x18
test eax, eax
je 0x45d2f2
cmp eax, 0xffffffff
jne 0x45d2f4
xor eax, eax
pop ebp
ret
Function at 0x464e70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x464ebd
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.004502a0
add esp, 0xc
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x464ee5
shr eax, 8
test al, al
jne 0x464ee5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.004502a0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 2
pop esi
call fcn.00442377
mov esp, ebp
pop ebp
ret

Function at 0x465710
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x154]
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x465758
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004502a0
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push dword [esi]
call fcn.00465000
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x465830
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x114]
jne 0x465986
push edi
lea eax, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], eax
cmp eax, edi
jae 0x465867
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x465872
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x46587d
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
mov word [ebp - 0xc], ax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [edi]
mov word [ebp - 0x14], ax
cmp ecx, edi
jae 0x4658ad
mov al, byte [ebp - 0xc]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4658ba
mov al, byte [ebp - 0xb]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4658c7
mov al, byte [ebp - 0x14]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4658d4
mov al, byte [ebp - 0x13]
mov byte [ecx], al
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4658df
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4658ea
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
lea esi, [ebx + 0x1cb0]
mov dword [ebx + 0x1eb4], eax
sub eax, esi
sub eax, 2
mov dword [edi], esi
mov edi, dword [ebp - 4]
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push edi
call fcn.00465100
add esp, 0x10
push 0
push 3
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x154]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x465942
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004502a0
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push esi
call fcn.00465770
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [esi + 0x154]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x465985
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004502a0
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret