joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov edi, edx
mov dword [ebp - 0x80], eax
mov ebx, ecx
test eax, eax
je 0x4b5bc6
test ecx, ecx
jle 0x4b5d14
xor eax, eax
lea edx, [ebp - 0x74]
mov byte [edx + eax*2 + 1], 0x20
mov byte [edx + eax*2], 0x20
inc eax
cmp ebx, eax
jg 0x4b5bd0
add eax, eax
lea ecx, [eax + 1]
mov byte [ebp + ecx - 0x74], 0
mov dword [ebp - 0x10], 0
mov byte [ebp + eax - 0x74], 0
push ecx
push ecx
push edi
push edx
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x80]
add esp, 0x10
mov esi, dword [eax + 0xc]
test esi, esi
je 0x4b5d23
cmp dword [esi], 0xe
jbe 0x4b5bd7
push edi
push 8
push 1
push str.UNKNOWN_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x18
jle 0x4b5b71
jmp 0x4b5b7f
mov eax, dword [esi]
jmp dword [eax*4 + 0x53f75c]
mov edx, dword [esi + 0x34]
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10]
call fcn.00499470
push edx
push eax
push str.ELEM__s
push edi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp - 0x10]
add esp, 0x10
test eax, eax
je 0x4b5c19
sub esp, 0xc
push eax
call dword [0x519080]
mov dword [ebp - 0x10], 0
add esp, 0x10
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + 0x10]
cmp eax, 1
je 0x4b5c34
push ecx
push eax
push str._min:__d
push edi
call sub.msvcrt.dll_fprintf
add esp, 0x10
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + 0x14]
cmp eax, 0x3fffffff
jg 0x4b5cfd
cmp eax, 1
je 0x4b5c5a
push edx
push eax
push str._max:__d
push edi
call sub.msvcrt.dll_fprintf
add esp, 0x10
push eax
push eax
push edi
push 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [esi]
sub eax, 6
add esp, 0x10
cmp eax, 2
ja 0x4b5c82
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4b5c82
lea ecx, [ebx + 1]
mov edx, edi
call fcn.004b5b50
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + 8]
test eax, eax
je 0x4b5bc6
mov ecx, ebx
mov edx, edi
call fcn.004b5b50
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push edi
push 3
push 1
push 0x53f729
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b5c19
push edi
push 6
push 1
push str.CHOICE
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b5c19
push edi
push 8
push 1
push str.SEQUENCE
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b5c19
push edi
push 3
push 1
push 0x53f72d
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b5c19
push edi
push 0xf
push 1
push str._max:_unbounded
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b5c5a
xor eax, eax
mov ecx, 1
lea edx, [ebp - 0x74]
jmp 0x4b5b84
push edi
push 0x16
push 1
push str.MISSING_particle_term_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b5bc6
Function at 0x4caf30
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
mov edi, ecx
mov ecx, dword [eax]
mov byte [ebp - 0xd], dl
mov esi, eax
mov dl, byte [ecx]
lea eax, [edx - 0x61]
cmp al, 0x19
jbe 0x4caf56
lea eax, [edx - 0x41]
cmp al, 0x19
ja 0x4cafea
lea eax, [edx - 0x61]
cmp al, 0x19
jbe 0x4cafd0
lea eax, [edx - 0x41]
cmp al, 0x19
jbe 0x4cafd0
lea eax, [edx - 0x30]
cmp al, 9
jbe 0x4cafd0
cmp dl, 0x2d
je 0x4cafd0
cmp dl, 0x2e
je 0x4cafd0
cmp dl, 0x5f
je 0x4cafd0
cmp dl, 0x7e
je 0x4cafd0
cmp dl, 0x25
je 0x4cb0ad
cmp dl, 0x21
je 0x4cafd0
cmp dl, 0x24
je 0x4cafd0
cmp dl, 0x26
je 0x4cafd0
cmp dl, 0x28
je 0x4cafd0
cmp dl, 0x29
je 0x4cafd0
cmp dl, 0x2a
je 0x4cafd0
cmp dl, 0x2b
je 0x4cafd0
cmp dl, 0x2c
je 0x4cafd0
cmp dl, 0x3b
je 0x4cafd0
cmp dl, 0x3d
je 0x4cafd0
cmp dl, 0x27
je 0x4cafd0
cmp dl, 0x3a
je 0x4cafd0
cmp dl, 0x40
jne 0x4cb0c5
lea esi, [esi]
cmp dl, byte [ebp - 0xd]
je 0x4cb0c5
cmp dl, 0x25
je 0x4cb0a3
inc ecx
mov dl, byte [ecx]
jmp 0x4caf56
lea eax, [edx - 0x30]
cmp al, 9
jbe 0x4caf56
cmp dl, 0x2d
je 0x4caf56
cmp dl, 0x2e
je 0x4caf56
cmp dl, 0x5f
je 0x4caf56
cmp dl, 0x7e
je 0x4caf56
cmp dl, 0x25
je 0x4cb0f8
cmp dl, 0x21
je 0x4caf56
cmp dl, 0x24
je 0x4caf56
cmp dl, 0x26
je 0x4caf56
cmp dl, 0x28
je 0x4caf56
cmp dl, 0x29
je 0x4caf56
cmp dl, 0x2a
je 0x4caf56
cmp dl, 0x2b
je 0x4caf56
cmp dl, 0x2c
je 0x4caf56
cmp dl, 0x3b
je 0x4caf56
cmp dl, 0x3d
je 0x4caf56
cmp dl, 0x27
je 0x4caf56
cmp dl, 0x3a
je 0x4caf56
cmp dl, 0x40
je 0x4caf56
test edi, edi
sete al
and eax, 0xff
jmp 0x4cb0c9
add ecx, 3
mov dl, byte [ecx]
jmp 0x4caf56
mov bl, byte [ecx + 1]
lea eax, [ebx - 0x30]
cmp al, 9
jbe 0x4cb0cf
lea eax, [ebx - 0x61]
cmp al, 5
jbe 0x4cb0cf
lea eax, [ebx - 0x41]
cmp al, 5
jbe 0x4cb0cf
mov dword [esi], ecx
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov bl, byte [ecx + 2]
lea eax, [ebx - 0x30]
cmp al, 9
jbe 0x4cafd0
lea eax, [ebx - 0x61]
cmp al, 5
jbe 0x4cafd0
lea eax, [ebx - 0x41]
cmp al, 5
jbe 0x4cafd0
jmp 0x4caf8d
mov bl, byte [ecx + 1]
lea eax, [ebx - 0x30]
cmp al, 9
jbe 0x4cb110
lea eax, [ebx - 0x61]
cmp al, 5
jbe 0x4cb110
lea eax, [ebx - 0x41]
cmp al, 5
ja 0x4cb097
mov bl, byte [ecx + 2]
lea eax, [ebx - 0x30]
cmp al, 9
jbe 0x4caf56
lea eax, [ebx - 0x61]
cmp al, 5
jbe 0x4caf56
lea eax, [ebx - 0x41]
cmp al, 5
jbe 0x4caf56
jmp 0x4cb02b
Function at 0x4ccb50
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, eax
mov dword [ebp - 0x10], edx
or eax, 0xffffffff
test edx, edx
je 0x4ccd10
mov ebx, dword [edx]
mov esi, ebx
lea esi, [esi]
mov dl, byte [ebx]
lea eax, [edx - 0x61]
cmp al, 0x19
jbe 0x4ccc60
lea esi, [esi]
lea eax, [edx - 0x41]
cmp al, 0x19
jbe 0x4ccc60
lea eax, [edx - 0x30]
cmp al, 9
jbe 0x4ccc60
cmp dl, 0x2d
je 0x4ccc52
cmp dl, 0x2e
je 0x4ccc52
cmp dl, 0x5f
je 0x4ccc52
cmp dl, 0x7e
je 0x4ccc52
cmp dl, 0x25
je 0x4ccc6d
cmp dl, 0x21
je 0x4ccc60
cmp dl, 0x24
je 0x4ccc60
cmp dl, 0x26
je 0x4ccc52
cmp dl, 0x28
je 0x4ccc52
cmp dl, 0x29
je 0x4ccc52
cmp dl, 0x2a
je 0x4ccc52
cmp dl, 0x2b
je 0x4ccc52
cmp dl, 0x2c
je 0x4ccc52
cmp dl, 0x3b
je 0x4ccc52
cmp dl, 0x3d
je 0x4ccc52
cmp dl, 0x27
je 0x4ccc52
cmp dl, 0x3a
je 0x4ccc52
cmp dl, 0x40
je 0x4ccc52
cmp dl, 0x2f
je 0x4ccc52
cmp dl, 0x3f
je 0x4ccc52
test edi, edi
je 0x4ccd09
mov ecx, dword [edi + 0x24]
test cl, 1
je 0x4ccca9
cmp dl, 0x7b
je 0x4ccc60
cmp dl, 0x7d
je 0x4ccc60
cmp dl, 0x7c
je 0x4ccc52
cmp dl, 0x5c
je 0x4ccc52
cmp dl, 0x5e
je 0x4ccc52
cmp dl, 0x5b
je 0x4ccc52
cmp dl, 0x5d
je 0x4ccc52
cmp dl, 0x60
jne 0x4ccca9
inc ebx
mov dl, byte [ebx]
lea eax, [edx - 0x61]
cmp al, 0x19
ja 0x4ccb80
cmp dl, 0x25
jne 0x4ccc52
add ebx, 3
jmp 0x4ccb70
mov cl, byte [ebx + 1]
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x4ccc85
lea eax, [ecx - 0x61]
cmp al, 5
jbe 0x4ccc85
lea eax, [ecx - 0x41]
cmp al, 5
ja 0x4ccc16
mov cl, byte [ebx + 2]
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x4ccc65
lea eax, [ecx - 0x61]
cmp al, 5
jbe 0x4ccc65
lea eax, [ecx - 0x41]
cmp al, 5
ja 0x4ccbcc
add ebx, 3
jmp 0x4ccb70
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4cccc5
sub esp, 0xc
push eax
call dword [0x519080]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x24]
add esp, 0x10
mov esi, dword [eax]
and ecx, 2
je 0x4ccd18
push eax
push eax
mov eax, ebx
sub eax, esi
push eax
push esi
call fcn.00483b00
add esp, 0x10
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x4cccf1
sub esp, 0xc
push eax
call dword [0x519080]
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push edx
push edx
mov edx, ebx
sub edx, eax
push edx
push eax
call fcn.00483b00
add esp, 0x10
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
push ecx
sub eax, esi
push 0
push eax
push esi
call fcn.004cb650
add esp, 0x10
mov dword [edi + 0x1c], eax
jmp 0x4cccdd
Function at 0x4ccd30
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, eax
mov dword [ebp - 0x10], edx
or eax, 0xffffffff
test edx, edx
je 0x4ccec2
mov ebx, dword [edx]
mov esi, ebx
lea esi, [esi]
mov dl, byte [ebx]
lea eax, [edx - 0x61]
cmp al, 0x19
jbe 0x4cce3e
lea esi, [esi]
lea eax, [edx - 0x41]
cmp al, 0x19
jbe 0x4cce3e
lea eax, [edx - 0x30]
cmp al, 9
jbe 0x4cce3e
cmp dl, 0x2d
je 0x4cce30
cmp dl, 0x2e
je 0x4cce30
cmp dl, 0x5f
je 0x4cce30
cmp dl, 0x7e
je 0x4cce30
cmp dl, 0x25
je 0x4cce4b
cmp dl, 0x21
je 0x4cce3e
cmp dl, 0x24
je 0x4cce3e
cmp dl, 0x26
je 0x4cce30
cmp dl, 0x28
je 0x4cce30
cmp dl, 0x29
je 0x4cce30
cmp dl, 0x2a
je 0x4cce30
cmp dl, 0x2b
je 0x4cce30
cmp dl, 0x2c
je 0x4cce30
cmp dl, 0x3b
je 0x4cce30
cmp dl, 0x3d
je 0x4cce30
cmp dl, 0x27
je 0x4cce30
cmp dl, 0x3a
je 0x4cce30
cmp dl, 0x40
je 0x4cce30
cmp dl, 0x2f
je 0x4cce30
cmp dl, 0x3f
je 0x4cce30
cmp dl, 0x5b
je 0x4cce30
cmp dl, 0x5d
je 0x4cce30
test edi, edi
je 0x4ccebb
mov ecx, dword [edi + 0x24]
test cl, 1
je 0x4cce87
cmp dl, 0x7b
je 0x4cce3e
cmp dl, 0x7d
je 0x4cce3e
cmp dl, 0x7c
je 0x4cce30
cmp dl, 0x5c
je 0x4cce30
cmp dl, 0x5e
je 0x4cce30
cmp dl, 0x60
jne 0x4cce87
nop
inc ebx
mov dl, byte [ebx]
lea eax, [edx - 0x61]
cmp al, 0x19
ja 0x4ccd60
cmp dl, 0x25
jne 0x4cce30
add ebx, 3
jmp 0x4ccd50
mov cl, byte [ebx + 1]
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x4cce63
lea eax, [ecx - 0x61]
cmp al, 5
jbe 0x4cce63
lea eax, [ecx - 0x41]
cmp al, 5
ja 0x4cce00
mov cl, byte [ebx + 2]
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x4cce43
lea eax, [ecx - 0x61]
cmp al, 5
jbe 0x4cce43
lea eax, [ecx - 0x41]
cmp al, 5
ja 0x4ccdac
add ebx, 3
jmp 0x4ccd50
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4ccea3
sub esp, 0xc
push eax
call dword [0x519080]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x24]
add esp, 0x10
mov esi, dword [eax]
and ecx, 2
je 0x4cceca
push eax
push eax
mov eax, ebx
sub eax, esi
push eax
push esi
call fcn.00483b00
add esp, 0x10
mov dword [edi + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
mov eax, ebx
sub eax, esi
push 0
push eax
push esi
call fcn.004cb650
add esp, 0x10
mov dword [edi + 0x20], eax
jmp 0x4ccebb
Function at 0x4cd4d0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.004ccee0

Function at 0x4ce770
Capabilities:
Encode data using xor

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
jle 0x4ce7b5
test eax, eax
je 0x4ce7b5
xor ebx, ebx
xor eax, eax
mov al, byte [ebx + edi]
inc ebx
lea eax, [ecx + eax]
mov edx, eax
shl edx, 0xa
add edx, eax
mov ecx, edx
shr ecx, 6
xor ecx, edx
cmp ebx, esi
jne 0x4ce784
lea eax, [ecx + ecx*8]
pop ebx
mov edx, eax
pop esi
shr edx, 0xb
pop edi
xor edx, eax
pop ebp
mov eax, edx
shl eax, 0xf
add eax, edx
ret
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4ce7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
mov edi, eax
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ecx, dword [ebp + 0xc]
test edx, edx
jle 0x4ce7fb
xor ebx, ebx
lea esi, [esi]
xor eax, eax
mov al, byte [ebx + edi]
inc ebx
lea eax, [ecx + eax]
mov edx, eax
shl edx, 0xa
add edx, eax
mov ecx, edx
shr ecx, 6
xor ecx, edx
cmp ebx, esi
jne 0x4ce7e0
mov eax, ecx
mov ebx, dword [ebp + 8]
shl eax, 0xa
lea eax, [eax + ecx + 0xe83a]
mov ecx, eax
shr ecx, 6
xor ecx, eax
test ebx, ebx
jle 0x4ce836
xor ebx, ebx
mov edx, dword [ebp - 0x10]
xor eax, eax
mov al, byte [ebx + edx]
inc ebx
lea eax, [ecx + eax]
mov edx, eax
shl edx, 0xa
add edx, eax
mov ecx, edx
shr ecx, 6
xor ecx, edx
cmp ebx, dword [ebp + 8]
jne 0x4ce817
lea eax, [ecx + ecx*8]
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 0xf
add eax, edx
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4e0550
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x11c
mov edi, eax
mov dword [ebp - 0x120], edx
mov esi, ecx
test byte [eax + 0x18], 1
jne 0x4e0578
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
je 0x4e056c
test ecx, ecx
jle 0x4e056c
xor ebx, ebx
jmp 0x4e058a
add ebx, eax
cmp esi, ebx
jle 0x4e056e
mov eax, esi
push 0
sub eax, ebx
push eax
mov eax, dword [ebp - 0x120]
add eax, ebx
push eax
mov eax, dword [edi + 0x14]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
jg 0x4e0584
inc eax
je 0x4e05ec
sub esp, 0xc
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push 0
push eax
mov eax, dword [edi + 0x14]
push 0
inc eax
mov dword [ebp - 0x14], 0x3c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x118], 1
push eax
call sub.WSOCK32.DLL_select
add esp, 0xc
jmp 0x4e0586
call fcn.004dfca0
cmp eax, 0xb
je 0x4e05aa
call fcn.004dfca0
cmp eax, 0x2733
je 0x4e05aa
push eax
push str.send_failed_n
push 0
push 0xa
call fcn.0048db10
add esp, 0x10
test ebx, ebx
jne 0x4e056e
or ebx, 0xffffffff
jmp 0x4e056e

Function at 0x4e09c0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x61f330]
test eax, eax
je 0x4e09d4
leave
ret
push eax
push eax
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
pop edx
test eax, eax
pop ecx
jne 0x4e09d2
mov eax, dword [0x61f320]
test eax, eax
je 0x4e0a02
mov dword [0x61f330], 1
leave
ret
sub esp, 0xc
mov dword [0x61f340], 0x50
push 0x544afa
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4e0a25
cmp byte [eax], 0x2a
je 0x4e0a47
sub esp, 0xc
push str.http_proxy
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4e0a4f
sub esp, 0xc
push eax
call fcn.004dffc0
add esp, 0x10
jmp 0x4e09f6
cmp byte [eax + 1], 0
je 0x4e09f6
jmp 0x4e0a25
sub esp, 0xc
push str.HTTP_PROXY
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
jne 0x4e0a39
jmp 0x4e09f6

Function at 0x4e1aa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xd0
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4e1ac0
or ebx, 0xffffffff
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
cmp dword [ebx + 0x2c], 0xffffffff
je 0x4e1ab2
lea esi, [ebp - 0xd0]
push ecx
push str.QUIT_r_n
push 0xc8
push esi
call sub.msvcrt.dll__snprintf_1
push 0
mov ecx, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4e1ae1
test edx, 0x8080
je 0x4e1b20
add dl, dl
sbb ecx, 3
sub ecx, esi
push ecx
push esi
mov edx, dword [ebx + 0x2c]
push edx
call sub.WSOCK32.DLL_send
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x4e1b28
xor ebx, ebx
jmp 0x4e1ab5
shr edx, 0x10
add ecx, 2
jmp 0x4e1b01
push eax
push str.send_failed
push 0
push 9
call fcn.0048db10
add esp, 0x10
jmp 0x4e1ab5
Function at 0x4e1df0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x114
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4e1e10
or eax, 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret
cmp dword [ebx + 0x2c], 0xffffffff
je 0x4e1e01
mov eax, dword [ebx + 0x2c]
sub esp, 0xc
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push 0
mov dword [ebp - 0x110], 1
push 0
push eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0xc], 0
inc eax
mov dword [ebp - 8], 0
push eax
call sub.WSOCK32.DLL_select
add esp, 0xc
mov edx, eax
cmp eax, 0xffffffff
je 0x4e1e6c
xor eax, eax
test edx, edx
je 0x4e1e04
mov eax, ebx
call fcn.004e1bb0
jmp 0x4e1e04
push ebx
push str.select
push 0
push 9
call fcn.0048db10
or eax, 0xffffffff
add esp, 0x10
jmp 0x4e1e04

Function at 0x4e1e90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.004e1bb0

Function at 0x4e1ea0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x214
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4e1ec0
or edx, 0xffffffff
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret
cmp dword [ebx + 0x2c], 0xffffffff
je 0x4e1eb1
sub esp, 0xc
mov eax, dword [ebx + 0x30]
push eax
call sub.WSOCK32.DLL_closesocket
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x30], 0xffffffff
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push 0
mov dword [ebp - 0x214], 1
push eax
mov dword [ebp - 0xc], 0xf
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 8], 0
inc eax
push eax
call sub.WSOCK32.DLL_select
add esp, 0xc
cmp eax, 0
jl 0x4e1f66
jne 0x4e1f4f
sub esp, 0xc
mov eax, dword [ebx + 0x2c]
push eax
call sub.WSOCK32.DLL_closesocket
xor edx, edx
add esp, 0xc
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x4e1eb4
sub esp, 0xc
push ebx
call fcn.004e1e90
add esp, 0x10
xor edx, edx
cmp eax, 2
je 0x4e1eb4
sub esp, 0xc
mov eax, dword [ebx + 0x2c]
push eax
call sub.WSOCK32.DLL_closesocket
or edx, 0xffffffff
add esp, 0xc
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x4e1eb4
Function at 0x4e20e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x190
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4e2100
or ebx, 0xffffffff
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
cmp dword [esi + 0x2c], 0xffffffff
je 0x4e20f2
mov eax, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x4e20f5
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x198]
push eax
push str.CWD__s_r_n
push 0x190
push ebx
call sub.msvcrt.dll__snprintf_1
mov byte [ebp - 9], 0
push 0
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4e2131
test edx, 0x8080
jne 0x4e2157
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebx
push ecx
push ebx
mov eax, dword [esi + 0x2c]
push eax
call sub.WSOCK32.DLL_send
add esp, 0x10
mov ebx, eax
test eax, eax
jns 0x4e2189
push eax
push str.send_failed
push 0
push 9
call fcn.0048db10
add esp, 0x10
jmp 0x4e20f5
sub esp, 0xc
push esi
call fcn.004e1e90
add esp, 0x10
cmp eax, 4
je 0x4e20f2
cmp eax, 2
sete al
xor ebx, ebx
mov bl, al
jmp 0x4e20f5
Function at 0x4e24f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x130
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4e25b3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4e25a8
sub esp, 0xc
push ebx
call fcn.004e21b0
add esp, 0x10
mov dword [ebx + 0x30], eax
inc eax
je 0x4e25b3
lea esi, [ebp - 0x134]
push ecx
push str.TYPE_I_r_n
push 0x12c
push esi
call sub.msvcrt.dll__snprintf_1
push 0
mov ecx, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4e2542
test edx, 0x8080
je 0x4e25c0
add dl, dl
sbb ecx, 3
sub ecx, esi
push ecx
push esi
mov edx, dword [ebx + 0x2c]
push edx
call sub.WSOCK32.DLL_send
add esp, 0x10
test eax, eax
jns 0x4e25c8
push eax
push str.send_failed
push 0
push 9
call fcn.0048db10
pop eax
mov esi, dword [ebx + 0x30]
push esi
call sub.WSOCK32.DLL_closesocket
mov dword [ebx + 0x30], 0xffffffff
or eax, 0xffffffff
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4e2511
lea esp, [ebp - 8]
or eax, 0xffffffff
pop ebx
pop esi
pop ebp
ret
shr edx, 0x10
add ecx, 2
jmp 0x4e2562
mov eax, ebx
call fcn.004e1bb0
cmp eax, 2
je 0x4e25d9
sub esp, 0xc
jmp 0x4e258b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4e2651
mov eax, dword [ebp + 0xc]
push eax
push str.RETR__s_r_n
push 0x12c
push esi
call sub.msvcrt.dll__snprintf_1
add esp, 0x10
mov byte [ebp - 9], 0
mov ecx, esi
push 0
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4e25ff
test edx, 0x8080
jne 0x4e2625
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, esi
push ecx
push esi
mov eax, dword [ebx + 0x2c]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
js 0x4e257b
mov eax, ebx
call fcn.004e1bb0
dec eax
jne 0x4e25d4
mov eax, dword [ebx + 0x30]
jmp 0x4e25a1
mov eax, dword [ebx + 0xc]
push eax
jmp 0x4e25e4
Function at 0x4e39d0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x61f3a0]
test eax, eax
je 0x4e39e4
leave
ret
push eax
push eax
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
pop edx
test eax, eax
pop ecx
jne 0x4e39e2
sub esp, 0xc
mov dword [0x61f360], 0x15
push str.no_proxy
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4e3a20
cmp byte [eax], 0x2a
je 0x4e3a98
sub esp, 0xc
push str.ftp_proxy
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4e3aa0
sub esp, 0xc
push eax
call fcn.004e3760
add esp, 0x10
sub esp, 0xc
push str.ftp_proxy_user
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4e3a66
sub esp, 0xc
push eax
call dword [0x519090]
add esp, 0x10
mov dword [0x61f370], eax
sub esp, 0xc
push str.ftp_proxy_password
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4e3a8c
sub esp, 0xc
push eax
call dword [0x519090]
add esp, 0x10
mov dword [0x61f380], eax
mov dword [0x61f3a0], 1
leave
ret
cmp byte [eax + 1], 0
jne 0x4e3a20
leave
ret
sub esp, 0xc
push str.FTP_PROXY
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
jne 0x4e3a34
jmp 0x4e3a40
Function at 0x4e4b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, eax
mov ebx, edx
mov edi, ecx
test edx, edx
je 0x4e4b4a
test ecx, ecx
jne 0x4e4b60
cmp byte [ebx], 5
jbe 0x4e4b52
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0xe
push 1
push str.Error_in_tree_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
test edi, edi
je 0x4e4b4a
push eax
push eax
push 0x544f8f
push esi
call fcn.00440b10
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov al, byte [ebx]
jmp dword [eax*4 + 0x544f94]
push eax
push eax
push 0x544f50
push esi
call fcn.00440b10
add esp, 0x10
jmp 0x4e4b17
mov edx, dword [ebx + 0xc]
mov al, byte [edx]
sub eax, 3
cmp al, 1
jbe 0x4e4cd5
xor ecx, ecx
mov eax, esi
call fcn.004e4b00
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x4e4c8b
mov eax, dword [ebx + 0x18]
cmp eax, 1
je 0x4e4cc5
cmp eax, 0xffffffff
je 0x4e4d29
cmp edx, eax
je 0x4e4d21
test eax, eax
js 0x4e4d08
sub esp, 0xc
lea ebx, [ebp - 0x34]
push eax
push edx
push 0x544f78
push 0x27
push ebx
call sub.msvcrt.dll__snprintf_1
add esp, 0x20
mov byte [ebp - 0xd], 0
push edx
push edx
push ebx
push esi
call fcn.00440b10
add esp, 0x10
jmp 0x4e4b36
mov edx, dword [ebx + 0xc]
mov al, byte [edx]
sub eax, 3
cmp al, 1
jbe 0x4e4ce6
xor ecx, ecx
mov eax, esi
call fcn.004e4b00
push ecx
push ecx
push 0x544f66
push esi
call fcn.00440b10
mov edx, dword [ebx + 0x14]
add esp, 0x10
mov al, byte [edx]
sub eax, 3
cmp al, 1
jbe 0x4e4c98
xor ecx, ecx
mov eax, esi
call fcn.004e4b00
jmp 0x4e4b36
mov edx, dword [ebx + 0xc]
mov al, byte [edx]
sub eax, 3
cmp al, 1
jbe 0x4e4cf7
xor ecx, ecx
mov eax, esi
call fcn.004e4b00
push eax
push eax
push 0x544f62
jmp 0x4e4c08
push eax
push eax
push str.forbidden
push esi
call fcn.00440b10
add esp, 0x10
jmp 0x4e4b36
push eax
push eax
push str.empty
push esi
call fcn.00440b10
add esp, 0x10
jmp 0x4e4b36
push eax
push eax
mov eax, dword [ebx + 0x14]
push eax
push esi
call fcn.00440e70
add esp, 0x10
jmp 0x4e4b36
cmp edx, 1
je 0x4e4ca9
mov eax, dword [ebx + 0x18]
jmp 0x4e4bab
mov ecx, 1
mov eax, esi
call fcn.004e4b00
jmp 0x4e4b36
mov eax, dword [ebx + 0x18]
cmp eax, 0xffffffff
jne 0x4e4bab
lea ebx, [ebp - 0x34]
mov byte [ebp - 0x34], 0x2b
mov byte [ebp - 0x33], 0
jmp 0x4e4bd3
lea ebx, [ebp - 0x34]
mov byte [ebp - 0x34], 0x3f
mov byte [ebp - 0x33], 0
jmp 0x4e4bd3
mov ecx, 1
mov eax, esi
call fcn.004e4b00
jmp 0x4e4b8b
mov ecx, 1
mov eax, esi
call fcn.004e4b00
jmp 0x4e4c01
mov ecx, 1
mov eax, esi
call fcn.004e4b00
jmp 0x4e4c44
push edx
push str._d_inf
lea ebx, [ebp - 0x34]
push 0x27
push ebx
call sub.msvcrt.dll__snprintf_1
add esp, 0x10
jmp 0x4e4bd3
push edx
push 0x544f6a
jmp 0x4e4d0e
lea ebx, [ebp - 0x34]
mov byte [ebp - 0x34], 0x2a
mov byte [ebp - 0x33], 0
jmp 0x4e4bd3