joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43afa0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43afc6
jmp 0x43b158
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43afde
jmp 0x43b158
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00463a30
add esp, 0xc
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00463a30
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0043a6c0
add esp, 8
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x424], 0
mov ecx, 1
test ecx, ecx
je 0x43b158
mov dword [ebp - 0x428], 1
mov word [ebp - 0x630], 0
push 0x206
push 0
lea edx, [ebp - 0x62e]
push edx
call fcn.00463a30
add esp, 0xc
cmp dword [ebp - 0x424], 0
jne 0x43b0b8
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
push str._s_s.del
lea edx, [ebp - 0x630]
push edx
call fcn.00466a2b
add esp, 0x10
jmp 0x43b0e1
mov eax, dword [ebp - 0x424]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
push str._s_s.del_d
lea eax, [ebp - 0x630]
push eax
call fcn.00466a2b
add esp, 0x14
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b105
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x43b12d
cmp dword [ebp - 0x424], 0xa
jl 0x43b119
jmp 0x43b158
mov eax, dword [ebp - 0x424]
add eax, 1
mov dword [ebp - 0x424], eax
jmp 0x43b055
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004693b7
add esp, 8
push 5
push 0
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x43b158
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00463a1b
mov esp, ebp
pop ebp
ret
Function at 0x43b4d0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x600], 0
push 0x206
push 0
lea eax, [ebp - 0x5fe]
push eax
call fcn.00463a30
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x600]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x600]
push edx
call fcn.0040cc70
add esp, 8
mov word [eax + 2], 0
mov dword [ebp - 0x814], 0x1f4
mov word [ebp - 0x3f0], 0
push 0x3e6
push 0
lea eax, [ebp - 0x3ee]
push eax
call fcn.00463a30
add esp, 0xc
lea ecx, [ebp - 0x600]
push ecx
push str._sxxxx.log
lea edx, [ebp - 0x808]
push edx
call fcn.00466a2b
add esp, 0xc
push str.c:log_
push str._slog.txt
lea eax, [ebp - 0x808]
push eax
call fcn.00466a2b
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x80c], ecx
mov edx, dword [ebp - 0x80c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x814]
sub ecx, 1
push ecx
lea edx, [ebp - 0x3f0]
push edx
call fcn.00469590
add esp, 0x10
mov eax, dword [ebp - 0x814]
mov word [ebp + eax*2 - 0x3f2], 0
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b5ec
mov dword [ebp - 0x810], 1
push 0x517d20
lea edx, [ebp - 0x808]
push edx
call fcn.004694ab
add esp, 8
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x43b6ca
cmp dword [ebp - 0x810], 0
jne 0x43b63f
mov word [ebp - 0x820], 0xfeff
mov eax, dword [ebp - 0x3f4]
push eax
push 2
push 1
lea ecx, [ebp - 0x820]
push ecx
call fcn.00465a20
add esp, 0x10
lea edx, [ebp - 0x3f0]
push edx
call fcn.00463dc7
add esp, 4
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x3f4]
push eax
mov ecx, dword [ebp - 0x818]
shl ecx, 1
push ecx
push 1
lea edx, [ebp - 0x3f0]
push edx
call fcn.00465a20
add esp, 0x10
mov word [ebp - 0x81c], 0xd
mov eax, dword [ebp - 0x3f4]
push eax
push 2
push 1
lea ecx, [ebp - 0x81c]
push ecx
call fcn.00465a20
add esp, 0x10
mov word [ebp - 0x81c], 0xa
mov edx, dword [ebp - 0x3f4]
push edx
push 2
push 1
lea eax, [ebp - 0x81c]
push eax
call fcn.00465a20
add esp, 0x10
mov ecx, dword [ebp - 0x3f4]
push ecx
call fcn.004663ab
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463a1b
mov esp, ebp
pop ebp
ret

Function at 0x43ccb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x43e140
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, dword [ebp - 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x43e430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x43e790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x43e466
jmp 0x43e483
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x43e471
jmp 0x43e483
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x43e490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x43e7b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x43e4c6
jmp 0x43e4e3
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x43e4d1
jmp 0x43e4e3
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x463a1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5655bc]
jne 0x463a25
repz ret
jmp fcn.0046e14c
Function at 0x472c73
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x565d30]
je 0x472c8e
inc edi
cmp edi, 0x17
jb 0x472c7f
cmp edi, 0x17
jae 0x472e0e
push ebp
push 3
call fcn.0047a0e8
cmp eax, 1
pop ecx
je 0x472dda
push 3
call fcn.0047a0e8
test eax, eax
pop ecx
jne 0x472cc2
cmp dword [0x565768], 1
je 0x472dda
cmp ebx, 0xfc
je 0x472e0d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x56b280
push ebp
call fcn.0046e3c2
add esp, 0xc
test eax, eax
je 0x472cf8
push esi
push esi
push esi
push esi
push esi
call fcn.00463afe
add esp, 0x14
push 0x104
mov esi, 0x56b299
push esi
push 0
mov byte [0x56b39d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x472d3c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0046e3c2
add esp, 0xc
test eax, eax
je 0x472d3c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00463afe
add esp, 0x14
push esi
call fcn.00463e40
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x472d81
push esi
call fcn.00463e40
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x56b594
push 0x51aff4
sub ecx, eax
push ecx
push eax
call fcn.004778ec
add esp, 0x14
test eax, eax
je 0x472d81
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00463afe
add esp, 0x14
jmp 0x472d83
xor esi, esi
push 0x51b688
push ebx
push ebp
call fcn.0047787b
add esp, 0xc
test eax, eax
je 0x472da3
push esi
push esi
push esi
push esi
push esi
call fcn.00463afe
add esp, 0x14
push dword [edi*8 + 0x565d34]
push ebx
push ebp
call fcn.0047787b
add esp, 0xc
test eax, eax
je 0x472dc5
push esi
push esi
push esi
push esi
push esi
call fcn.00463afe
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0047e4ac
add esp, 0xc
jmp 0x472e0d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x472e0d
cmp ebp, 0xffffffff
je 0x472e0d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x565d34]
push dword [esi]
call fcn.00463e40
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x479e4a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0046dae0
xor ebx, ebx
cmp dword [0x56b6bc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x479f20
push 0x51c878
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x47a000
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51c86c
push edi
call esi
cmp eax, ebx
je 0x47a000
push eax
call fcn.0046da72
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x56b6bc], eax
call esi
push eax
call fcn.0046da72
mov dword [esp], 0x51c848
push edi
mov dword [0x56b6c0], eax
call esi
push eax
call fcn.0046da72
mov dword [0x56b6c4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0046ca7c
test eax, eax
pop ecx
pop ecx
je 0x479eee
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00463afe
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x479f20
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.0046da72
cmp eax, ebx
pop ecx
mov dword [0x56b6cc], eax
je 0x479f20
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046da72
pop ecx
mov dword [0x56b6c8], eax
mov eax, dword [0x56b6c8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x479fa5
cmp dword [0x56b6cc], ecx
je 0x479fa5
push eax
call fcn.0046dae9
push dword [0x56b6cc]
mov esi, eax
call fcn.0046dae9
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x479fa5
cmp edi, ebx
je 0x479fa5
call esi
cmp eax, ebx
je 0x479f72
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x479f72
test byte [ebp - 0x18], 1
jne 0x479fa5
lea eax, [ebp - 0x10]
push eax
call fcn.0046cab3
test eax, eax
pop ecx
je 0x479f8d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00463afe
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x479f9c
or dword [ebp + 0x10], 0x200000
jmp 0x479fe0
or dword [ebp + 0x10], 0x40000
jmp 0x479fe0
mov eax, dword [0x56b6c0]
cmp eax, dword [ebp - 8]
je 0x479fe0
push eax
call fcn.0046dae9
cmp eax, ebx
pop ecx
je 0x479fe0
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x479fe0
mov eax, dword [0x56b6c4]
cmp eax, dword [ebp - 8]
je 0x479fe0
push eax
call fcn.0046dae9
cmp eax, ebx
pop ecx
je 0x479fe0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x56b6bc]
call fcn.0046dae9
cmp eax, ebx
pop ecx
je 0x47a000
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47a002
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47e4ac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0046dae0
xor ebx, ebx
cmp dword [0x56b934], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x47e582
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x47e662
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x47e662
push eax
call fcn.0046da72
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x56b934], eax
call esi
push eax
call fcn.0046da72
mov dword [esp], 0x51c848
push edi
mov dword [0x56b938], eax
call esi
push eax
call fcn.0046da72
mov dword [0x56b93c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0046ca7c
test eax, eax
pop ecx
pop ecx
je 0x47e550
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00463afe
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x47e582
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0046da72
cmp eax, ebx
pop ecx
mov dword [0x56b944], eax
je 0x47e582
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046da72
pop ecx
mov dword [0x56b940], eax
mov eax, dword [0x56b940]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x47e607
cmp dword [0x56b944], ecx
je 0x47e607
push eax
call fcn.0046dae9
push dword [0x56b944]
mov esi, eax
call fcn.0046dae9
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x47e607
cmp edi, ebx
je 0x47e607
call esi
cmp eax, ebx
je 0x47e5d4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47e5d4
test byte [ebp - 0x18], 1
jne 0x47e607
lea eax, [ebp - 0x10]
push eax
call fcn.0046cab3
test eax, eax
pop ecx
je 0x47e5ef
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00463afe
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x47e5fe
or dword [ebp + 0x10], 0x200000
jmp 0x47e642
or dword [ebp + 0x10], 0x40000
jmp 0x47e642
mov eax, dword [0x56b938]
cmp eax, dword [ebp - 8]
je 0x47e642
push eax
call fcn.0046dae9
cmp eax, ebx
pop ecx
je 0x47e642
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x47e642
mov eax, dword [0x56b93c]
cmp eax, dword [ebp - 8]
je 0x47e642
push eax
call fcn.0046dae9
cmp eax, ebx
pop ecx
je 0x47e642
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x56b934]
call fcn.0046dae9
cmp eax, ebx
pop ecx
je 0x47e662
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47e664
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x484cb4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00484c49
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00463a30
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x484d03
cmp dword [ebp - 0x1c], 5
jb 0x484d1b
jmp 0x484d17
cmp dword [ebp - 0x10], 1
jne 0x484d1b
cmp dword [ebp - 0x1c], 4
ja 0x484d17
jne 0x484d1b
cmp dword [ebp - 0x18], 0
jbe 0x484d1b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x51d208
call fcn.0042aec0
test eax, eax
jge 0x484d3c
mov byte [0x56c344], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00463a1b
add ebp, 0x78
leave
ret

Function at 0x484d80
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5655bc]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x484dd0
mov ax, word [esp]
cmp al, 2
jne 0x484dca
cmp ah, al
jne 0x484dca
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00463a1b
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.00463a1b
add esp, 0x194
ret

Function at 0x4908b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4908e2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x490a30
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x164]
test ecx, ecx
je 0x490a4b
mov edx, dword [esi + 0xf4]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x490a7f
cmp eax, 2
jg 0x490a7f
mov ecx, dword [esi + 0xf0]
push ecx
push 1
lea edx, [eax + eax*2 + 0x51e364]
push 2
push edx
call fcn.00465a20
mov eax, dword [esi + 0xf0]
push eax
push 1
push edi
push ebx
call fcn.00465a20
add esp, 0x20
xor eax, eax
ret
Function at 0x490d90
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x130]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebx], 0
jne 0x490e0d
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x490de4
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.00494c90
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.00490c10
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x856c], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4915d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x5655bc]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
mov ebp, dword [esp + 0x118]
cmp dword [ebp + 0x19c], 0
push esi
push edi
mov edi, dword [ebp]
mov dword [esp + 0x14], edi
jne 0x49170b
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x49164c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.00494c90
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.00490c10
add esp, 0x18
jmp 0x491714
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x49168c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.00494c90
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.00490c10
add esp, 0x18
jmp 0x491714
lea ebx, [ebp + 0xcc]
lea edi, [ebp + 0x9e]
lea esi, [esp + 0x18]
call fcn.00491590
test eax, eax
jne 0x4916ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.00494c90
mov ecx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.00490c10
add esp, 0x18
jmp 0x491714
lea ebx, [ebp + 0x100]
lea edi, [ebp + 0xd0]
lea esi, [esp + 0x98]
call fcn.00491590
test eax, eax
jne 0x49170b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.00494c90
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.00490c10
add esp, 0x18
jmp 0x491714
push ebp
call fcn.00491530
add esp, 4
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00463a1b
add esp, 0x10c
ret

Function at 0x491730
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x491773
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00494c90
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00490b80
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00490b80
add esp, 8
pop esi
pop ecx
ret

Function at 0x491790
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x1c], 0x4020
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4917d9
mov edx, dword [esp + 4]
cmp edx, dword [esp + 8]
jg 0x4917f1
push 4
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
add esp, 0xc
ret
Function at 0x491800
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x530]
cmp eax, 0xffffffff
je 0x491859
mov ecx, dword [ecx + 0x524]
mov edx, dword [ecx]
cmp dword [edx + eax*4], 0
lea eax, [edx + eax*4]
je 0x491859
mov ecx, dword [esp + 8]
test ecx, ecx
mov eax, dword [eax]
je 0x49182c
mov dword [ecx], eax
cmp dword [eax + 0x148], 0
push esi
mov esi, dword [eax + 0x130]
jne 0x491850
push 2
push 1
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x491855
or eax, 0xffffffff
pop esi
ret
mov eax, esi
pop esi
ret
or eax, 0xffffffff
ret
Function at 0x4932a0
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x493344
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x493315
cmp word [ecx + 0xa], 4
jne 0x493315
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x493315
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.00493230
test eax, eax
mov dword [esi], eax
je 0x493338
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x4932f0
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.004778ec
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x493354.11001
jmp dword [eax*4 + 0x493378]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18