joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0020
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4c019d
push esi
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x4c0189
push edi
nop dword [eax]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c007e
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c0070
sub eax, edx
lea ecx, [eax + 1]
jmp 0x4c0080
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 8], ecx
cmp eax, 2
jne 0x4c0092
mov eax, 0x10
jmp 0x4c00a0
cmp eax, 0x17
jne 0x4c0145
mov eax, 0x1c
cmp dword [esi + 0x18], 0
mov dword [ebp - 4], eax
je 0x4c0145
mov edx, dword [esi + 0x10]
test edx, edx
je 0x4c0145
cmp edx, eax
jb 0x4c0145
add ecx, 0x20
add eax, ecx
push eax
call dword [0x6ba08c]
mov edi, eax
add esp, 4
test edi, edi
je 0x4c017e
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x20]
push ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x18]
push eax
call fcn.005e0960
mov edx, dword [ebp - 8]
add esp, 0xc
test edx, edx
je 0x4c0133
mov eax, dword [edi + 0x18]
add eax, dword [ebp - 4]
push edx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.005e0960
add esp, 0xc
mov eax, dword [ebp - 0xc]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0x4c0142
mov dword [eax + 0x1c], edi
mov dword [ebp - 0xc], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4c0060
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
pop edi
test eax, eax
je 0x4c0162
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x4c0185
push ebx
call fcn.004bfff0
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 8
jmp 0x4c0153
test ebx, ebx
jne 0x4c0195
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c05a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.005f3fd0
add esp, 0x18
test eax, eax
je 0x4c05c2
cmp eax, 0xffffffff
jne 0x4c05c4
xor eax, eax
pop ebp
ret
Function at 0x4c3a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6c4705], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x15c], ebx
jne 0x4c3a36
call fcn.004c4290
test al, al
je 0x4c3a47
mov byte [0x6c4705], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x5a8]
test eax, eax
je 0x4c3a68
push 0x400
push eax
call fcn.005270d0
add esp, 8
call fcn.004c4290
test al, al
jne 0x4c3a36
push esi
push edi
nop word [eax + eax]
mov esi, 2
mov dword [ebp - 0x154], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x150], eax
nop
lea eax, [ebp - 0x18c]
push eax
call fcn.004b20e0
push 0
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x17c], xmm0
movups xmmword [ebp - 0x16c], xmm0
call fcn.004bb7d0
movups xmm1, xmmword [ebp - 0x17c]
add esp, 0xc
lea ecx, [esi - 1]
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
push eax
movd eax, xmm1
push eax
push 0
push ecx
call fcn.0060b8b0
imul esi, dword [ebp - 0x164]
mov edi, eax
lea eax, [ebp - 0x19c]
mov ebx, edx
push eax
mov dword [ebp - 0x158], esi
call fcn.004b20e0
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1ac]
push eax
call fcn.004b20e0
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, esi
cdq
add eax, dword [ecx]
push 0
push dword [ebp - 0x14c]
adc edx, dword [ecx + 4]
push edx
push eax
call fcn.0060b8b0
shld edx, eax, 8
shl eax, 8
xor ebx, edx
xor edi, eax
mov dword [ebp - 0x168], ebx
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x16c], edi
push eax
call fcn.004b20e0
lea esi, [eax + 8]
lea eax, [ebp - 0x1cc]
push eax
call fcn.004b20e0
add esp, 8
mov ecx, dword [eax]
add ecx, dword [esi]
mov eax, dword [ebp - 0x148]
mov esi, dword [ebp - 0x14c]
add eax, 2
imul ecx, eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x148], esi
shl ecx, 0x10
xor eax, ecx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x150]
movups xmm0, xmmword [ebp - 0x16c]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x154], 1
mov dword [ebp - 0x150], eax
jne 0x4c3a90
movsd xmm0, qword [0x61c2a0]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.005263e0
add esp, 0x10
call fcn.004c4290
test al, al
je 0x4c3a70
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.00526f20
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x4c3c2c
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.005270d0
add esp, 8
call fcn.004c4290
test al, al
jne 0x4c3a36
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [ebp - 0x15c]
call fcn.004ae5f0
add esp, 8
call fcn.004c4290
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
Function at 0x4c9b40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
mov byte [ebp + 0xa], cl
lea ecx, [ebp + 8]
push 3
mov eax, dword [esi + 0xc]
push ecx
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c9b88
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004ae530
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push esi
call fcn.004c9430
add esp, 0x10
pop esi
pop ebx
pop ebp
ret

Function at 0x4c9cc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x134]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
jne 0x4c9e1e
push edi
lea eax, [ebx + 0x1cb4]
lea edi, [ebx + 0x1eb4]
mov dword [edi], eax
cmp eax, edi
jae 0x4c9cf8
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c9d03
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c9d0e
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
mov word [ebp - 0xc], ax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [edi]
mov word [ebp - 0x14], ax
cmp ecx, edi
jae 0x4c9d3e
mov al, byte [ebp - 0xc]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4c9d4b
mov al, byte [ebp - 0xb]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4c9d58
mov al, byte [ebp - 0x14]
mov byte [ecx], al
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x4c9d65
mov al, byte [ebp - 0x13]
mov byte [ecx], al
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c9d70
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c9d7b
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
lea ecx, [ebx + 0x1cb4]
mov esi, dword [ebp + 8]
mov dword [ebx + 0x1eb8], eax
sub eax, ecx
sub eax, 2
mov dword [edi], ecx
push eax
lea eax, [ebx + 0x1cb6]
push eax
push 0x3e
push esi
call fcn.004c9530
add esp, 0x10
lea eax, [ebx + 0x1cb4]
push 0
push 3
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x4c9ddb
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004ae530
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb7]
push eax
push esi
call fcn.004c9ba0
add esp, 0xc
lea eax, [ebx + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c9e1c
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004ae530
add esp, 0xc
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9f80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x104]
push esi
push edi
push 0x80
push 0
push eax
mov dword [ebp - 0x908], ebx
call fcn.005e1e60
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.005e1e60
mov esi, dword [ebx + 0x134]
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x90c], edi
mov eax, dword [esi + 0x1eb8]
sub eax, dword [esi + 0x1eb4]
add eax, 2
push eax
lea eax, [esi + 0x1cb4]
push eax
push 0x3c
push ebx
call fcn.004c9530
mov eax, dword [esi + 0x1eb4]
add esp, 0x28
movzx ecx, byte [eax]
inc eax
mov dword [esi + 0x1eb4], eax
cmp ecx, 0x18
je 0x4ca168
cmp ecx, 0x23
je 0x4ca142
cmp ecx, 0x27
jne 0x4ca1f6
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.004bdac0
mov esi, dword [esi + 0x1cb0]
add esp, 0x1c
mov edi, 4
mov eax, 0x800
test esi, esi
je 0x4ca0e1
nop
mov edx, dword [esi]
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ca067
sub ecx, ebx
lea ebx, [edi + 1]
add ebx, ecx
cmp ebx, 0x7fa
jae 0x4ca0cf
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
push str._127_____127s
push edx
call fcn.0040b679
add esp, 0x10
test eax, eax
je 0x4ca0cf
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, 0x800
sub eax, edi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x904]
add eax, edi
push eax
call fcn.004bdac0
add esp, 0x1c
mov edi, ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x4ca060
mov ebx, dword [ebp - 0x908]
mov eax, 0x800
push 0xf0
push 0xff
sub eax, edi
push str._c_c
push eax
lea eax, [ebp - 0x904]
add eax, edi
push eax
call fcn.004bdac0
add esp, 0x14
lea eax, [edi + 2]
push 0
push eax
lea eax, [ebp - 0x904]
push eax
mov eax, dword [ebp - 0x90c]
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4ca13c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004ae530
add esp, 0xc
push edi
jmp 0x4ca1e4
lea edx, [esi + 0x1c28]
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ca150
push 0xf0
push 0xff
push edx
push 0
push 0x23
jmp 0x4ca189
lea edx, [esi + 0x1c08]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ca173
push 0xf0
push 0xff
push edx
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
sub ecx, esi
lea eax, [ebp - 0x904]
push 0x800
push eax
lea esi, [ecx + 6]
call fcn.004bdac0
add esp, 0x28
lea eax, [ebp - 0x904]
push 0
push esi
push eax
push dword [edi + 0x148]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4ca1e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004ae530
add esp, 0xc
lea eax, [esi - 2]
push eax
lea eax, [ebp - 0x902]
push eax
push 0x3e
push ebx
call fcn.004c9530
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
Function at 0x4caea0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x300]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x14c]
lea esi, [edi + 0x158]
push 0
add eax, 4
push eax
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x140], 0
mov dword [edi + 0x144], eax
jne 0x4caf2e
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xc0]
push eax
call fcn.005e0960
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x140], eax
mov edx, dword [edi + 0x144]
cmp edx, 4
jge 0x4caf61
push str.Received_too_short_packet
push ebx
call fcn.004ae530
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
push esi
call fcn.004caa90
movzx eax, ax
add esp, 4
mov dword [edi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x4caf7c
jmp dword [eax*4 + 0x4cb0bc]
cmp edx, 4
jle case.0x4caf7c.4
push esi
call fcn.004caa70
movzx ecx, word [edi + 0x154]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x4caf7c.4
lea eax, [edx - 4]
push eax
mov eax, dword [esi]
add eax, 4
push eax
push 1
push ebx
call fcn.004ae470
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4cafdf
push 5
push edi
call fcn.004cb930
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x144]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.004ba3a0
jmp 0x4cb087
mov eax, dword [esi]
lea esi, [edx - 4]
add eax, 4
mov dword [ebp - 0x8c], eax
lea eax, [edi + 0x158]
push eax
call fcn.004caa70
push esi
push dword [ebp - 0x8c]
movzx eax, ax
mov dword [edi + 8], eax
call fcn.004cba40
add esp, 0xc
cmp eax, esi
jae case.0x4caf7c.4
push dword [ebp - 0x8c]
push str.TFTP_error:__s_n
push ebx
call fcn.004ae5f0
jmp 0x4cb087
lea eax, [edx - 2]
push eax
mov eax, dword [esi]
add eax, 2
push eax
push edi
call fcn.004cac50
add esp, 0xc
test eax, eax
je case.0x4caf7c.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x693668
push ebx
call fcn.004ae530
add esp, 0xc
push ebx
call fcn.004ba690
add esp, 4
test eax, eax
je 0x4caf4e
push 5
push edi
call fcn.004cb930
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
Function at 0x4cb930
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x4cb940
jmp dword [edx*4 + 0x4cb994]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cb3a0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cb0d0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cbb70
push str.TFTP_finished
push 0x616b60
push ecx
call fcn.004ae5f0
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x693668
push ecx
call fcn.004ae530
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x4d2410
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x84]
or esi, 0xffffffff
push ecx
mov ebx, dword [edi + 0xc]
mov eax, dword [ebx + 0x14c]
push eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4d2484
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x8c]
push ebx
push edi
call fcn.004aee60
add esp, 0xc
cmp esi, 0xffffffff
jne 0x4d24bd
push str.Error_accept__ing_server_connect
push edi
call fcn.004ae530
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push edi
call fcn.004ae5f0
push 1
push esi
mov byte [ebx + 0x24e], 0
mov dword [ebx + 0x14c], esi
call fcn.004ba220
add esp, 0x10
mov byte [ebx + 0x261], 1
cmp dword [edi + 0x1b8], 0
je 0x4d253a
push 1
push edi
call fcn.004a01b0
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.004a01b0
add esp, 0x1c
test esi, esi
je 0x4d253a
push ebx
push edi
call fcn.004d2980
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049ae07
mov esp, ebp
pop ebp
ret

Function at 0x4d4940
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x4d4972
push str.Couldnt_set_desired_mode
push esi
call fcn.004ae530
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x4d4989
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push esi
call fcn.004ae5f0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x4d49a2
push ebx
push esi
call fcn.004d4600
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x4d49b7
push esi
call fcn.004d3630
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x4d49cc
push esi
call fcn.004d45e0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x4d49dc
push esi
call fcn.004d4820
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e01f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4e0223
push 0x2e
push edi
call fcn.005e1c80
add esp, 8
test eax, eax
je 0x4e0221
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4e1550
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x6ba08c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e157d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4e15c4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4e15ca
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4e162b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4e15f0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4e1657
mov eax, dword [esi + 4]
push 1
push 0x620f48
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x620f49
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4e1630
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50d1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
push ebx
mov eax, dword [ecx + 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x98], eax
xor eax, eax
mov dword [ebp - 0x88], eax
cmp ecx, ebx
jb 0x50d35a
cmp ebx, 0x40
ja 0x50d35a
lea eax, [ebp - 0x84]
neg eax
push esi
push edi
and eax, 0x3f
lea edi, [ebp - 0x84]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [ebp - 0x9c], edi
cmp ecx, eax
jbe 0x50d22e
mov eax, ecx
sub eax, ebx
sub eax, 0x100
mov dword [ebp - 0x88], eax
push ebx
xor esi, esi
mov dword [ebp - 0x8c], 0
push esi
push edi
call fcn.005e1e60
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x90], esi
cmp ecx, dword [eax + 0xc]
jae 0x50d30e
mov edx, ecx
sub edx, dword [eax + 8]
mov dword [ebp - 0x94], edx
nop dword [eax + eax]
mov ebx, dword [ebp + 0xc]
mov eax, ecx
xor eax, dword [ebp - 0x98]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, dword [ebp + 0xc]
neg edi
xor edx, dword [eax + 8]
mov eax, ecx
xor eax, dword [ebx + 8]
or edx, eax
mov eax, dword [ebx + 0x14]
xor edx, ecx
mov ebx, dword [ebp + 0x10]
shr edx, 0x1f
neg edx
mov cl, byte [eax + ecx]
mov eax, edi
or eax, dword [ebp - 0x8c]
and eax, edx
mov edx, dword [ebp - 0x90]
and edi, edx
mov dword [ebp - 0x8c], eax
and al, cl
or esi, edi
mov edi, dword [ebp - 0x9c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
mov eax, dword [ebp + 0xc]
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x90], edx
inc ecx
mov edx, dword [ebp - 0x94]
inc edx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x94], edx
cmp ecx, dword [eax + 0xc]
jb 0x50d270
xor edx, edx
test ebx, ebx
je 0x50d344
mov ecx, dword [ebp - 0xa0]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [ecx + edx], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x50d314
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ae07
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.0049ae07
mov esp, ebp
pop ebp
ret