joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac600
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x154]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [ebp + 0x18]
mov esi, eax
mov dword [edi], 0
cmp esi, 0xffffffff
jne 0x4ac67e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x4ac64e
mov dword [edi], 0x51
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
mov edx, ebx
call fcn.004c21a0
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.004ac430
mov eax, dword [ebp + 8]
add esp, 0xc
mov eax, dword [eax]
mov dword [eax + 0x85b4], ebx
mov eax, esi
mov dword [edi], 0x37
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4acb10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 0x1d0]
test eax, eax
je 0x4acb36
push dword [edi + 0x15c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push edi
call eax
add esp, 0x14
pop edi
pop ebp
ret
cmp edx, 2
ja 0x4acb6c
push dword [edi + 0x158]
lea eax, [edx*2 + 0x6d3e80]
push 1
add eax, edx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x158]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x4acd80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
push edi
push 4
mov edi, edx
cmp byte [esi + 0x41c], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4acddb
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004ac3b0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x420]
mov dword [ebp - 0x10], 1
call fcn.004b9aa0
mov ecx, dword [esi + 0x424]
imul eax, eax, 0x3e8
mov dword [ebp - 0xc], eax
call fcn.004b9aa0
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4ace45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004ac3b0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x4ad5c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x4ad78e
cmp byte [edi + 0x1e1], 0
jne 0x4ad787
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x80
push eax
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4ad64b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.004c21a0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.004ac430
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x88]
mov dword [ebp - 0x10c], 0x80
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4ad6b6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.004c21a0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.004ac430
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xe8]
lea esi, [edi + 0xb8]
push eax
mov edx, esi
lea ecx, [ebp - 0x108]
call fcn.004ad560
add esp, 4
test al, al
jne 0x4ad709
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.004c21a0
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004ac430
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
lea edx, [edi + 0xec]
lea ecx, [ebp - 0x88]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x11c]
push eax
call fcn.004ad560
add esp, 4
test al, al
jne 0x4ad787
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.004c21a0
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004ac430
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.004ad4a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x4adb00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
push 4
mov esi, dword [edi]
movzx eax, byte [esi + 0x326]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push 6
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4adb4f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, edi
call fcn.004c21a0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004ac3b0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004ac3b0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4adb70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x758f3c]
mov dword [ebp - 0x130], 0x4020
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x134], 4
push esi
push edi
mov edi, ecx
test eax, eax
jne 0x4adc3e
push 0x114
push eax
lea eax, [ebp - 0x120]
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
mov dword [ebp - 0x124], 6
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x4adc32
mov dword [0x758f3c], 2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov dword [0x758f3c], 1
jmp 0x4adc43
cmp eax, 2
je 0x4adc8e
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x1001
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4adc74
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x130]
jg 0x4adc8e
push 4
lea eax, [ebp - 0x130]
push eax
push 0x1001
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x4ae0d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x578]
test esi, esi
je 0x4ae124
mov ecx, dword [edi + 0x44]
test ecx, ecx
jne 0x4ae0f3
cmp dword [edi + 0x40], ecx
je 0x4ae124
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
test ecx, ecx
jne 0x4ae101
mov ecx, dword [edi + 0x40]
push 0x4ae0b0
add ecx, 0x68
lea edx, [ebp - 0xc]
call fcn.004b87d0
add esp, 4
cmp byte [ebp - 8], 0
jne 0x4ae12e
mov dword [edi + 0x578], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4ae134
mov dword [ebx], esi
cmp byte [esi + 0x178], 0
mov edi, dword [esi + 0x154]
je 0x4ae158
mov ecx, esi
call fcn.004b7e20
test eax, eax
jne 0x4ae16b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 1
lea eax, [ebp - 1]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4ae124
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9b30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.004b9a90
push eax
push edx
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
pop esi
pop ebp
ret
Function at 0x4c2840
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4c29b9
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x4c29a5
push esi
nop dword [eax + eax]
cmp dword [edi + 4], 2
jne 0x4c2938
cmp dword [edi + 0x18], 0
je 0x4c2938
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4c2938
cmp eax, 0x10
jb 0x4c2938
push 0x20
call dword [0x74b958]
mov esi, eax
add esp, 4
test esi, esi
je 0x4c299a
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x74b958]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4c2989
mov ecx, dword [edi + 0x18]
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4c2926
push eax
call dword [0x74b964]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4c296f
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x4c2935
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4c2880
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x4c2955
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x4c29a1
mov ecx, ebx
call fcn.004c2800
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x74b960]
push esi
call dword [0x74b960]
add esp, 8
jmp 0x4c2946
push esi
mov edi, 8
call dword [0x74b960]
add esp, 4
jmp 0x4c2946
mov edi, 8
jmp 0x4c2946
test ebx, ebx
jne 0x4c29b1
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c2bd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4c2c32
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4c2c32
lea eax, [ebp - 0x108]
push eax
call dword [0x74b964]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x4c9090
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x90], 0x80
push edi
mov dword [ebp - 0x8c], eax
mov esi, dword [eax + 0x3c0]
mov edi, dword [eax]
lea ebx, [esi + 0x15c]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x88]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [ebx]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4c9122
push dword [ebp - 0x90]
lea eax, [ebp - 0x88]
push eax
lea eax, [esi + 0xc8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x90]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x4c9155
push str.Received_too_short_packet
push edi
call fcn.004ac430
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.004c8120
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x4c916e
jmp dword [eax*4 + 0x4c9294]
cmp edx, 4
jle case.0x4c916e.4
mov ecx, ebx
call fcn.004c8140
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne case.0x4c916e.4
lea eax, [edx - 4]
mov edx, 1
push eax
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x8c]
add eax, 4
push eax
mov ecx, ebx
call fcn.004ac980
add esp, 8
mov dword [ebp - 0x8c], eax
test eax, eax
je 0x4c91df
mov edx, 5
mov ecx, esi
call fcn.004c8e00
mov eax, dword [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14c]
mov ecx, edi
sub eax, 4
cdq
add dword [edi + 0x70], eax
adc dword [edi + 0x74], edx
push dword [edi + 0x74]
push dword [edi + 0x70]
call fcn.004bfad0
add esp, 8
jmp 0x4c9262
mov ecx, ebx
call fcn.004c8140
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [ebx]
add eax, 4
push eax
push 0x6f145c
push edi
call fcn.004ac3b0
jmp 0x4c9259
lea eax, [edx - 2]
mov ecx, esi
mov edx, dword [ebx]
push eax
add edx, 2
call fcn.004c81e0
add esp, 4
test eax, eax
je case.0x4c916e.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x6f0620
push edi
call fcn.004ac430
add esp, 0xc
mov ebx, dword [ebp - 0x8c]
mov ecx, ebx
call fcn.004bfbb0
test eax, eax
je 0x4c9142
mov edx, 5
mov ecx, esi
call fcn.004c8e00
mov ecx, dword [ebp - 4]
mov eax, 0x2a
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x4cab70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], 0x10
push edi
lea ecx, [ebp - 0x18]
or edi, 0xffffffff
push ecx
mov eax, dword [esi + 0x158]
lea ecx, [ebp - 0x14]
mov ebx, dword [esi]
push ecx
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4cabc7
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004ae180
cmp edi, 0xffffffff
jne 0x4cabfa
push str.Error_accept__ing_server_connect
push ebx
call fcn.004ac430
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.004ac3b0
add esp, 8
mov dword [esi + 0x158], edi
mov edx, 1
mov ecx, edi
call fcn.004c2450
mov byte [esi + 0x165], 1
mov eax, dword [ebx + 0x1d8]
test eax, eax
je 0x4cac66
push 1
push edi
push dword [ebx + 0x1dc]
call eax
add esp, 0xc
test eax, eax
je 0x4cac66
mov edx, edi
mov ecx, esi
call fcn.004ae180
mov dword [esi + 0x158], 0xffffffff
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x4ccc60
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea eax, [edx - 0xc8]
xor esi, esi
mov ecx, dword [edi]
cmp eax, 0x64
jb 0x4ccc8d
push str.Couldnt_set_desired_mode
push ecx
call fcn.004ac430
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ecx
pop ebp
ret
cmp edx, 0xc8
je 0x4ccca4
push edx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ecx
call fcn.004ac3b0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x4cccba
mov ecx, edi
call fcn.004cbda0
mov esi, eax
pop edi
pop esi
pop ecx
pop ebp
ret
cmp eax, 0x14
jne 0x4ccccd
mov ecx, edi
call fcn.004cbdf0
mov esi, eax
pop edi
pop esi
pop ecx
pop ebp
ret
cmp eax, 0x15
jne 0x4ccce0
mov ecx, edi
call fcn.004cbf20
mov esi, eax
pop edi
pop esi
pop ecx
pop ebp
ret
cmp eax, 0x16
jne 0x4cccee
mov ecx, edi
call fcn.004cbf30
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ecx
pop ebp
ret

Function at 0x4cf740
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x198]
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4cf78c
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.004ac430
add esp, 0xc
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x198]
cmp al, 2
jne 0x4cf7b4
shr eax, 8
test al, al
jne 0x4cf7b4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.004ac430
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 2
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret

Function at 0x4cf9c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
mov esi, ecx
mov byte [ebp - 2], al
push 3
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xff
push eax
push dword [esi + 0x154]
mov edi, dword [esi]
mov ebx, edx
mov byte [ebp - 3], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4cfa09
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004ac430
add esp, 0xc
push dword [ebp + 8]
mov ecx, dword [esi]
mov edx, str.SENT
push ebx
call fcn.004cf8b0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cfc70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [edi]
mov eax, dword [eax + 0x154]
mov ecx, dword [eax + esi*4 + 8]
sub ecx, 0
je 0x4cfd16
sub ecx, 2
je 0x4cfcc6
sub ecx, 1
jne 0x4cfcf6
mov ecx, dword [eax + esi*4 + 0x408]
sub ecx, 0
je 0x4cfcba
sub ecx, 1
jne 0x4cfcf6
mov dword [eax + esi*4 + 8], 1
mov dword [eax + esi*4 + 0x408], ecx
pop edi
pop esi
pop ebx
ret
mov dword [eax + esi*4 + 8], 0
pop edi
pop esi
pop ebx
ret
mov ecx, dword [eax + esi*4 + 0x408]
sub ecx, 0
je 0x4cfcfa
sub ecx, 1
jne 0x4cfcf6
mov dword [eax + esi*4 + 8], 3
mov dword [eax + esi*4 + 0x1008], ecx
push esi
mov edx, 0xfc
mov ecx, edi
call fcn.004cf9c0
add esp, 4
pop edi
pop esi
pop ebx
ret
cmp dword [eax + esi*4 + 0x1808], 1
mov dword [eax + esi*4 + 8], 1
jne 0x4cfcf6
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.004d0670
cmp dword [eax + esi*4 + 0x808], 1
lea ebx, [eax + esi*4]
jne 0x4cfd50
push esi
mov edx, 0xfb
mov dword [eax + esi*4 + 8], 1
mov ecx, edi
call fcn.004cf9c0
add esp, 4
cmp dword [ebx + 0x1808], 1
jne 0x4cfcf6
mov edx, esi
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.004d0670
cmp dword [ebx + 0x1808], 1
jne 0x4cfce6
push esi
mov edx, 0xfb
mov dword [eax + esi*4 + 8], 1
mov ecx, edi
call fcn.004cf9c0
add esp, 4
mov ecx, edi
mov edx, esi
pop edi
pop esi
pop ebx
jmp fcn.004d0670
Function at 0x4d03d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x108]
mov edi, ecx
push 0
push eax
mov dword [ebp - 0x910], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x88]
push 0x80
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [edi]
add esp, 0xc
mov edx, 0x3c
mov dword [ebp - 0x90c], ebx
mov ecx, ebx
mov esi, dword [ebx + 0x154]
mov eax, dword [esi + 0x1eb4]
sub eax, dword [esi + 0x1eb0]
add eax, 2
push eax
lea eax, [esi + 0x1cb0]
push eax
call fcn.004cfe10
mov eax, dword [esi + 0x1eb0]
add esp, 8
mov cl, byte [eax]
inc eax
mov dword [esi + 0x1eb0], eax
cmp cl, 0x18
je 0x4d05be
cmp cl, 0x23
je 0x4d059b
cmp cl, 0x27
jne 0x4d0657
push 0
push 0x27
push 0xfa
push 0xff
push 0x6f6268
lea eax, [ebp - 0x908]
push 0x800
push eax
call fcn.004c1720
mov esi, dword [esi + 0x1cac]
add esp, 0x1c
mov edi, 4
mov eax, 0x800
test esi, esi
je 0x4d053a
mov edx, dword [esi]
mov eax, edx
lea ebx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d04c0
sub eax, ebx
lea ebx, [edi + 1]
add ebx, eax
cmp ebx, 0x7fa
jae 0x4d0528
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x108]
push eax
push str._127_____127s
push edx
call fcn.0047a620
add esp, 0x10
test eax, eax
je 0x4d0528
lea eax, [ebp - 0x88]
push eax
push 1
lea eax, [ebp - 0x108]
push eax
push 0
mov eax, 0x800
sub eax, edi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x908]
add eax, edi
push eax
call fcn.004c1720
add esp, 0x1c
mov edi, ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x4d04b7
mov ebx, dword [ebp - 0x90c]
mov eax, 0x800
push 0xf0
push 0xff
sub eax, edi
push 0x6f6290
push eax
lea eax, [ebp - 0x908]
add eax, edi
push eax
call fcn.004c1720
add esp, 0x14
lea eax, [edi + 2]
push 0
push eax
lea eax, [ebp - 0x908]
push eax
mov eax, dword [ebp - 0x910]
push dword [eax + 0x154]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4d0595
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004ac430
add esp, 0xc
push edi
jmp 0x4d0641
lea edx, [esi + 0x1c28]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d05a6
push 0xf0
push 0xff
push edx
push 0
push 0x23
jmp 0x4d05e6
lea edx, [esi + 0x1c08]
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d05d0
push 0xf0
push 0xff
push edx
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
sub ecx, esi
lea eax, [ebp - 0x908]
push 0x800
push eax
lea esi, [ecx + 6]
call fcn.004c1720
add esp, 0x28
lea eax, [ebp - 0x908]
push 0
push esi
push eax
push dword [edi + 0x154]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4d063d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004ac430
add esp, 0xc
lea eax, [esi - 2]
push eax
lea eax, [ebp - 0x906]
mov edx, 0x3e
push eax
mov ecx, ebx
call fcn.004cfe10
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x4d13c0
Capabilities:
Parse pe header

Disassembly:
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x4d13cb
jmp dword [eax*4 + 0x4d1424]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret
Function at 0x4d59b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push edx
push 0x4b6950
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x4d59d0
cmp eax, 0xffffffff
jne 0x4d59d2
xor eax, eax
ret