joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x62e52c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48b28f
xor eax, eax
jmp 0x48b3e2
push 0x62e540
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x62e550
mov ecx, dword [ebp + 8]
push ecx
call fcn.006075da
add esp, 8
test eax, eax
je 0x48b2e4
cmp dword [ebp - 8], 0
je 0x48b2cc
push 8
push 0
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0x18], eax
jmp 0x48b2d9
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
jmp 0x48b3df
cmp dword [ebp - 8], 0
je 0x48b313
push str.AddDllDirectory
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b313
push 0x800
push 0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x48b3df
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48b3df
mov ecx, dword [ebp + 8]
push ecx
call fcn.00604baa
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 1]
shl ecx, 1
push ecx
call dword [0x6b5368]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48b3d2
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x48b3d2
push 0x62e568
mov ecx, dword [ebp - 4]
push ecx
call fcn.00604baa
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [edx + eax*2]
push eax
call fcn.006075b8
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00604baa
add esp, 4
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
push edx
call fcn.006075b8
add esp, 8
cmp dword [ebp - 8], 0
je 0x48b3bf
push 8
push 0
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jmp 0x48b3cc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x6b536c]
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x48b3f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x6b8dd8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and eax, 2
je 0x48b4a3
mov ecx, 0x202
mov word [ebp - 0x198], cx
lea edx, [ebp - 0x194]
push edx
movzx eax, word [ebp - 0x198]
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x48b449
mov eax, 2
jmp 0x48b520
movzx ecx, word [ebp - 0x194]
and ecx, 0xff
movzx edx, cl
movzx eax, word [ebp - 0x198]
and eax, 0xff
movzx ecx, al
cmp edx, ecx
jne 0x48b496
movzx edx, word [ebp - 0x194]
shr edx, 8
and edx, 0xff
movzx eax, dl
movzx ecx, word [ebp - 0x198]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
cmp eax, edx
je 0x48b4a3
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x48b520
push str.iphlpapi.dll
call fcn.0048b260
add esp, 4
mov dword [0x6bc714], eax
cmp dword [0x6bc714], 0
je 0x48b4ea
push str.if_nametoindex
mov eax, dword [0x6bc714]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x48b4ea
mov ecx, dword [ebp - 0x19c]
mov dword [0x6bc710], ecx
push 3
push 2
push 0
push 0
push 6
call fcn.004cc020
add esp, 0x14
movzx edx, al
test edx, edx
je 0x48b50c
mov byte [0x6c045c], 1
jmp 0x48b513
mov byte [0x6c045c], 0
push 0x6c0460
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005db6f9
mov esp, ebp
pop ebp
ret

Function at 0x4930d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0x4004747b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49311a
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x495390
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
je 0x4953b4
xor eax, eax
jne 0x49539c
xor ecx, ecx
jne 0x4953a0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x70]
mov al, byte [eax + 0xe3]
jmp 0x495403
mov dword [ebp - 4], 0xffffffff
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4953d9
mov dword [ebp - 4], 0
jmp 0x4953ea
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [ebp - 4], 0
jle 0x4953f9
mov dword [ebp - 0xc], 1
jmp 0x495400
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x49c840
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
add eax, 0x80
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x70]
mov dword [ecx + 0xd60], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x114]
mov eax, dword [ebp + 8]
mov dword [eax + 0xd68], edx
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xc55]
test edx, edx
je 0x49c899
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xc55]
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 0x114]
cmp ecx, eax
jle 0x49c8ab
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 0x114]
mov byte [ecx + 0xc55], al
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + 0xc60]
or ecx, dword [eax + 0xc64]
je 0x49c8e7
mov edx, dword [ebp + 8]
cmp dword [edx + 0xcb8], 0
jne 0x49c8e7
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0x1a0
jne 0x49c8e7
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xbf], 1
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 0x114]
cmp eax, 0xa
jne 0x49c917
push str.HTTP_1.0__assume_close_after_body
mov ecx, dword [ebp + 8]
push ecx
call fcn.00487990
add esp, 8
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.00488860
add esp, 8
jmp 0x49c971
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x114]
cmp ecx, 0x14
je 0x49c93b
mov edx, dword [ebp - 4]
cmp dword [edx + 0x8c], 1
jne 0x49c950
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0x65
jne 0x49c950
xor ecx, ecx
jne 0x49c93b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c4]
mov dword [eax], 2
jmp 0x49c971
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x114]
cmp edx, 0xb
jl 0x49c971
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x25e]
test ecx, ecx
jne 0x49c971
xor edx, edx
jne 0x49c96d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0x64
jl 0x49c98f
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x70], 0xc8
jge 0x49c98f
mov dword [ebp - 0xc], 1
jmp 0x49c996
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x49c9a5
mov dword [ebp - 0x10], 0
jmp 0x49c9ac
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 4]
mov al, byte [ebp - 0x10]
mov byte [edx + 0xc0], al
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x70]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0xcc
je 0x49c9eb
cmp dword [ebp - 0x14], 0x130
je 0x49c9d5
jmp 0x49ca16
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3e4], 0
je 0x49c9eb
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xe24], 1
mov edx, dword [ebp - 4]
mov dword [edx], 0
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc0], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x49ff10
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0xc], 0
je 0x49ff24
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x49ff55
cmp dword [ebp + 0x10], 0
je 0x49ff32
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x49ff55
cmp dword [ebp + 0x14], 0
je 0x49ff40
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
jne 0x49ff55
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0049fea0
add esp, 8
jmp 0x4a0074
lea edx, [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x1c], 0
jg 0x49ff75
jl 0x49ff69
cmp dword [ebp + 0x18], 0
jae 0x49ff75
mov dword [ebp - 4], 0
jmp 0x4a0000
cmp dword [ebp + 0x1c], 0
jl 0x49fff2
jg 0x49ff83
cmp dword [ebp + 0x18], 0
jbe 0x49fff2
push 0
push 0x3e8
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.005dc690
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0
push 0x3e8
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
call fcn.005dc740
push 0
push 0x3e8
push edx
push eax
call fcn.005dc3a0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x14], 0
jl 0x49ffe4
jg 0x49ffd6
cmp dword [ebp - 0x18], 0x7fffffff
jbe 0x49ffe4
mov dword [ebp - 0x18], SysReAllocString
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
jmp 0x4a0000
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 0x14], 0
je 0x4a0016
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x4a0016
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
jmp 0x4a001d
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x4a0033
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
je 0x4a0033
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
jmp 0x4a003a
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x4a0050
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x4a0050
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
jmp 0x4a0057
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov esp, ebp
pop ebp
ret
Function at 0x4a3e00
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6b8dd8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0x3e8
lea eax, [ebp - 0x40]
push eax
call fcn.00494570
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
push eax
call fcn.004a2cf0
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004a2cf0
add esp, 4
mov dword [ebp - 0x18], eax
push 1
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4a3eab
cmp dword [ebp - 0x1c], 0
je 0x4a3e85
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005fe94d
add esp, 4
mov dword [ebp - 0x1c], 0
xor edx, edx
jne 0x4a3e6c
cmp dword [ebp - 0x18], 0
je 0x4a3ea2
mov eax, dword [ebp - 0x18]
push eax
call fcn.005fe94d
add esp, 4
mov dword [ebp - 0x18], 0
xor ecx, ecx
jne 0x4a3e89
jmp 0x4a3f71
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
mov dword [edx + 0xc], ecx
lea edx, [ebp - 0x50]
push edx
call fcn.00494570
add esp, 0xfffffff4
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
call fcn.00494660
add esp, 0x20
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0
jl 0x4a3f23
jg 0x4a3f07
cmp dword [ebp - 0x24], 0
jb 0x4a3f23
mov eax, dword [ebp - 0x28]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x2c]
jl 0x4a3f64
jg 0x4a3f23
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x30]
jbe 0x4a3f64
cmp dword [ebp - 0x1c], 0
je 0x4a3f3c
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005fe94d
add esp, 4
mov dword [ebp - 0x1c], 0
xor ecx, ecx
jne 0x4a3f23
cmp dword [ebp - 0x18], 0
je 0x4a3f59
mov edx, dword [ebp - 0x18]
push edx
call fcn.005fe94d
add esp, 4
mov dword [ebp - 0x18], 0
xor eax, eax
jne 0x4a3f40
mov eax, 1
jmp 0x4a3f73
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a3e58
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005db6f9
mov esp, ebp
pop ebp
ret
Function at 0x4a4a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call fcn.00602ad2
add esp, 0x18
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x4a4a93
cmp dword [ebp - 4], 0xffffffff
jne 0x4a4a97
xor eax, eax
jmp 0x4a4a9a
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4acc80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0x8000
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x6b5370]
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4accc6
mov edx, dword [ebp - 8]
push edx
call dword [0x6b536c]
add esp, 4
xor eax, eax
jmp 0x4acd20
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4accfd
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
je 0x4accfd
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jbe 0x4acd0e
mov ecx, dword [ebp - 8]
push ecx
call dword [0x6b536c]
add esp, 4
xor eax, eax
jmp 0x4acd20
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jae 0x4acd1b
mov eax, dword [ebp - 8]
jmp 0x4acd20
jmp 0x4acc9b
mov esp, ebp
pop ebp
ret

Function at 0x4af050
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 4], 0xff
mov ecx, 1
shl ecx, 0
mov dl, byte [ebp + 0xc]
mov byte [ebp + ecx - 4], dl
mov eax, 1
shl eax, 1
mov cl, byte [ebp + 0x10]
mov byte [ebp + eax - 4], cl
push 0
push 3
lea edx, [ebp - 4]
push edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x148]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x4af0d1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.Sending_data_failed___d_
mov edx, dword [ebp + 8]
push edx
call fcn.00487870
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SENT
mov edx, dword [ebp + 8]
push edx
call fcn.004ae4b0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4bc240
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x6b8dd8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x88], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + edx + 0x148]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x90], 0x80
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4bc2d8
mov dword [ebp - 0x90], 0x80
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x94]
push edx
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00488690
add esp, 0xc
cmp dword [ebp - 0x8c], 0xffffffff
jne 0x4bc316
push str.Error_accept__ing_server_connect
mov edx, dword [ebp + 8]
push edx
call fcn.00487870
add esp, 8
mov eax, 0x1e
jmp 0x4bc3eb
push str.Connection_accepted_from_server
mov eax, dword [ebp + 8]
push eax
call fcn.00487990
add esp, 8
mov ecx, dword [ebp - 0x88]
mov byte [ecx + 0x265], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x8c]
mov dword [eax + edx + 0x148], ecx
push 1
mov edx, dword [ebp - 0x8c]
push edx
call fcn.004cb7d0
add esp, 8
mov eax, dword [ebp - 0x88]
mov byte [eax + 0x278], 1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1b8], 0
je 0x4bc3e9
mov dword [ebp - 0x98], 0
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00471620
add esp, 8
push 1
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1bc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1b8]
call ecx
add esp, 0xc
mov dword [ebp - 0x98], eax
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00471620
add esp, 8
cmp dword [ebp - 0x98], 0
je 0x4bc3e9
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004bc9e0
add esp, 8
mov eax, 0x2a
jmp 0x4bc3eb
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005db6f9
mov esp, ebp
pop ebp
ret
Function at 0x4bfa30
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
cdq
mov ecx, 0x64
idiv ecx
cmp eax, 2
je 0x4bfa6e
push str.Couldnt_set_desired_mode
mov edx, dword [ebp + 8]
push edx
call fcn.00487870
add esp, 8
mov eax, 0x11
jmp 0x4bfaed
cmp dword [ebp + 0xc], 0xc8
je 0x4bfa8c
mov eax, dword [ebp + 0xc]
push eax
push str.Got_a__03d_response_code_instead_of_the_assumed_200
mov ecx, dword [ebp + 8]
push ecx
call fcn.00487990
add esp, 0xc
cmp dword [ebp + 0x10], 0x13
jne 0x4bfaa7
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004bf570
add esp, 8
mov dword [ebp - 4], eax
jmp 0x4bfaea
cmp dword [ebp + 0x10], 0x14
jne 0x4bfabe
mov ecx, dword [ebp + 8]
push ecx
call fcn.004bdc70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4bfaea
cmp dword [ebp + 0x10], 0x15
jne 0x4bfad5
mov edx, dword [ebp + 8]
push edx
call fcn.004bf550
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4bfaea
cmp dword [ebp + 0x10], 0x16
jne 0x4bfaea
mov eax, dword [ebp + 8]
push eax
call fcn.004bf870
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4cb7d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0
je 0x4cb7e5
mov dword [ebp - 4], 1
jmp 0x4cb7ec
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
push 0x8004667e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esp, ebp
pop ebp
ret

Function at 0x4d49d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov byte [edx + ecx], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp + 0xc]
mov byte [edx - 1], 0
cmp dword [ebp - 4], 0
je 0x4d4a0b
mov eax, dword [ebp - 4]
jmp 0x4d4a2a
push 0x2e
mov eax, dword [ebp + 8]
push eax
call fcn.005f52a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d4a28
mov ecx, dword [ebp - 8]
mov byte [ecx], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4dd8d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.005dc4c0
mov ecx, dword [esp + 0xc]
xor edx, edx
push ebx
push ebp
push esi
mov esi, dword [ecx + 4]
xor ebp, ebp
mov eax, dword [ecx + 8]
dec esi
xor ebx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
test eax, eax
jle 0x4dd94c
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
push edi
push dword [ecx]
mov eax, ebx
xor eax, esi
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
call fcn.004dd1b0
mov ecx, ebp
mov edx, edi
not edx
not ecx
and edx, ecx
and eax, edi
mov ecx, dword [esp + 0x14]
and edx, 0x20
add edx, dword [esp + 0x20]
inc ebx
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x1c], edx
or ebp, edi
mov dword [esp + 0x10], ecx
cmp ebx, dword [esp + 0x14]
jl 0x4dd901
pop edi
not esi
lea eax, [esi - 1]
not esi
shr eax, 0x1f
shr esi, 0x1f
and eax, esi
pop esi
dec eax
pop ebp
and eax, edx
pop ebx
add esp, 8
ret
Function at 0x4f1670
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x20
call fcn.005dc4c0
push ebx
push esi
mov esi, dword [esp + 0x38]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x4f16b8
sub eax, 2
je 0x4f16b8
sub eax, 0x15
je 0x4f16b8
push 0x297
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.004e8fc0
add esp, 0x14
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
call fcn.004f1450
cmp eax, 1
jne 0x4f16b0
mov eax, dword [esp + 0x3c]
xorps xmm0, xmm0
movdqu xmmword [esp + 8], xmm0
push ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
push edi
xor edi, edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], esi
movdqu xmmword [esp + 0x20], xmm0
test esi, esi
jne 0x4f16fa
or eax, 0x400
mov dword [esp + 0x10], eax
cmp dword [esp + 0x3c], 1
jne 0x4f1708
or eax, 1
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x4f175e
cmp esi, 8
je 0x4f17a5
mov eax, dword [esp + 0x10]
test eax, 0x400
je 0x4f176d
and eax, 0xfffffbff
mov edi, esi
or eax, 4
push ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x4f1726
pop edi
pop ebp
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2da
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.004e8fc0
test edi, edi
cmovne esi, edi
push esi
call fcn.004f1c00
push eax
push 1
call fcn.004e87c0
add esp, 0x20
mov eax, ebx
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret
push 0x2cb
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.004e8fc0
add esp, 0x14
mov eax, ebx
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x4f8680
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4f86a5
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
dec esi
jne 0x4f8696
pop edi
movzx eax, dl
pop esi
ret