joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429d20
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 6
push 4
lea edx, [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x429d80
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0042c9d0
add esp, 8
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
mov eax, dword [ebp - 4]
push eax
call fcn.00424e70
add esp, 0xc
jmp 0x429d91
push str.TCP_NODELAY_set_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.00424e70
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x429da0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x4020
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
cmp dword [0x479848], 0
jne 0x429df1
push 3
push 2
push 0
push 6
call fcn.004345b0
add esp, 0x10
test eax, eax
je 0x429de7
mov dword [0x479848], 2
jmp 0x429df1
mov dword [0x479848], 1
cmp dword [0x479848], 2
jne 0x429dfc
jmp 0x429e40
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x429e26
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jle 0x429e26
jmp 0x429e40
push 4
lea ecx, [ebp - 4]
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a260
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x528], 0
setne cl
mov dword [ebp - 4], ecx
push 4
lea edx, [ebp - 4]
push edx
push 8
push 0xffff
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x42a2b0
mov ecx, dword [ebp + 0xc]
push ecx
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov edx, dword [ebp + 8]
push edx
call fcn.00424e70
add esp, 0xc
jmp 0x42a346
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x52c]
push ecx
call fcn.00433d60
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
imul edx, edx, 0x3e8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x530]
push edx
call fcn.00433d60
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x42a346
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov edx, dword [ebp + 0xc]
push edx
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov eax, dword [ebp + 8]
push eax
call fcn.00424e70
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42abb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1d8], 0
je 0x42abdb
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415440
add esp, 4
test eax, eax
jne 0x42abd9
xor eax, eax
jmp 0x42ac10
jmp 0x42ac0b
mov edx, dword [ebp + 8]
cmp dword [edx + 0x190], 0xffffffff
jne 0x42abeb
xor eax, eax
jmp 0x42ac10
push 2
push 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x190]
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x42ac0b
xor eax, eax
jmp 0x42ac10
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42aef0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42af21
cmp dword [ebp - 4], 0xffffffff
jne 0x42af25
xor eax, eax
jmp 0x42af28
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x42b500
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x42bd80
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.0042b490
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
cmp dword [0x479850], 0
je 0x42b2d8
mov eax, dword [ebp + 8]
and eax, 0xffff
mov eax, dword [eax*8 + 0x478ff4]
jmp 0x42b47b
push 0x104
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x42b2f3
jmp 0x42b3cd
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x238]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ws2_32
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b35c
push str.getaddrinfo
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x42b35c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x42b364
jmp 0x42b3cd
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x238]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.wship6
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b3cd
push str.getaddrinfo
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x42b3cd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x42b462
mov dword [ebp - 0x24], 0
jmp 0x42b3e9
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [0x46cbb0]
jge 0x42b42c
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + ecx*8 - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 0x24]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x42b42a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
jmp 0x42b42c
jmp 0x42b3e0
cmp dword [ebp - 4], 0
je 0x42b462
mov dword [ebp - 0x24], 0
jmp 0x42b444
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [0x46cbb0]
jge 0x42b462
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + ecx*8 - 0x18]
mov dword [eax*8 + 0x478ff4], edx
jmp 0x42b43b
mov dword [0x479850], 1
mov eax, dword [ebp + 8]
and eax, 0xffff
mov eax, dword [eax*8 + 0x478ff4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42bbc0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42bc91
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x42bc6b
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x42bc6b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x42bc28
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x42bc6b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
mov ax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0042b990
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x42bc5e
mov eax, 8
jmp 0x42bcd6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 4], ecx
jmp 0x42bc1f
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp + 0x18]
mov byte [edx + 0x400], 0
xor eax, eax
jmp 0x42bcd6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x2af9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
ja case.default.0x42bcae
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x42bcdf]
mov eax, 0x2af9
jmp 0x42bcd6
mov eax, 0x2afa
jmp 0x42bcd6
mov eax, 0x2afb
jmp 0x42bcd6
mov eax, 0x2af9
jmp 0x42bcd6
mov eax, 0x2af9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4324b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4324e0
mov eax, 2
jmp 0x432517
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x432509
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x432517
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433db0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
call fcn.00433cf0
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x434762
xor eax, eax
jmp 0x4348b2
push str.LoadLibraryExA
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x46f78c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strpbrk]
add esp, 8
test eax, eax
je 0x4347b8
cmp dword [ebp - 8], 0
je 0x4347a0
push 8
push 0
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jmp 0x4347ad
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
jmp 0x4348af
cmp dword [ebp - 8], 0
je 0x4347e7
push str.AddDllDirectory
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4347e7
push 0x800
push 0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x4348af
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4348af
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [eax + edx + 1]
push ecx
call dword [0x478f9c]
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4348a2
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4348a2
push 0x4785d4
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, eax
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, eax
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [ebp - 8], 0
je 0x43488f
push 8
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 8]
mov dword [ebp - 0x20], eax
jmp 0x43489c
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
push eax
call dword [0x478fa0]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4435d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
push esi
push edi
xor eax, eax
test eax, eax
jne 0x4435dc
mov word [ebp - 8], 2
lea ecx, [ebp - 0x198]
push ecx
mov dx, word [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44361f
mov eax, dword [ebp - 4]
push eax
push str.WSAStartup_failed___d_
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424ef0
add esp, 0xc
mov eax, 2
jmp 0x443698
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 0x198]
and edx, 0xffff
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 8]
and eax, 0xffff
and eax, 0xff
and eax, 0xff
cmp edx, eax
jne 0x44367e
mov ecx, dword [ebp - 0x198]
and ecx, 0xffff
shr ecx, 8
and ecx, 0xff
mov edx, dword [ebp - 8]
and edx, 0xffff
shr edx, 8
and edx, 0xff
cmp ecx, edx
je 0x443696
push str.insufficient_winsock_version_to_support_telnet
mov eax, dword [ebp + 8]
push eax
call fcn.00424ef0
add esp, 8
mov eax, 2
jmp 0x443698
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443950
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0xff
mov dl, byte [ebp + 0xc]
mov byte [ebp - 3], dl
mov al, byte [ebp + 0x10]
mov byte [ebp - 2], al
push 0
push 3
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x190]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x4439b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.Sending_data_failed___d_
mov edx, dword [ebp - 0x10]
push edx
call fcn.00424ef0
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SENT
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004439e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448fa0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
cdq
mov ecx, 0x64
idiv ecx
cmp eax, 2
je 0x448fe0
push str.Couldnt_set_desired_mode
mov edx, dword [ebp - 8]
push edx
call fcn.00424ef0
add esp, 8
mov eax, 0x11
jmp 0x44905b
cmp dword [ebp + 0xc], 0xc8
je 0x448ffe
mov eax, dword [ebp + 0xc]
push eax
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
mov ecx, dword [ebp - 8]
push ecx
call fcn.00424e70
add esp, 0xc
cmp dword [ebp + 0x10], 0x13
jne 0x449015
mov edx, dword [ebp + 8]
push edx
call fcn.00446f30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x449058
cmp dword [ebp + 0x10], 0x14
jne 0x44902c
mov eax, dword [ebp + 8]
push eax
call fcn.00449070
add esp, 4
mov dword [ebp - 4], eax
jmp 0x449058
cmp dword [ebp + 0x10], 0x15
jne 0x449043
mov ecx, dword [ebp + 8]
push ecx
call fcn.00449230
add esp, 4
mov dword [ebp - 4], eax
jmp 0x449058
cmp dword [ebp + 0x10], 0x16
jne 0x449058
mov edx, dword [ebp + 8]
push edx
call fcn.00449260
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449b20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x194]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x449b7d
mov dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042ac20
add esp, 8
cmp dword [ebp - 0xc], 0xffffffff
jne 0x449bae
push str.Error_accept__ing_server_connect
mov eax, dword [ebp - 4]
push eax
call fcn.00424ef0
add esp, 8
mov eax, 0x1e
jmp 0x449c40
push str.Connection_accepted_from_server_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.00424e70
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x3c8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x194], ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
call fcn.0045b4d0
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x1a8], 0
je 0x449c3e
mov dword [ebp - 0x24], 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1ac]
push ecx
mov edx, dword [ebp - 4]
call dword [edx + 0x1a8]
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x449c3e
mov eax, dword [ebp + 8]
push eax
call fcn.00447d50
add esp, 4
mov eax, 0x2a
jmp 0x449c40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459800
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 0x108], eax
mov byte [ebp - 0x104], 0
cmp dword [ebp - 0x108], 0
je 0x459848
push 0x104
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
movsx eax, byte [ebp - 0x104]
test eax, eax
je 0x45986b
lea ecx, [ebp - 0x104]
push ecx
call dword [0x478fa8]
add esp, 4
mov dword [ebp - 0x10c], eax
jmp 0x459875
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45b4d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45efd0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov byte [eax - 1], 0
cmp dword [ebp - 4], 0
je 0x45f005
mov eax, dword [ebp - 4]
jmp 0x45f025
push 0x2e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45f023
mov edx, dword [ebp - 8]
mov byte [edx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f090
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x20], 8
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x45f0c0
xor eax, eax
jmp 0x45f179
push 0x14
push 0
lea ecx, [ebp - 0x1c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov byte [ebp - 0x1c], 8
mov byte [ebp - 0x1b], 2
mov dword [ebp - 0x18], 0x6601
mov dword [ebp - 0x14], 8
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0045f180
add esp, 8
push 8
lea ecx, [ebp - 0x10]
push ecx
call fcn.004667a0
add esp, 8
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x45f130
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x45f179
push 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f360
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
call dword [0x478f9c]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45f39a
mov eax, 0x1b
jmp 0x45f462
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045f470
add esp, 0xc
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x45f3c3
mov eax, dword [ebp - 0xc]
jmp 0x45f462
push 0xf0000000
push 1
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x45f440
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x8002
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x45f434
mov dword [ebp - 0x18], 0x10
push 0
mov edx, dword [ebp - 4]
shl edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 2
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 5
push 0
mov ecx, dword [ebp + 0x10]
add ecx, 0x10
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [0x478fa0]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret