joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9bf0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2cf7
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 0xbc], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xb8], 0
push 1
push 1
lea ecx, [ebp - 0xb4]
call fcn.00478410
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c0], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x4bc], 0
push 0x3ff
push 0
lea eax, [ebp - 0x4bb]
push eax
call fcn.00496f40
add esp, 0xc
mov dword [ebp - 0x14], 0x400
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x4bc]
push eax
push 0x13
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx + 0xf4]
push edx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.004ca168
add esp, 4
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x10], 0
je 0x4b9cd1
cmp dword [ebp - 0x4c0], 0xc8
je 0x4b9cf8
mov dword [ebp - 0x4c4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.00461500
mov eax, dword [ebp - 0x4c4]
jmp 0x4b9d94
mov dword [ebp - 0x14], 0x400
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x4bc]
push eax
push 5
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx + 0xf4]
push edx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4b9d45
mov eax, dword [ebp - 0x4cc]
mov dword [eax + 0x70], 0xffffffff
mov dword [eax + 0x74], 0xffffffff
jmp 0x4b9d6d
lea ecx, [ebp - 0x4bc]
push ecx
call fcn.004ca173
add esp, 4
mov ecx, dword [ebp - 0x4cc]
mov dword [ecx + 0x70], eax
mov dword [ecx + 0x74], edx
mov edx, dword [ebp - 0x4cc]
mov dword [edx + 0x60], 1
mov eax, dword [ebp - 0x4cc]
mov ecx, dword [eax + 0x70]
mov dword [ebp - 0x4c8], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.00461500
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xbc]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
Function at 0x4cc8f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4cc923
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x4cca60
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x4cca7b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x4ccaaf
cmp eax, 2
jg 0x4ccaaf
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x5bb468]
push 2
push edx
call fcn.0049991d
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.0049991d
add esp, 0x20
xor eax, eax
ret

Function at 0x4ccd90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x150]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x4cce0c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x4ccde1
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push eax
push esi
call fcn.004d0c10
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.004ccc20
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x85dc], edx
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4cd660
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [esi + 0x454], eax
push 4
lea ecx, [ebp - 0x14]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4cd6b3
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004ccba0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x458]
push edx
mov dword [ebp - 0x10], 1
call fcn.004cfd40
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x45c]
push eax
call fcn.004cfd40
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0xc
lea edx, [ebp - 0x10]
push edx
push 0x98000004
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4cd725
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004ccba0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
Function at 0x4cdd70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x8c], 2
mov ebx, dword [esi]
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x110], ebx
je 0x4cdf36
cmp dword [esi + 0x1ec], 0
push edi
jne 0x4cdf2c
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push edi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4cde07
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.004d0c10
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.004ccc20
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x84]
push eax
push edi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4cde5a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.004d0c10
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.004ccc20
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0xb6]
lea ebx, [esi + 0xe4]
lea esi, [ebp - 0x104]
mov dword [ebp - 0x114], edi
call fcn.004cdd30
test eax, eax
jne 0x4cdeb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x108]
mov esi, eax
push esi
push ecx
call fcn.004d0c10
mov edx, dword [ebp - 0x110]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.004ccc20
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
mov esi, dword [ebp - 0x114]
lea edi, [eax + 0x58]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [eax + 0x118]
lea edi, [eax + 0xe8]
lea esi, [ebp - 0x84]
call fcn.004cdd30
test eax, eax
jne 0x4cdf26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x108]
push esi
push eax
call fcn.004d0c10
mov ecx, dword [ebp - 0x110]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.004ccc20
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x108]
push esi
call fcn.004cdcd0
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
Function at 0x4cdf50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x354]
push 4
lea ecx, [ebp - 4]
push ecx
push 1
push 6
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4cdf96
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004d0c10
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004ccba0
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004ccba0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4cdfb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x62d31c]
mov dword [ebp - 0xa4], 0x4020
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], 4
test eax, eax
jne 0x4ce05a
push 0x9c
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00496f40
add esp, 0xc
push 3
push 2
push 0
push 0
mov dword [ebp - 0xa0], 0x9c
mov dword [ebp - 0x9c], 6
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x4ce04e
mov dword [0x62d31c], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
mov dword [0x62d31c], 1
jmp 0x4ce05f
cmp eax, 2
je 0x4ce0af
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 0xac]
push edx
lea eax, [ebp - 0xa8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4ce094
mov ecx, dword [ebp - 0xa8]
cmp ecx, dword [ebp - 0xa4]
jg 0x4ce0ae
push 4
lea edx, [ebp - 0xa4]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
Function at 0x4cfda0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x4cff36
push edi
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x4cff18
push esi
cmp dword [edi + 4], 2
jne 0x4cfe9c
cmp dword [edi + 0x18], ebx
je 0x4cfe9c
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x4cfe9c
cmp eax, 0x10
jb 0x4cfe9c
push 0x20
call dword [0x61e4f4]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4cfea9
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x61e4f4]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x4cfeb2
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x4cfe87
push eax
call dword [0x61e500]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x4cfec5
cmp dword [ebp - 4], ebx
jne 0x4cfe8f
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4cfe99
mov dword [eax + 0x1c], esi
mov dword [ebp - 0xc], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x4cfde2
jmp 0x4cfee0
mov dword [ebp - 8], 8
jmp 0x4cfee0
push esi
mov dword [ebp - 8], 8
call dword [0x61e4f8]
add esp, 4
jmp 0x4cfee0
mov edx, dword [esi + 0x18]
push edx
mov dword [ebp - 8], 8
call dword [0x61e4f8]
push esi
call dword [0x61e4f8]
add esp, 8
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, ebx
je 0x4cfeef
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], ebx
je 0x4cff13
mov eax, dword [ebp - 4]
push eax
call fcn.004cfd50
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, ebx
pop edi
mov dword [ebp - 4], ebx
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], ebx
jne 0x4cff2a
push 0x2af9
mov dword [ebp - 8], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [edx], ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d01d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.00496e92
add esp, 0x18
test eax, eax
je 0x4d01f4
cmp eax, 0xffffffff
jne 0x4d01f6
xor eax, eax
pop ebp
ret
Function at 0x4d0de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4d0df1
jmp dword [ecx*4 + 0x4d0e60]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
Function at 0x4dd1d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x5bb55c
push ecx
call fcn.004ccba0
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.004dc350
test eax, eax
jne 0x4dd204
mov eax, esi
pop ebp
jmp fcn.004dc7d0
pop ebp
ret
Function at 0x4dd600
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
mov esi, dword [eax + 0x410]
push edi
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4dd694
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.00493fb0
mov edx, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x4dd6c7
push str.Received_too_short_packet
push ebx
call fcn.004ccc20
add esp, 8
mov dword [esi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x15c]
call fcn.004dc4f0
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x4dd6e4
jmp dword [eax*4 + 0x4dd814]
cmp edx, 4
jle case.0x4dd6e4.4
lea eax, [esi + 0x15c]
call fcn.004dc500
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne case.0x4dd6e4.4
mov eax, dword [ebp - 0x8c]
add edx, 0xfffffffc
push edx
mov edx, dword [esi + 0x15c]
add edx, 4
push edx
push 1
push eax
call fcn.004ccef0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4dd751
mov ecx, 5
mov eax, esi
call fcn.004dd580
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x70], eax
adc dword [ebx + 0x74], edx
mov ecx, dword [ebx + 0x74]
mov edx, dword [ebx + 0x70]
push ecx
push edx
push ebx
call fcn.004d4200
jmp 0x4dd7d5
lea eax, [esi + 0x15c]
call fcn.004dc500
mov ecx, dword [esi + 0x15c]
add ecx, 4
push ecx
movzx eax, ax
push 0x5bb55c
push ebx
mov dword [esi + 8], eax
call fcn.004ccba0
jmp 0x4dd7d5
add edx, 0xfffffffe
push edx
mov edx, dword [esi + 0x15c]
add edx, 2
push edx
push esi
call fcn.004dc590
add esp, 0xc
test eax, eax
je case.0x4dd6e4.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x605660
push ebx
call fcn.004ccc20
add esp, 0xc
mov eax, dword [ebp - 0x8c]
push eax
call fcn.004d42c0
add esp, 4
test eax, eax
je 0x4dd6b4
mov ecx, 5
mov eax, esi
call fcn.004dd580
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x2a
pop ebx
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
Function at 0x4de690
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4de6d8
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.004ccc20
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4de6ff
shr eax, 8
test al, al
jne 0x4de6ff
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.004ccc20
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
mov eax, 2
call fcn.00493f9c
mov esp, ebp
pop ebp
ret

Function at 0x4de890
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edi + 0x150]
push ebx
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [ebp - 4]
mov ebx, eax
mov al, byte [ebp + 8]
push ecx
push edx
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], al
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4de8d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004ccc20
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ebx
mov ebx, str.SENT
call fcn.004de790
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4df610
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [ebp - 4], eax
jne 0x4df75f
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea esi, [ebx + 0x1eb0]
mov dword [esi], edi
cmp edi, esi
jae 0x4df646
mov byte [edi], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4df651
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4df65c
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [ebx + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [ebp + 0xc], edx
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x4df68e
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4df69b
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4df6a5
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4df6af
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4df6ba
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x4df6c5
mov byte [eax], 0xf0
inc dword [esi]
mov eax, dword [esi]
mov dword [ebx + 0x1eb4], eax
sub eax, edi
sub eax, 2
push eax
lea edx, [ebx + 0x1cb2]
push edx
mov dword [esi], edi
mov esi, dword [ebp - 4]
push 0x3e
call fcn.004dec00
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 0xc
push 0
push 3
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x150]
push eax
call esi
test eax, eax
jns 0x4df71c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.004ccc20
add esp, 0xc
lea edx, [ebx + 0x1cb3]
push 4
push edx
call fcn.004df4b0
mov eax, dword [edi + 0x150]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push eax
call esi
pop edi
pop esi
test eax, eax
jns 0x4df75f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.004ccc20
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e0160
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ebx
mov ebx, dword [esi + 0x154]
push edi
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4e01b2
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.004ce0c0
add esp, 8
cmp edi, 0xffffffff
jne 0x4e01e7
mov edx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push edx
call fcn.004ccc20
add esp, 8
pop edi
mov eax, 0x1e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push ebx
call fcn.004ccba0
push 1
push edi
mov dword [esi + 0x154], edi
call fcn.004eace0
mov dword [esi + 0x164], 1
mov eax, dword [ebx + 0x1b0]
add esp, 0x10
test eax, eax
je 0x4e0256
mov ecx, dword [ebx + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x4e0256
push edi
push esi
call fcn.004ce0c0
add esp, 8
pop edi
mov dword [esi + 0x154], 0xffffffff
mov eax, 0x2a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00493f9c
mov esp, ebp
pop ebp
ret
Function at 0x4e39d0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x4e3a04
push str.Couldnt_set_desired_mode
push ebx
call fcn.004ccc20
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x4e3a1b
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.004ccba0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x4e3a32
push edi
call fcn.004e3960
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x4e3a46
push edi
call fcn.004e0cb0
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x4e3a58
mov eax, edi
call fcn.004e39b0
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x4e3a66
mov eax, edi
call fcn.004e39c0
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret