joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497a70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da4ee
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x663a90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x5c]
push eax
call fcn.00497f40
mov dword [ebp - 4], 0
push dword [ebp - 0x5c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x497aea
and dword [ebp - 0x70], 0xfffffe00
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x78]
mov ecx, dword [ebp - 0x5c]
call fcn.00482d10
mov eax, dword [ebp - 0x70]
test al, al
je 0x497b2c
cmp al, 7
je 0x497b2c
lea ecx, [ebp - 0x78]
call fcn.00480ef0
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x5c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x497b0e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push ecx
push str.send_date
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.00481550
lea edx, [ebp - 0x68]
mov ecx, eax
call fcn.004992a0
mov eax, dword [ebp - 0x64]
mov edi, dword [ebp - 0x68]
sub eax, edi
sar eax, 2
cmp eax, 3
jb 0x497baf
mov ecx, dword [edi]
cmp ecx, 0x7d0
jb 0x497baf
mov eax, dword [edi + 4]
cmp eax, 1
jb 0x497baf
cmp eax, 0xc
ja 0x497baf
mov eax, dword [edi + 8]
cmp eax, 1
jb 0x497baf
cmp eax, 0x1f
ja 0x497baf
sub esp, 0x10
push eax
push dword [edi + 4]
push ecx
lea ecx, [ebp - 0x88]
call fcn.0040fd90
mov ecx, dword [eax]
mov dword [ebx + 0x3c], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x40], eax
lea ecx, [ebp - 0x80]
call fcn.0040fd70
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x80]
call fcn.0049a470
test eax, eax
je 0x497bcc
mov esi, dword [eax + 0xc]
jmp 0x497bce
xor esi, esi
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebx + 0x3c]
call fcn.0049a470
test eax, eax
je 0x497be3
mov eax, dword [eax + 0xc]
jmp 0x497be5
xor eax, eax
cmp esi, eax
je 0x497c21
mov eax, dword [ebp - 0x80]
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx + 0x40], eax
mov byte [ebp - 4], 4
lea ecx, [ebx + 0x34]
mov eax, dword [ebx + 0x34]
push dword [eax + 4]
call fcn.00406e60
mov eax, dword [ebx + 0x34]
mov dword [eax + 4], eax
mov eax, dword [ebx + 0x34]
mov dword [eax], eax
mov eax, dword [ebx + 0x34]
mov dword [eax + 8], eax
mov dword [ebx + 0x38], 0
jmp 0x497c39
push ecx
push str.reports
lea ecx, [ebp - 0x78]
call fcn.00481550
lea edx, [ebx + 0x34]
mov ecx, eax
call fcn.00499440
test edi, edi
je 0x497c4c
mov eax, dword [ebp - 0x60]
sub eax, edi
sar eax, 2
push eax
push edi
call fcn.00407980
lea ecx, [ebp - 0x78]
call fcn.00480ef0
mov esi, 1
jmp 0x497aec
Function at 0x498650
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da688
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x663a90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005a2d80
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 0x44]
push 0x104
push eax
push 0x640c08
push dword [ebp + 8]
push str.masterpdf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x498705
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4986e0
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.004034d0
mov esi, 1
jmp 0x498707
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x498729
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret 8

Function at 0x499ca0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x499d3f
push 0x2c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.005a2d80
add esp, 0xc
mov dword [esp + 8], 0x30
lea eax, [esp + 8]
mov dword [esp + 0x1c], 0x400000
mov dword [esp + 0x30], str.Q360SoftMgrTimerWnd
mov dword [esp + 0x10], 0x499d90
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x499d49
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49a790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0x663a90]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x49a7c0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret 0x14
push 0x800
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.005a2d80
push str._ElevPri
push esi
lea eax, [ebp - 0x80c]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x40
lea eax, [ebp - 0x860]
push 0
push eax
call fcn.005a2d80
add esp, 0x28
mov dword [ebp - 0x864], 0x44
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x838], 1
xorps xmm0, xmm0
mov edi, 1
movups xmmword [ebp - 0x81c], xmm0
push eax
lea eax, [ebp - 0x864]
mov word [ebp - 0x834], di
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x80c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49a7ac
push dword [ebp - 0x81c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x818]
call esi
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00589cd3
mov esp, ebp
pop ebp
ret 0x14

Function at 0x49a890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x663a90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x49a93c
mov eax, dword [0x642430]
xorps xmm0, xmm0
movups xmmword [ebp - 0x22], xmm0
push 0x38
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
movq qword [ebp - 0x12], xmm0
movq xmm0, qword [str.runas]
push 0
push eax
mov dword [ebp - 0xa], 0
mov word [ebp - 6], 0
movq qword [ebp - 0x24], xmm0
call fcn.005a2d80
add esp, 0xc
mov dword [ebp - 0x60], 0x3c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], str._ElevPri
push eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x49a93c
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00589cd3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49a950
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x654f40
push 0x5a3c90
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x663a90]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x49a9be
push 1
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x49a9b9
mov ebx, 1
push eax
call edi
push esi
call edi
jmp 0x49a9c4
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x49a9cd
lea eax, [ebx + 1]
jmp 0x49aa30
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
xor esi, esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 4], ebx
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x49aa22
push 0x10020
push dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x49aa22
lea eax, [ebp - 0x38]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0049aa58
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret

Function at 0x49ade0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x663a90]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x49ae30
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x49ae2a
shr eax, 8
cmp al, 2
jne 0x49ae2a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret

Function at 0x49b020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x49b051
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x49b040
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x49c440
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x49c649
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x49c648
cmp eax, 0x29
jne 0x49c478
cmp dword [esi + 0x10], 0
jne 0x49c648
test dword [esi + 0x50], 0x10000000
je 0x49c64d
cmp eax, 0x2e
jne 0x49c4cf
push 5
lea ecx, [esi + 0x24]
call fcn.0049d950
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x49c4c3
cmp byte [eax], 0x5c
jne 0x49c4c1
inc eax
cmp eax, ecx
je 0x49c4c1
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x49c4ae
mov dl, byte [eax]
cmp dl, 0x28
je 0x49c4bf
cmp dl, 0x29
je 0x49c4bf
test cl, 0x10
jne 0x49c4c1
mov cl, byte [eax]
cmp cl, 0x7b
je 0x49c4bf
cmp cl, 0x7d
jne 0x49c4c1
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.0049db40
jmp 0x49c635
cmp eax, 0x5c
jne 0x49c574
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x49c514
cmp byte [eax], 0x5c
jne 0x49c512
inc eax
cmp eax, ecx
je 0x49c512
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x49c4ff
mov dl, byte [eax]
cmp dl, 0x28
je 0x49c510
cmp dl, 0x29
je 0x49c510
test cl, 0x10
jne 0x49c512
mov cl, byte [eax]
cmp cl, 0x7b
je 0x49c510
cmp cl, 0x7d
jne 0x49c512
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.0049db40
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x49c541
cmp byte [esi + 0x48], 0x62
jne 0x49c541
push 4
lea ecx, [esi + 0x24]
call fcn.0049d950
mov ecx, esi
call fcn.0049d9c0
jmp 0x49c63c
test eax, eax
je 0x49c568
cmp byte [esi + 0x48], 0x42
jne 0x49c568
push 4
lea ecx, [esi + 0x24]
call fcn.0049d950
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0049d9c0
jmp 0x49c63c
mov ecx, esi
call fcn.0049c670
jmp 0x49c635
cmp eax, 0x5b
jne 0x49c597
mov ecx, esi
call fcn.0049d9c0
mov ecx, esi
call fcn.0049ca60
push 4
push 0x5d
mov ecx, esi
call fcn.0049d660
jmp 0x49c635
cmp eax, 0x28
jne 0x49c5c1
mov ecx, esi
call fcn.0049d9c0
mov ecx, esi
call fcn.0049dcf0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.0049d660
test bl, bl
je 0x49c63c
jmp 0x49c635
cmp eax, 0x5e
jne 0x49c5d9
push 2
lea ecx, [esi + 0x24]
call fcn.0049d950
mov ecx, esi
call fcn.0049d9c0
jmp 0x49c63c
cmp eax, 0x24
jne 0x49c5f1
push 3
lea ecx, [esi + 0x24]
call fcn.0049d950
mov ecx, esi
call fcn.0049d9c0
jmp 0x49c63c
cmp eax, 0x2a
je 0x49c662
cmp eax, 0x2b
je 0x49c662
cmp eax, 0x3f
je 0x49c662
cmp eax, 0x7b
je 0x49c662
cmp eax, 0x7d
jne 0x49c613
test dword [esi + 0x50], 0x10000000
je 0x49c654
cmp eax, 0x5d
jne 0x49c621
test dword [esi + 0x50], 0x10000000
je 0x49c65b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0049b9d0
mov ecx, esi
call fcn.0049d9c0
mov ecx, esi
call fcn.0049da10
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x49c450
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.0058705d
push 6
call fcn.0058705d
push 4
call fcn.0058705d
push 0xa
call fcn.0058705d
int3
Function at 0x49fa80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x49faac
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x49fa9d
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x49fae0
cmp dword [esi + 8], 0
jne 0x49fad0
push 0x641040
push dword [eax + 8]
call fcn.005b61c6
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x49fad0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.005b6c82
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x49fb02
mov eax, dword [esi + 8]
test eax, eax
je 0x49fafc
push eax
call fcn.005b6da8
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4a45d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4a45ee
cmp dword [esi + 0x48], 0
je 0x4a45ee
push 2
push 3
push esi
call fcn.004bc960
add esp, 0xc
push dword [ebp + 0xc]
call fcn.004b41c0
add esp, 4
test esi, esi
je 0x4a460e
cmp dword [esi + 0x48], 0
je 0x4a460e
push 3
push esi
call fcn.004bc9a0
add esp, 8
pop esi
pop ebp
ret
Function at 0x4a54b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bd850
Function at 0x4ae9c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x1a0]
call fcn.004aeca0
add esp, 8
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x4aea44
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4aea1c
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0x51
xor eax, eax
pop ebp
ret
push esi
push edi
call fcn.004bced0
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.004ae630
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x8658], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4aeca0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, edx
push ebx
push esi
shl eax, 4
lea esi, [ecx + 0x1c4]
mov ebx, dword [ecx + edx*4 + 0x1a0]
add esi, eax
mov eax, dword [ecx + 0x2c0]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x4aed56
cmp dword [ecx + edx*4 + 0x1b4], 0x4ae910
jne 0x4aed56
cmp dword [esi], 0
je 0x4aecec
test edi, edi
je 0x4aed56
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.004adf50
add esp, 0x14
cmp eax, 0xffffffff
je 0x4aed56
test al, 1
je 0x4aed56
cmp dword [esi], 0
jne 0x4aed3f
push 0x8000
mov dword [esi + 4], 0x8000
call dword [section..data]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x4aed3f
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4aed56
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4aed60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x4aed89
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4aedbf
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x5df178
push 2
push eax
call fcn.005b7332
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.005b7332
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4aeea0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x1e4], 0
je 0x4aeec0
push eax
call fcn.004a54b0
add esp, 4
test eax, eax
jne 0x4aeee2
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x1a0]
cmp eax, 0xffffffff
je 0x4aeebc
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4aeee2
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret
Function at 0x4af5b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6691b0]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x4af601
push 3
push 2
push eax
push 6
call fcn.004d3910
add esp, 0x10
test al, al
je 0x4af5f5
mov dword [0x6691b0], 2
mov esp, ebp
pop ebp
ret
mov dword [0x6691b0], 1
jmp 0x4af606
cmp eax, 2
je 0x4af646
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4af62d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4af646
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret

Function at 0x4af710
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4af758
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004bced0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004ae6d0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004ae6d0
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x4af850
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x663a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x4afa2a
cmp byte [edi + 0x286], 0
push esi
jne 0x4afa20
cmp byte [edi + 0x2a2], 0
jne 0x4afa20
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4af8e8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.004bced0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.004ae630
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push 0
push eax
call fcn.005a2d80
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4af951
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.004bced0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.004ae630
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x140]
push eax
lea esi, [edi + 0x112]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.004aff30
add esp, 0xc
test al, al
jne 0x4af9a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.004bced0
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004ae630
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x174]
push eax
lea eax, [edi + 0x144]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004aff30
add esp, 0xc
test al, al
jne 0x4afa20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.004bced0
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004ae630
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00589cd3
mov esp, ebp
pop ebp
ret
push edi
call fcn.004af4d0
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00589cd3
mov esp, ebp
pop ebp
ret