joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ad20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x49ad32
mov dword [edi], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x49af06
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x13c4], 0
test ecx, ecx
je 0x49af06
mov eax, dword [ebp + 0x14]
test eax, eax
js 0x49af06
cmp byte [esi + 0x1390], 0
je 0x49ad82
test edi, edi
je 0x49ad70
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
xor eax, eax
pop esi
pop ebp
ret 0x10
test eax, eax
jne 0x49ad9e
test edi, edi
je 0x49ad8c
mov dword [edi], eax
pop edi
mov dword [esi + 0x13c4], 0
xor eax, eax
pop esi
pop ebp
ret 0x10
push ebx
push dword [esi]
mov dword [esi + 0x13a8], eax
mov dword [esi + 0x13a4], ecx
call fcn.00561abc
add esp, 4
test eax, eax
jne 0x49ae74
nop dword [eax]
cmp dword [esi + 0x1398], 0
jne 0x49ae17
mov ebx, dword [esi]
push ebx
call fcn.005604af
add esp, 4
cmp eax, 0xffffffff
je 0x49ae17
push ebx
push eax
call fcn.00560a1f
push dword [esi]
lea eax, [esi + 4]
push 0x1388
push 1
push eax
call fcn.0055cf27
push dword [esi]
mov ebx, eax
call fcn.00561abc
add esp, 0x1c
test eax, eax
jne 0x49ae74
lea eax, [esi + 4]
mov dword [esi + 0x138c], ebx
mov dword [esi + 0x1398], ebx
mov dword [esi + 0x1394], eax
lea eax, [esi + 0x1394]
push eax
call fcn.0049aa10
test eax, eax
jne 0x49aecc
mov ebx, dword [esi]
push ebx
call fcn.005604af
add esp, 4
cmp eax, 0xffffffff
je 0x49ae47
push ebx
push eax
call fcn.00560a1f
add esp, 8
jmp 0x49ae59
cmp dword [esi + 0x1398], 0
jne 0x49ae59
cmp dword [esi + 0x13a8], 0
ja 0x49ae91
cmp dword [esi + 0x13a8], 0
je 0x49aeae
push dword [esi]
call fcn.00561abc
add esp, 4
test eax, eax
je 0x49adc0
test edi, edi
je 0x49ae7e
mov dword [edi], 0xfffffffa
pop ebx
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
xor eax, eax
pop esi
pop ebp
ret 0x10
test edi, edi
je 0x49ae9b
mov dword [edi], 0xfffffff9
pop ebx
pop edi
mov dword [esi + 0x13c4], 0xfffffff9
xor eax, eax
pop esi
pop ebp
ret 0x10
test edi, edi
je 0x49aeb8
mov dword [edi], 0
mov eax, dword [ebp + 0x14]
pop ebx
pop edi
mov dword [esi + 0x13c4], 0
pop esi
pop ebp
ret 0x10
cmp eax, 4
jne 0x49aef1
test edi, edi
je 0x49aed7
mov dword [edi], eax
mov eax, dword [ebp + 0x14]
sub eax, dword [esi + 0x13a8]
pop ebx
pop edi
mov dword [esi + 0x13c4], 4
pop esi
pop ebp
ret 0x10
test edi, edi
je 0x49aef7
mov dword [edi], eax
pop ebx
mov dword [esi + 0x13c4], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
test edi, edi
je 0x49af10
mov dword [edi], 0xfffffffe
test esi, esi
je 0x49af1e
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x49b110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push str.1.0.6__6_Sept_2010
push dword [ebp + 8]
push 0x5a8f30
push 2
call fcn.0055be83
add esp, 4
push eax
call fcn.0049b1e0
add esp, 0x10
cmp dword [ebp + 8], 0x3ef
jne 0x49b154
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 2
call fcn.0055be83
add esp, 4
push eax
call fcn.0049b1e0
add esp, 8
push 3
call fcn.0055c1e3
int3
Function at 0x4a01c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x60940c]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [0x611020]
mov ecx, eax
inc eax
mov dword [0x611020], eax
test ecx, ecx
je 0x4a01fc
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0052b33d
add esp, 0x194
ret
cmp byte [esp + 0x19c], 0
je 0x4a0238
mov dword [fcn.0055cd50], 0x55cd50
mov dword [fcn.00558829], 0x558829
mov dword [fcn.0055dc94], 0x55dc94
mov dword [0x6091f4], 0x56de80
mov dword [fcn.00558876], 0x558876
push ebx
call fcn.004ac870
test eax, eax
je 0x4a027a
mov ebx, dword [esp + 0x19c]
test bl, 2
je 0x4a029d
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4a027a
mov eax, dword [esp + 4]
cmp al, 2
jne 0x4a0295
shr eax, 8
cmp al, 2
jne 0x4a0295
call fcn.004ab4f0
test eax, eax
je 0x4a029d
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0052b33d
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4a027a
call fcn.0052c520
test eax, eax
jne 0x4a027a
call fcn.004a9630
mov eax, dword [0x611134]
test bl, 4
mov ecx, 1
mov dword [0x611024], ebx
cmovne eax, ecx
mov dword [0x611134], eax
call fcn.004b5920
mov ecx, dword [esp + 0x194]
xor eax, eax
pop ebx
xor ecx, esp
call fcn.0052b33d
add esp, 0x194
ret
Function at 0x4a7ce0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x60940c]
xor eax, esp
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4a7dba
lea eax, [esp + 4]
push eax
push edi
push 2
call fcn.004c2270
add esp, 0xc
test eax, eax
jne 0x4a7dba
lea eax, [esp + 8]
push eax
push edi
push 0x17
call fcn.004c2270
add esp, 0xc
test eax, eax
jne 0x4a7dba
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a7d35
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.004c2240
add esp, 0xc
test eax, eax
je 0x4a7d69
sub eax, edi
push eax
push 0x2e
push edi
call fcn.004c2240
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4a7d6b
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [esi + edi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x4a7da4
mov al, byte [edi]
push eax
call fcn.004b59f0
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x4a7d83
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0052b33d
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
xor ecx, esp
call fcn.0052b33d
add esp, 0x18
ret

Function at 0x4a9630
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [0x6091fc]
cmp eax, 0xffffffff
jne 0x4a9672
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4a9658
xor eax, eax
test eax, eax
mov dword [0x6091fc], eax
setg al
ret
push eax
push 0
mov dword [0x6091fc], 1
call fcn.004b3c80
mov eax, dword [0x6091fc]
add esp, 8
test eax, eax
setg al
ret

Function at 0x4a9680
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2d0], 2
jne 0x4a96d5
mov eax, dword [0x6091fc]
cmp eax, 0xffffffff
jne 0x4a96cf
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4a96b5
xor eax, eax
test eax, eax
mov dword [0x6091fc], eax
setg al
ret
push eax
push 0
mov dword [0x6091fc], 1
call fcn.004b3c80
mov eax, dword [0x6091fc]
add esp, 8
test eax, eax
setg al
ret
mov al, 1
ret
Function at 0x4b3160
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x1d0], 0
je 0x4b31a4
push esi
push 1
push edi
call fcn.004a3a00
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.004a3a00
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x4b31dd
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x5ab028
push 2
push eax
call fcn.0055bd63
push dword [edi + 0x158]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0055bd63
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x4b38b0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, 0x1cc
mov ecx, dword [edi + 0x1ac]
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1a8]
mov ebp, dword [eax + edi]
mov eax, 0x1dc
cmove esi, eax
mov eax, dword [edi + 0x2c8]
add esi, edi
mov ebx, dword [esi + 4]
sub ebx, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x4b3988
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1bc]
cmp dword [eax + edi], 0x4b3500
jne 0x4b3988
cmp dword [esi], 0
je 0x4b3918
test ebx, ebx
je 0x4b3988
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.004b2d20
add esp, 0x14
cmp eax, 0xffffffff
je 0x4b3988
test al, 1
je 0x4b3988
mov ecx, dword [esi]
test ecx, ecx
jne 0x4b3968
mov eax, dword [edi]
mov eax, dword [eax + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x6091e8]
mov ebx, dword [esi + 4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x4b3981
mov eax, dword [esi + 8]
push 0
push ebx
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4b3988
add dword [esi + 8], eax
jmp 0x4b3988
mov dword [esi + 4], 0
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b39f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4b39c2
mov ecx, dword [esp + 0x24]
lea eax, [ebx + 0x52]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
ret
push esi
push edi
call fcn.004d8460
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.004b31f0
mov eax, dword [edi]
add esp, 0x14
mov ecx, dword [esp + 0x24]
pop edi
mov dword [eax + 0x48dc], esi
mov eax, 0x37
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
ret

Function at 0x4b3d40
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1ec], 0
je 0x4b3d5d
push eax
call fcn.004ac040
add esp, 4
test eax, eax
jne 0x4b3d7c
xor al, al
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x4b3d5a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4b3d5a
mov al, 1
ret
Function at 0x4c25a0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [eax], ebx
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4c2732
push ebp
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4c271c
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4c25ef
lea ebp, [eax + 0xe]
jmp 0x4c25fb
cmp eax, 0x17
jne 0x4c26a9
lea ebp, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4c26a9
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4c26a9
cmp eax, ebp
jb 0x4c26a9
push 0x20
call dword [0x6091e8]
mov esi, eax
add esp, 4
test esi, esi
je 0x4c2711
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebp
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebp
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x6091e8]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4c2700
push ebp
push dword [edi + 0x18]
push eax
call fcn.0054e520
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4c2695
push eax
call dword [0x6091f4]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4c26e6
mov eax, dword [esp + 0x10]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x4c26a5
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4c25e2
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4c26c8
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x4c2718
push ebx
call fcn.004c2560
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebp, 8
call dword [0x6091ec]
push esi
call dword [0x6091ec]
add esp, 8
jmp 0x4c26b8
push esi
mov ebp, 8
call dword [0x6091ec]
add esp, 4
jmp 0x4c26b8
mov ebp, 8
jmp 0x4c26b8
test ebx, ebx
jne 0x4c2728
mov ebp, 0x2af9
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebx
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4c3090
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x4c30aa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x5ad2f0
push esi
call fcn.00566dd0
add esp, 8
test eax, eax
je 0x4c30f2
test ebp, ebp
je 0x4c30e3
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x4c3118
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c3118
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x4c31cf
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c3135
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x6091e8]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4c31c5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4c31c5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c3167
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c3180
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4c3190
test ebp, ebp
je 0x4c31bc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x6091ec]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x6091ec]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x4c66d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x60940c]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.005671e4
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4c6735
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4c6735
lea eax, [esp]
push eax
call dword [0x6091f4]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052b33d
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor eax, eax
xor ecx, esp
call fcn.0052b33d
add esp, 0x108
ret
Function at 0x4cbd10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x60940c]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x80
push eax
mov ebp, dword [edi + 0x1ac]
or esi, 0xffffffff
mov ebx, dword [edi]
push ebp
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4cbd72
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebp
push edi
call fcn.004b3c80
add esp, 8
cmp esi, 0xffffffff
jne 0x4cbd96
push str.Error_accept__ing_server_connect
push ebx
call fcn.004b31f0
add esp, 8
mov eax, 0x1e
jmp 0x4cbe05
push str.Connection_accepted_from_server_n
push ebx
call fcn.004b32d0
push 1
mov byte [edi + 0x28c], 0
push esi
mov dword [edi + 0x1ac], esi
call fcn.004d8d10
add esp, 0x10
mov byte [edi + 0x1b9], 1
cmp dword [ebx + 0x1d8], 0
je 0x4cbe03
push 1
push ebx
call fcn.004a3a00
mov eax, dword [ebx + 0x1d8]
push 1
push esi
push dword [ebx + 0x1dc]
call eax
push 0
push ebx
mov esi, eax
call fcn.004a3a00
add esp, 0x1c
test esi, esi
je 0x4cbe03
push edi
call fcn.004cc2b0
add esp, 4
mov eax, 0x2a
jmp 0x4cbe05
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052b33d
add esp, 0x88
ret
Function at 0x4d31d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
mov byte [esp + 0x16], al
lea eax, [esp + 0x14]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x1a8]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4d321c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004b31f0
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.004d2de0
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4d3350
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebp
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebp, dword [eax + 0x150]
jne 0x4d34a0
push ebx
push esi
push edi
lea ebx, [ebp + 0x1cb0]
lea edi, [ebp + 0x1eb0]
mov dword [edi], ebx
cmp ebx, edi
jae 0x4d338b
mov byte [ebx], 0xff
inc dword [edi]
mov eax, dword [edi]
jmp 0x4d338d
mov eax, ebx
cmp eax, edi
jae 0x4d33a1
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4d33a1
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x1c]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x4d340b
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4d340b
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4d340b
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4d340b
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4d340b
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4d340b
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov esi, dword [esp + 0x10]
mov dword [ebp + 0x1eb4], eax
sub eax, ebx
sub eax, 2
mov dword [edi], ebx
push eax
lea eax, [ebp + 0x1cb2]
push eax
push 0x3e
push esi
call fcn.004d2ee0
add esp, 0x10
push 0
push 3
push ebx
mov ebx, dword [esp + 0x24]
push dword [ebx + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x4d345f
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004b31f0
add esp, 0xc
push 4
lea eax, [ebp + 0x1cb3]
push eax
push ebx
call fcn.004d3240
add esp, 0xc
lea eax, [ebp + 0x1cb7]
push 0
push 2
push eax
push dword [ebx + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4d349d
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004b31f0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret
Function at 0x4d4890
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x60940c]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
lea eax, [esp + 8]
push esi
push edi
push eax
mov edi, dword [ebp + 0x518]
lea eax, [esp + 0x1c]
mov ebx, dword [ebp]
push eax
mov dword [esp + 0x18], 0x80
mov eax, dword [edi + 0x154]
push 0
add eax, 4
push eax
push dword [edi + 0x15c]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x148], 0
mov dword [edi + 0x14c], eax
jne 0x4d4916
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xc8]
push eax
call fcn.0054e520
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x148], eax
mov edx, dword [edi + 0x14c]
cmp edx, 4
jge 0x4d4951
push str.Received_too_short_packet
push ebx
call fcn.004b31f0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052b33d
add esp, 0x8c
ret
mov eax, dword [edi + 0x15c]
movzx ecx, byte [eax]
movzx eax, byte [eax + 1]
shl ecx, 8
or ecx, eax
mov dword [edi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x4d4972
jmp dword [ecx*4 + 0x4d4a98]
cmp edx, 4
jle case.0x4d4972.4
mov esi, dword [edi + 0x15c]
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x4d4972.4
lea eax, [edx - 4]
push eax
lea eax, [esi + 4]
push eax
push 1
push ebp
call fcn.004b3130
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d49d0
push 5
push edi
call fcn.004d5370
add esp, 8
mov eax, esi
jmp 0x4d4938
mov eax, dword [edi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.004bee70
jmp 0x4d4a6c
mov eax, dword [edi + 0x15c]
lea esi, [edx - 4]
push esi
lea ecx, [eax + 4]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
push dword [esp + 0x18]
shl ecx, 8
or ecx, eax
mov dword [edi + 8], ecx
call fcn.004d4580
add esp, 8
cmp eax, esi
jae case.0x4d4972.4
push dword [esp + 0x14]
push str.TFTP_error:__s_n
push ebx
call fcn.004b32d0
jmp 0x4d4a6c
lea eax, [edx - 2]
push eax
mov eax, dword [edi + 0x15c]
add eax, 2
push eax
push edi
call fcn.004d4620
add esp, 0xc
test eax, eax
je case.0x4d4972.4
jmp 0x4d4938
push str.Internal_error:_Unexpected_packet
push 0x5aea74
push ebx
call fcn.004b31f0
add esp, 0xc
push ebp
call fcn.004bf220
add esp, 4
test eax, eax
je 0x4d4936
push 5
push edi
call fcn.004d5370
add esp, 8
mov eax, 0x2a
jmp 0x4d4938
Function at 0x4e04e0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4e04f0
sub esi, ecx
je 0x4e0507
lea eax, [esi + esi]
push eax
call dword [0x6091e8]
jmp 0x4e0512
push 0x5a9829
call dword [0x6091f4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e0525
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
xor ecx, ecx
test esi, esi
je 0x4e0540
nop dword [eax + eax]
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x4e0530
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ebx, dword [esp + 0x24]
test eax, eax
je 0x4e05bd
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4e05b1
push 0
lea eax, [esi + esi]
mov dword [esp + 0x18], 0x10
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push 2
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x6091ec]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret