joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486de0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [0x597628]
test edx, edx
push esi
mov esi, ecx
je 0x486e36
lea ecx, [ecx]
cmp dword [edx], esi
je 0x486e00
mov edx, dword [edx + 0x218]
test edx, edx
jne 0x486df0
pop esi
ret
mov ecx, esi
call fcn.00486d50
cmp esi, dword [0x5a1b00]
jne 0x486e2d
mov ecx, 4
call fcn.0052b760
mov eax, dword [0x5a1b00]
push 0
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
pop esi
jmp fcn.0041cfc0
push 0
push esi
call dword [sym.imp.USER32.dll_FlashWindow]
pop esi
ret
Function at 0x48a840
Capabilities:
Clear file content

Disassembly:
sub esp, 0x40c
push esi
mov esi, ecx
mov eax, dword [esi + 0x468]
push edi
xor edi, edi
cmp eax, edi
je 0x48a90d
mov ecx, dword [esi + 0x474]
cmp ecx, 1
jne 0x48a8df
lea eax, [esi + 0x234]
push eax
lea ecx, [esi + 0x130]
push ecx
lea edx, [esp + 0x34]
push 0x574904
push edx
mov dword [esi + 0x474], 2
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00572efe
add esp, 0x18
test eax, eax
jne 0x48a8be
mov edx, dword [esi + 0x464]
cmp edx, dword [esp + 0x1c]
jae 0x48a8be
mov dword [esi + 0x468], edi
pop edi
pop esi
add esp, 0x40c
ret
mov eax, dword [esi + 0x468]
cmp eax, 0x2000
jb 0x48a8af
add eax, 0xffffe000
pop edi
mov dword [esi + 0x468], eax
pop esi
add esp, 0x40c
ret
cmp ecx, 2
mov dword [esi + 0x474], edi
jne 0x48a90d
mov ecx, dword [esi + 0x43c]
push edi
push eax
xor edx, edx
call fcn.00488fc0
and eax, edx
cmp eax, 0xffffffff
je 0x48a90d
mov eax, dword [esi + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
add esp, 0x40c
ret
Function at 0x48abc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x597650]
sub esp, 0x7d0
test eax, eax
push esi
mov esi, ecx
je 0x48abe0
cmp eax, esi
je 0x48abea
mov eax, dword [eax + 0x4bc]
test eax, eax
jne 0x48abd2
xor eax, eax
pop esi
add esp, 0x7d0
ret
mov ecx, dword [esi + 0x4b8]
call fcn.004dbea0
test eax, eax
je 0x48abe0
mov ecx, dword [0x5a1b00]
push edi
push 0
push 0x465bc0
mov edx, 0xfa
mov dword [0x59477c], esi
call fcn.00464b70
mov ecx, esi
mov edi, eax
mov dword [0x59477c], 0
call fcn.0048a760
test eax, eax
je 0x48ac8c
mov ecx, dword [esi + 0x4b8]
call fcn.004dbea0
test eax, eax
je 0x48ac83
test edi, edi
jg 0x48ac97
mov eax, dword [esi + 0x47c]
test eax, eax
je 0x48ac83
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48ac65
push 0
sub eax, edx
mov edx, dword [esi + 0x4b0]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
xor edx, edx
mov ecx, esi
call fcn.0048aaf0
pop edi
xor eax, eax
pop esi
add esp, 0x7d0
ret
cmp edi, 2
jne 0x48ae06
mov eax, dword [esi + 0x47c]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x48ad25
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call edi
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48acc6
push 0
sub eax, edx
mov edx, dword [esi + 0x4b0]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
lea eax, [esi + 0x68]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x3f8]
push str._s_id__s
push edx
call edi
mov eax, dword [esi + 0x4b8]
add esp, 0x10
push eax
mov edx, 2
lea ecx, [esp + 0x3f4]
call fcn.004c8030
lea ecx, [esp + 0x3f0]
push ecx
push str.__ignore__wdu__s
jmp 0x48ad64
lea eax, [esi + 0x68]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x3f8]
push 0x575b58
push edx
call edi
mov eax, dword [esi + 0x4b8]
add esp, 0x10
push eax
mov edx, 2
lea ecx, [esp + 0x3f4]
call fcn.004c8030
lea ecx, [esp + 0x3f0]
push ecx
push str.__ignore__du__s
lea edx, [esp + 0x10]
push edx
call edi
mov eax, dword [esi + 0x4b8]
mov ecx, dword [eax]
add esp, 0xc
push eax
push 0
push 0
push 0
lea edx, [esp + 0x18]
push 0
call fcn.0043bba0
xor edx, edx
mov ecx, esi
call fcn.0048aaf0
mov esi, dword [0x597650]
test esi, esi
je 0x48adfb
jmp 0x48ada0
mov eax, dword [esi + 0x47c]
test eax, eax
lea eax, [esi + 0x68]
lea ecx, [esi + 4]
push eax
lea edx, [esp + 0xc]
push ecx
je 0x48adbd
push str._s_id__s
jmp 0x48adc2
push 0x575b58
push edx
call edi
add esp, 0x10
push 1
push 0
lea edx, [esp + 0x10]
lea ecx, [esp + 0x3f8]
call fcn.00535d60
test eax, eax
je 0x48adf1
xor edx, edx
mov ecx, esi
call fcn.0048aaf0
mov esi, dword [0x597650]
jmp 0x48adf7
mov esi, dword [esi + 0x4bc]
test esi, esi
jne 0x48ada0
pop edi
xor eax, eax
pop esi
add esp, 0x7d0
ret
mov eax, edi
pop edi
pop esi
add esp, 0x7d0
ret
Function at 0x48b970
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, dword [0x597650]
sub esp, 0x1c
test eax, eax
push esi
mov esi, ecx
je 0x48b98e
nop
cmp eax, esi
je 0x48b995
mov eax, dword [eax + 0x4bc]
test eax, eax
jne 0x48b980
xor eax, eax
pop esi
add esp, 0x1c
ret
mov ecx, dword [esi + 0x4b8]
call fcn.004dbea0
test eax, eax
jne 0x48b9b9
push 0x574b10
xor edx, edx
mov ecx, esi
call fcn.0048b250
xor eax, eax
pop esi
add esp, 0x1c
ret
mov eax, dword [esi + 0x444]
test eax, eax
push edi
mov dword [esi + 0x440], 2
mov dword [esi + 0x4ac], 0
je 0x48bab7
cmp word [esi + 0x454], 0
lea edi, [esi + 0x454]
jne 0x48bab7
mov eax, dword [0x597618]
test eax, eax
je 0x48ba40
xor edx, edx
mov ecx, 0xb5c
call fcn.0041c9e0
push eax
push 1
push 1
push 1
mov edx, 1
mov ecx, esi
call fcn.0052a6c0
mov eax, dword [esi + 0x4b8]
mov ecx, dword [esi + 0x444]
push eax
push ecx
push 1
lea ecx, [esi + 0xcc]
xor edx, edx
call fcn.00486340
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
mov dx, word [0x589910]
mov cx, word [0x58990c]
push 1
push 0
push edi
call fcn.004fd380
cmp eax, 0xffffffff
mov dword [esi + 0x4b0], eax
je 0x48bb47
mov edx, dword [0x5a1b00]
push 8
push 0x8011
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x4b8]
mov ecx, dword [esi + 0x444]
mov edx, dword [esi + 0x464]
push eax
push ecx
xor ecx, ecx
mov cx, word [edi]
push edx
mov edx, dword [eax + 0x908]
push ecx
push edx
lea edx, [esi + 0x234]
lea ecx, [esi + 4]
call fcn.0050d420
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
lea eax, [esi + 0xcc]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
xor edx, edx
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x48bad9
mov ecx, 0xb5e
jmp 0x48bb9b
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], eax
xor eax, eax
mov ax, word [esi + 0x454]
lea ecx, [esp + 8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], edx
mov word [esp + 0x14], 2
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esp + 0xc]
push 0
mov word [esp + 0x1a], ax
mov edx, dword [ecx]
mov cx, word [0x58990c]
push 2
mov dword [esp + 0x20], edx
mov dx, word [0x589910]
push 0
call fcn.004fd380
cmp eax, 0xffffffff
mov dword [esi + 0x4b0], eax
jne 0x48bb4e
mov ecx, 0xb5d
jmp 0x48bb99
mov ecx, eax
call fcn.0053e860
mov eax, dword [0x5a1b00]
mov ecx, dword [esi + 0x4b0]
push 0x10
push 0x800f
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x4b0]
push 0x10
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x48bbaa
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x48bbaa
mov ecx, 0xb5f
xor edx, edx
call fcn.0041c9e0
mov ecx, esi
xor edx, edx
push eax
call fcn.0048b250
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x48c720
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.00565660
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x48c915
cmp dword [esi + 0x474], ebx
je 0x48c745
call fcn.0048a840
mov edx, dword [esi + 0x4b0]
push 1
push 1
mov ecx, 0x8012
mov dword [esi + 0x4ac], ebx
call fcn.0053f9b0
test eax, eax
jne 0x48c915
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push edi
nop
mov ecx, dword [esi + 0x4b4]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x4b4], ecx
jl 0x48c7a5
mov edx, dword [esi + 0x4b0]
push ebx
push 1
mov ecx, 0x8012
mov dword [esi + 0x4b4], ebx
call fcn.0053f9b0
test eax, eax
jne 0x48c913
mov ecx, dword [esi + 0x4b0]
push ebx
push 0x2000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov edi, eax
cmp dword [esi + 0x440], 4
jne 0x48c913
cmp edi, 0xffffffff
je 0x48c8d6
cmp edi, ebx
jle 0x48c8f6
mov edx, dword [esi + 0x458]
mov ecx, dword [esi + 0x470]
mov eax, dword [esi + 0x468]
add edx, edi
add ecx, edi
cmp eax, ebx
mov dword [esi + 0x458], edx
mov dword [esi + 0x470], ecx
jbe 0x48c810
mov edx, dword [esi + 0x43c]
push 2
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x43c]
push ebx
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48c8fd
cmp edi, dword [esp + 0x10]
jne 0x48c8fd
mov eax, dword [esi + 0x458]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, esi
mov dword [esi + 0x45c], eax
call fcn.0048a9a0
mov ecx, esi
call fcn.0048c180
test eax, eax
je 0x48c913
mov eax, dword [0x597650]
cmp eax, ebx
je 0x48c913
cmp eax, esi
je 0x48c890
mov eax, dword [eax + 0x4bc]
cmp eax, ebx
jne 0x48c875
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2004
ret
mov eax, dword [esi + 0x464]
cmp eax, ebx
jbe 0x48c8a2
cmp dword [esi + 0x458], eax
jae 0x48c8ea
cmp dword [0x597654], ebx
je 0x48c770
cmp dword [esi + 0x470], 0x7d000
jl 0x48c770
mov ecx, dword [esi + 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esi + 0x470], ebx
jmp 0x48c770
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x48c913
mov ecx, 0xb67
jmp 0x48c902
mov edx, dword [esi + 0x464]
mov dword [esi + 0x458], edx
push 0x574b10
jmp 0x48c90a
mov ecx, 0xb65
xor edx, edx
call fcn.0041c9e0
push eax
mov ecx, esi
xor edx, edx
call fcn.0048b250
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2004
ret
Function at 0x48cdf0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
sub esp, 0x3e8
push esi
xor esi, esi
test al, al
push edi
lea edx, [esp + 8]
je 0x48ce0f
inc ecx
mov byte [edx], al
mov al, byte [ecx]
inc edx
inc esi
test al, al
jne 0x48ce04
test esi, esi
mov byte [edx], 0
lea edi, [esp + 8]
ja 0x48ce25
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
mov cl, byte [esp + 8]
xor eax, eax
test cl, cl
je 0x48ce50
jmp 0x48ce40
movzx ecx, cl
xor ecx, eax
shl ecx, 1
inc edi
mov eax, ecx
mov cl, byte [edi]
test cl, cl
jne 0x48ce40
pop edi
pop esi
add esp, 0x3e8
ret

Function at 0x491b20
Capabilities:
Capture screenshot

Disassembly:
push esi
call fcn.005366c0
mov esi, eax
test esi, esi
je 0x491b73
mov eax, dword [esi + 0x708]
test eax, eax
jg 0x491b73
mov eax, dword [esi]
cmp eax, dword [0x5a1b0c]
je 0x491b73
push eax
mov dword [esi + 0x708], 1
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x491b6b
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x491b6b
xor edx, edx
mov ecx, esi
call fcn.00491a70
mov ecx, esi
pop esi
jmp fcn.0051c6d0
pop esi
ret

Function at 0x491b80
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x589bd0]
test eax, eax
je 0x491bed
push esi
mov esi, dword [0x5a1af8]
test esi, esi
je 0x491bec
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsIconic]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
lea esp, [esp]
mov ecx, dword [esi]
call fcn.00536a40
test eax, eax
je 0x491bdf
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x491bdf
mov ecx, dword [esi]
call fcn.0051ad50
test eax, eax
je 0x491bdf
mov ecx, dword [esi]
push ecx
call ebp
test eax, eax
je 0x491bdf
mov edx, dword [esi]
push 0
push edx
call edi
mov esi, dword [esi + 0xd84]
test esi, esi
jne 0x491bb0
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x492680
Capabilities:
Capture screenshot
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push edi
mov ebx, edx
mov edi, ecx
call fcn.005366c0
mov ebp, eax
test ebp, ebp
je 0x4926e8
push esi
push edi
call dword [sym.imp.USER32.dll_IsZoomed]
neg eax
sbb eax, eax
neg eax
mov ecx, edi
mov dword [ebp + 0x768], eax
call fcn.00536a40
test eax, eax
je 0x4927fb
mov eax, dword [0x589bd0]
test eax, eax
je 0x4927fb
mov ecx, edi
call fcn.0051ad50
test eax, eax
jne 0x4926ec
cmp dword [ebp + 0x700], 3
je 0x4927fb
push 0
push 0
push 0x10
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop edi
pop ebp
pop ebx
ret
test bl, 1
mov ebx, dword [sym.imp.USER32.dll_UpdateWindow]
je 0x492767
call fcn.0050b730
test eax, eax
jne 0x492767
call fcn.00491b80
mov eax, dword [0x5a1b04]
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call ebp
cmp eax, edi
jne 0x492767
push 2
push eax
call ebp
mov esi, eax
test esi, esi
je 0x49273e
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4927d3
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x492724
mov ecx, edi
call fcn.004dc030
mov esi, eax
mov ecx, esi
call fcn.00536a40
test eax, eax
je 0x492767
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.005366c0
mov ecx, eax
call fcn.0051c6d0
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call ebp
mov ecx, dword [0x5a1b04]
push ecx
call ebx
push edi
call ebx
mov edx, dword [0x5a1b04]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb
push edx
call esi
push 7
push edi
call ebp
push 0
push edi
call ebp
mov eax, dword [0x5a1b04]
push 0
push 1
push 0xb
push eax
call esi
mov ecx, dword [0x5a1b04]
push ecx
call ebx
push edi
call ebx
mov ecx, edi
call fcn.005386c0
call fcn.00491b80
call fcn.005387a0
pop esi
pop edi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.0051c6d0
test esi, esi
je 0x49273e
cmp esi, edi
je 0x49273e
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x492759
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 7
push edi
call ebx
mov ecx, edi
call fcn.00536a40
test eax, eax
jne 0x49283e
mov eax, dword [0x5a1b1c]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x492831
push 0x10
call esi
test ah, ah
jns 0x492839
mov eax, dword [0x5a1b1c]
test eax, eax
jne 0x49283e
push 0x10
call esi
test ah, ah
jns 0x49283e
push 0
push edi
call ebx
cmp edi, dword [0x5a1b0c]
jne 0x492850
mov dword [0x5a1b0c], 0
mov ecx, dword [ebp]
call fcn.005386c0
call fcn.005387a0
mov ecx, edi
call fcn.005366c0
pop esi
pop edi
pop ebp
mov ecx, eax
pop ebx
jmp fcn.0051c6d0
Function at 0x492960
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ecx
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
cmp edi, dword [0x597790]
je 0x4929cb
push ebx
xor eax, eax
mov bl, 0x20
push esi
mov esi, dword [sym.imp.USER32.dll_VkKeyScanA]
mov dword [0x59778c], eax
mov byte [esp + 0xc], bl
lea esp, [esp]
test bl, bl
je 0x4929c0
test eax, eax
jne 0x4929c0
mov eax, dword [esp + 0xc]
push eax
call esi
cmp ah, 6
jne 0x4929b0
mov eax, 1
mov dword [0x59778c], eax
jmp 0x4929b5
mov eax, dword [0x59778c]
inc bl
cmp bl, 0xff
mov byte [esp + 0xc], bl
jbe 0x492990
pop esi
pop ebx
mov dword [0x597790], edi
pop edi
pop ecx
ret
mov eax, dword [0x59778c]
pop edi
pop ecx
ret
Function at 0x4968f0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword [0x597d28]
test eax, eax
push esi
mov esi, ecx
je 0x496927
mov eax, dword [0x589a60]
test eax, eax
je 0x496910
xor ecx, ecx
call fcn.004de2d0
test eax, eax
je 0x496927
push 0
mov edx, esi
mov ecx, 0x597d30
call fcn.004e8c60
test eax, eax
jne 0x49692f
mov dword [0x597d28], eax
xor ecx, ecx
pop esi
jmp fcn.00496860
mov eax, dword [0x589a68]
or esi, 0xffffffff
cmp eax, esi
jne 0x496994
push 0
push 1
push 2
mov dword [0x589a6c], esi
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, esi
mov dword [0x589a68], eax
je 0x496927
mov edx, dword [0x589a64]
mov ecx, eax
call fcn.004fd2b0
test eax, eax
je 0x496927
mov eax, dword [0x589a68]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
jne 0x496927
mov ecx, dword [0x5a1b00]
mov edx, dword [0x589a68]
push 8
push 0x802a
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
ret
Function at 0x4969a0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x589a6c]
sub esp, 0x17c
cmp eax, 0xffffffff
push ebp
push esi
jne 0x496a8d
mov eax, dword [0x5a1b00]
mov ecx, dword [0x589a68]
push 0
push 0
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov ecx, dword [0x589a68]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
cmp eax, 0xffffffff
mov dword [0x589a6c], eax
je 0x496a8d
mov edx, 0x64
lea ecx, [esp + 0x1c]
call fcn.0041e210
mov eax, dword [esp + 8]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [0x589a70], 0xffffffff
je 0x496a5c
cmp eax, 6
jl 0x496a5c
movzx edx, byte [esp + 0x13]
movzx eax, byte [esp + 0x12]
movzx ecx, byte [esp + 0x11]
push edx
movzx edx, byte [esp + 0x14]
push eax
push ecx
push edx
lea eax, [esp + 0x2c]
push 0x575624
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [0x589a70], eax
mov ecx, 1
call fcn.004de2d0
mov esi, eax
test esi, esi
jne 0x496b1c
mov eax, dword [0x589a60]
test eax, eax
jne 0x496a97
call fcn.004dbf30
mov esi, eax
test esi, esi
jne 0x496b26
mov eax, dword [0x589a6c]
mov ecx, dword [0x589a60]
test ecx, ecx
je 0x496ab7
xor ecx, ecx
call fcn.004de2d0
test eax, eax
jne 0x496ab2
xor ecx, ecx
call fcn.00496860
pop esi
pop ebp
add esp, 0x17c
ret
mov eax, dword [0x589a6c]
cmp eax, 0xffffffff
je 0x496adc
push 1
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov edx, dword [0x589a6c]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [0x589a6c], 0xffffffff
mov eax, dword [0x589a68]
cmp eax, 0xffffffff
mov dword [0x597dc8], 0
mov dword [0x589a70], 0xffffffff
je 0x496bbd
mov ecx, dword [0x5a1b00]
push 8
push 0x802a
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
pop ebp
add esp, 0x17c
ret
mov dword [esi + 0x838], 2
mov eax, dword [0x589a5c]
test eax, eax
je 0x496b8f
mov edx, dword [0x594094]
mov ecx, dword [esi]
call fcn.004fb620
mov al, byte [esp + 0x1c]
test al, al
je 0x496b73
lea edx, [esp + 0x1c]
push edx
xor edx, edx
mov ecx, 0xc1d
call fcn.0041c9e0
push eax
lea eax, [esp + 0x88]
push eax
call ebp
mov ecx, dword [0x5940a4]
add esp, 0xc
push ecx
lea edx, [esp + 0x84]
jmp 0x496b88
mov edx, dword [0x5940a4]
push edx
xor edx, edx
mov ecx, 0xc1e
call fcn.0041c9e0
mov edx, eax
mov ecx, dword [esi]
call fcn.004fb730
mov eax, dword [0x5a1b00]
mov ecx, dword [0x589a6c]
push 0x21
push 0x802b
push eax
push ecx
mov dword [0x597dc8], 0x1e
mov dword [0x597dcc], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
pop ebp
add esp, 0x17c
ret
Function at 0x496bd0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x550
push ebx
mov eax, ecx
shr eax, 0x10
test eax, eax
push ebp
push esi
jne 0x496c1a
cmp ecx, 0x20
je 0x496c1a
mov eax, dword [0x589a6c]
cmp eax, 0xffffffff
je 0x496c1a
push 0
push 0x103
lea ecx, [esp + 0x78]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x496c47
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x496e42
mov eax, dword [0x589a60]
test eax, eax
je 0x496dec
xor ecx, ecx
call fcn.004de2d0
test eax, eax
jne 0x496dec
xor ecx, ecx
call fcn.00496860
pop esi
pop ebp
pop ebx
add esp, 0x550
ret
cmp eax, 1
jle 0x496c1a
cmp eax, 0x19
jg 0x496c1a
lea edx, [esp + 0x70]
push 0x2c
push edx
mov byte [esp + eax + 0x78], 0
call fcn.00563730
mov esi, eax
add esp, 8
test esi, esi
je 0x496c1a
mov byte [esi], 0
mov al, byte [esi + 1]
inc esi
test al, al
je 0x496c1a
lea eax, [esp + 0x70]
push eax
call fcn.00563a6c
push esi
mov ebp, eax
call fcn.00563a6c
add esp, 8
mov ecx, 2
mov ebx, eax
call fcn.004de2d0
mov esi, eax
test esi, esi
jne 0x496cb7
mov eax, dword [0x589a60]
test eax, eax
jne 0x496c27
call fcn.004dbf30
mov esi, eax
test esi, esi
je 0x496c1a
jmp 0x496cc1
mov dword [esi + 0x838], 0
push 0x597d30
mov edx, 0x64
lea ecx, [esp + 0x10]
call fcn.0041e120
mov eax, dword [0x597d2c]
test eax, eax
je 0x496d0f
mov edx, 0x64
lea ecx, [esp + 0xc]
call fcn.0041e210
push 0
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.004e8c60
test eax, eax
jne 0x496d0f
push 0x597d30
mov edx, 0x64
lea ecx, [esp + 0x10]
call fcn.0041e120
mov eax, dword [0x589a5c]
test eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x496d66
lea ecx, [esp + 0x10]
push ecx
push 0x597d94
push ebx
push ebp
xor edx, edx
mov ecx, 0xc1f
call fcn.0041c9e0
push eax
lea edx, [esp + 0x18c]
push edx
call edi
mov eax, dword [0x5940a4]
mov ecx, dword [esi]
add esp, 0x18
push eax
lea edx, [esp + 0x17c]
call fcn.004fb730
mov edx, dword [0x594094]
mov ecx, dword [esi]
call fcn.004fb620
mov ecx, dword [0x5a1b00]
mov edx, dword [0x589a6c]
push 0x22
push 0x802c
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp + 0x10]
push eax
push 0x597d94
push ebx
push ebp
lea ecx, [esp + 0x84]
push str._d___d_:_USERID_:__s_:__s_r_n
push ecx
call edi
add esp, 0x18
lea eax, [esp + 0x74]
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x496da7
sub eax, edx
push 0
mov esi, eax
mov eax, dword [0x589a6c]
push esi
lea edx, [esp + 0x78]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
jne 0x496c1a
pop esi
pop ebp
mov dword [0x597dc8], 3
mov dword [0x597dcc], 1
pop ebx
add esp, 0x550
ret
mov eax, dword [0x589a6c]
or esi, 0xffffffff
cmp eax, esi
je 0x496e14
push 1
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov ecx, dword [0x589a6c]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [0x589a6c], esi
mov eax, dword [0x589a68]
cmp eax, esi
mov dword [0x597dc8], 0
mov dword [0x589a70], esi
je 0x496e42
mov edx, dword [0x5a1b00]
push 8
push 0x802a
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
pop ebp
pop ebx
add esp, 0x550
ret