joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49469d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0x5035ed
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4946fa
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._1963_:_Unable_to_open_file__s.
mov dword [esp + 8], str.is_usc2
mov dword [esp + 4], 0xc04
mov dword [esp], str.shared_file_op.c
call dbg._mdebug1
mov dword [ebp - 0xc], 1
jmp 0x49476f
mov word [ebp - 0x16], 0
mov dword [ebp - 0x14], 0
nop
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
lea eax, [ebp - 0x16]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49476e
movzx eax, byte [ebp - 0x16]
cmp al, 0xff
jne 0x49474c
movzx eax, byte [ebp - 0x15]
cmp al, 0xfe
jne 0x49474c
mov dword [ebp - 0xc], 1
jmp 0x49476f
movzx eax, byte [ebp - 0x16]
cmp al, 0xfe
jne 0x494765
movzx eax, byte [ebp - 0x15]
cmp al, 0xff
jne 0x494765
mov dword [ebp - 0xc], 2
jmp 0x49476f
mov dword [ebp - 0xc], 0
jmp 0x49476f
nop
cmp dword [ebp - 0x10], 0
je 0x494780
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x49487a
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x988
mov dword [ebp - 0x10], 0
fldz
fstp dword [ebp - 0xc]
fldz
fstp dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.
lea eax, [ebp - 0x954]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
lea eax, [ebp - 0x954]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x494909
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._1117_:_Error_handling_file__s.
mov dword [esp + 8], str.DirSize
mov dword [esp + 4], 0xc48
mov dword [esp], str.shared_file_op.c
call dbg._merror
fldz
jmp 0x494a19
mov dword [esp + 4], 0x5048a7
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x4949e4
mov dword [esp + 4], 0x5048a9
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x4949e4
lea eax, [ebp - 0x154]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x504c2b
lea eax, [ebp - 0x954]
mov dword [esp], eax
call sym._sprintf_5
mov eax, dword [ebp - 0x154]
and eax, 0x10
test eax, eax
je 0x49499a
lea eax, [ebp - 0x954]
mov dword [esp], eax
call dbg.DirSize
fld dword [ebp - 0xc]
faddp st(1)
fstp dword [ebp - 0xc]
jmp 0x4949e4
lea eax, [ebp - 0x954]
mov dword [esp], eax
call dbg.FileSizeWin
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], 0
fild qword [ebp - 0x960]
fstp dword [ebp - 0x14]
fld dword [ebp - 0x14]
fld1
fchs
fucompi st(1)
fstp st(0)
jp 0x4949db
fld dword [ebp - 0x14]
fld1
fchs
fucompi st(1)
fstp st(0)
je 0x4949e4
fld dword [ebp - 0xc]
fadd dword [ebp - 0x14]
fstp dword [ebp - 0xc]
lea eax, [ebp - 0x154]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
jne 0x494909
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
call eax
sub esp, 4
fld dword [ebp - 0xc]
leave
ret
Function at 0x495121
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0x5035ea
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x495188
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
lea eax, [ebp - 0x12]
mov dword [esp], eax
call sym._fread
cmp eax, 2
jne 0x495188
movzx eax, byte [ebp - 0x12]
cmp al, 0x1f
jne 0x495188
movzx eax, byte [ebp - 0x11]
cmp al, 0x8b
jne 0x495188
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0x10], 0
je 0x495199
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x49519e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0x5035ea
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x49520d
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 1
lea eax, [ebp - 0x13]
mov dword [esp], eax
call sym._fread
cmp eax, 3
jne 0x49520d
movzx eax, byte [ebp - 0x13]
cmp al, 0x42
jne 0x49520d
movzx eax, byte [ebp - 0x12]
cmp al, 0x5a
jne 0x49520d
movzx eax, byte [ebp - 0x11]
cmp al, 0x68
jne 0x49520d
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0x10], 0
je 0x49521e
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x496c0c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._cJSON_PrintUnformatted_4
sub esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x496c6d
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Internal_error_dumping_JSON_into_file__s
mov dword [esp + 8], str.json_fwrite
mov dword [esp + 4], 0x2e
mov dword [esp], str.shared_json_op.c
call dbg._mdebug1
mov eax, 0xffffffff
jmp 0x496d83
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x18], eax
mov dword [esp + 4], 0x5051f3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x496ce8
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x5051f8
mov dword [esp + 8], str.json_fwrite
mov dword [esp + 4], 0x35
mov dword [esp], str.shared_json_op.c
call dbg._mdebug1
jmp 0x496d64
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fwrite
cmp dword [ebp - 0x18], eax
je 0x496d5d
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Couldnt_write_JSON_into__s:__s___d_
mov dword [esp + 8], str.json_fwrite
mov dword [esp + 4], 0x3a
mov dword [esp], str.shared_json_op.c
call dbg._mdebug1
jmp 0x496d64
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0x10], 0
je 0x496d80
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x49a3f7
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
call eax
sub esp, 0xc
test eax, eax
jne 0x49a432
mov eax, 0
jmp 0x49a50d
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x34]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call eax
sub esp, 0x18
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
je 0x49a493
mov eax, 0
jmp 0x49a50d
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp dword [ebp + 0xc], 0
je 0x49a4b7
mov eax, dword [ebp - 0x1c]
or eax, 2
mov dword [ebp - 0x1c], eax
jmp 0x49a4c0
mov eax, dword [ebp - 0x1c]
and eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call eax
sub esp, 0x18
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
je 0x49a508
mov eax, 0
jmp 0x49a50d
mov eax, 1
leave
ret
Function at 0x4a0d76
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x2e], 0x927225c
mov dword [ebp - 0x2a], 0x3c3e603b
mov dword [ebp - 0x26], 0x5b2a237c
mov dword [ebp - 0x22], 0x267d7b5d
mov dword [ebp - 0x1e], 0x283a2124
mov word [ebp - 0x1a], 0x29
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x4a0dc3
mov eax, 0
jmp 0x4a0f16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
jmp 0x4a0e2d
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp + 4], eax
lea eax, [ebp - 0x2e]
mov dword [esp], eax
call sym._strchr
test eax, eax
je 0x4a0e25
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x4a0e21
mov eax, dword [ebp - 0x14]
add eax, 1
movzx eax, byte [eax]
test al, al
je 0x4a0e21
mov eax, dword [ebp - 0x14]
add eax, 1
movzx eax, byte [eax]
movsx eax, al
mov dword [esp + 4], eax
lea eax, [ebp - 0x2e]
mov dword [esp], eax
call sym._strchr
test eax, eax
je 0x4a0e21
add dword [ebp - 0x14], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
jne 0x4a0dcb
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._calloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a0e60
mov eax, 0
jmp 0x4a0f16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
jmp 0x4a0f05
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp + 4], eax
lea eax, [ebp - 0x2e]
mov dword [esp], eax
call sym._strchr
test eax, eax
je 0x4a0eed
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x4a0ede
mov eax, dword [ebp - 0x14]
add eax, 1
movzx eax, byte [eax]
test al, al
je 0x4a0ede
mov eax, dword [ebp - 0x14]
add eax, 1
movzx eax, byte [eax]
movsx eax, al
mov dword [esp + 4], eax
lea eax, [ebp - 0x2e]
mov dword [esp], eax
call sym._strchr
test eax, eax
je 0x4a0ede
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
mov byte [edx], al
add dword [ebp - 0x10], 1
add dword [ebp - 0x14], 1
jmp 0x4a0eed
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, edx
mov byte [eax], 0x5c
add dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
mov byte [edx], al
add dword [ebp - 0x10], 1
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
jne 0x4a0e72
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x4a1609
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], al
mov byte [ebp - 1], 0
jmp 0x4a1655
movzx eax, byte [ebp - 1]
xor eax, 1
test al, al
je 0x4a164d
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp byte [ebp - 0x14], al
jne 0x4a163c
mov eax, dword [ebp + 8]
jmp 0x4a1664
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp byte [ebp - 0x18], al
jne 0x4a1651
mov byte [ebp - 1], 1
jmp 0x4a1651
mov byte [ebp - 1], 0
add dword [ebp + 8], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x4a1621
mov eax, 0
leave
ret

Function at 0x4a4d2f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4a4d8b
mov dword [ebp - 0xc], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.The_attributes_for__s_could_not_be_obtained._Error__ld.
mov dword [esp + 8], str.w_get_file_attrs
mov dword [esp + 4], 0x401
mov dword [esp], str.shared_syscheck_op.c
call dbg._mdebug2
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4a532b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a53d3
mov dword [esp + 0xc], str.Couldnt_get_modification_time_for_registry_key.
mov dword [esp + 8], str.get_registry_mtime
mov dword [esp + 4], 0x48e
mov dword [esp], str.shared_syscheck_op.c
call dbg._mwarn
mov eax, 0
jmp 0x4a53e5
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
call dbg.get_windows_file_time_epoch
leave
ret
Function at 0x4ad96a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
test eax, eax
jg 0x4ad9ab
mov eax, 0xfffffffa
jmp 0x4ad9b0
mov eax, 0
leave
ret

Function at 0x4ad9b2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
cmp dword [ebp + 0xc], eax
jle 0x4ad9ea
mov eax, 0xfffffffa
jmp 0x4ad9ef
mov eax, 0
leave
ret

Function at 0x4ad9f1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
jmp 0x4ada60
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0x77
jne 0x4ada14
cmp dword [ebp - 0xc], 4
jbe 0x4ada1b
mov eax, 0xfffffffa
jmp 0x4ada93
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Remote_socket_busy__waiting__d_s.
mov dword [esp + 8], str.OS_SendUDPbySize
mov dword [esp + 4], 0x17b
mov dword [esp], str.os_net_os_net.c
call dbg._minfo
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x3e8
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
test eax, eax
js 0x4ada00
mov eax, 0
leave
ret

Function at 0x4adb85
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4adbae
mov eax, 0
jmp 0x4adbf0
mov eax, dword [ebp + 0xc]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
test eax, eax
jg 0x4adbed
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x4adbf0
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4adbf2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4adc35
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4adc3a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4adc63
mov eax, 0
jmp 0x4adcaa
mov eax, dword [ebp + 0xc]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jns 0x4adca7
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x4adcaa
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4adcac
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x4adcf3
mov eax, 0
jmp 0x4add01
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4add03
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x4adef4
mov eax, 0
jmp 0x4adf05
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_getaddrinfo]
call eax
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4add7d
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
jmp 0x4adef4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4aded5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
cmp eax, 2
jne 0x4ade21
mov dword [esp + 4], 1
mov dword [esp], 0x42
call sym._calloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4addfc
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x508cb0
mov dword [esp + 8], str.OS_GetHost
mov dword [esp + 4], 0x222
mov dword [esp], str.os_net_os_net.c
call dbg._merror_exit
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
mov dword [esp + 8], 0x41
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.get_ipv4_string
jmp 0x4adedf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
cmp eax, 0x17
jne 0x4adecc
mov dword [esp + 4], 1
mov dword [esp], 0x42
call sym._calloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ade95
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x508cb0
mov dword [esp + 8], str.OS_GetHost
mov dword [esp + 4], 0x226
mov dword [esp], str.os_net_os_net.c
call dbg._merror_exit
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x14], 0x41
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 8]
mov dword [esp], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 4], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x14]
mov dword [esp + 0xc], eax
call dbg.get_ipv6_string
jmp 0x4adedf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4add88
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_freeaddrinfo]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x4adf05
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0xc], eax
jae 0x4add33
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4adf22
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 4
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 8
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_setsockopt]
call eax
sub esp, 0x14
leave
ret

Function at 0x4adfe7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0xc]
imul ebx, eax, 0x3e8
mov ecx, dword [ebp + 0x10]
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea eax, [ebx + edx]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 4
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1006
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_setsockopt]
call eax
sub esp, 0x14
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4ae047
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x3e8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 4
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1005
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_setsockopt]
call eax
sub esp, 0x14
leave
ret