joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d805
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x4d0d32
call fcn.004a55f6
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0043db94
call fcn.0041a236
push eax
lea ecx, [ebp - 0x94]
call fcn.00417b31
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0041a23c
mov ecx, eax
call fcn.00418341
test al, al
je 0x43d91b
push ebx
lea ecx, [ebp - 0x94]
call fcn.00417db1
push edi
push 0x80
push 3
push edi
push 1
push accept
lea ecx, [ebp - 0x94]
call fcn.00417d50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x43d88c
push str.Error_opening_file
jmp 0x43d9fc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x43d995
cmp edi, 0x400000
ja 0x43d9a6
and dword [ebp - 0x2c8], 0
push edi
call fcn.004a4c07
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x43d904
push ebx
call fcn.004a4c10
pop ecx
mov ecx, esi
call fcn.0043db94
push 0
push str.Could_not_read_file
jmp 0x43d9fc
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0043da47
push dword [ebp - 0x2cc]
jmp 0x43da2a
call fcn.0041a23c
push eax
lea ecx, [ebp - 0x94]
call fcn.00417d94
call fcn.0041a542
test al, al
je 0x43d93c
call fcn.0041a242
jmp 0x43d953
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00417d50
push eax
call fcn.00439ff4
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x43d964
push eax
push str.Error_opening_zip_file
jmp 0x43d9fc
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.00439a35
add esp, 0x14
test eax, eax
je 0x43d98b
push 0
push str.Could_not_find_ziped_file
jmp 0x43d9fc
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x43d99e
push 0
push str.File_is_empty
jmp 0x43d9fc
cmp ebx, 0x400000
jbe 0x43d9af
push 0
push 0x4d8148
jmp 0x43d9fc
push ebx
call fcn.004a4c07
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.0043a3b4
add esp, 0x18
test eax, eax
je 0x43da07
cmp eax, 0x600
je 0x43da07
push dword [ebp - 0x2c8]
call fcn.004a4c10
pop ecx
call fcn.0041a542
test al, al
jne 0x43d9f5
push edi
call fcn.0043988f
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0043dbbc
mov bl, al
jmp 0x43da32
call fcn.0041a542
test al, al
jne 0x43da17
push edi
call fcn.0043988f
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0043da47
push edi
mov bl, al
call fcn.004a4c10
pop ecx
lea ecx, [ebp - 0x94]
call fcn.00417c3d
mov al, bl
call fcn.004a55b1
ret 8

Function at 0x44679f
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x638
jmp fcn.0044b33c
Function at 0x452bff
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x452c7f
cmp dword [esi + 0x10], 0
je 0x452c7f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004a5570
mov ebx, esp
test ebx, ebx
je 0x452c7f
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1c8
call fcn.00417cdb
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
push str.textchanged
push ecx
mov ecx, dword [ecx + 0x44]
call fcn.0041dc62
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.0041a54f
test al, al
je 0x452c7f
mov ecx, dword [esi + 0x10]
call fcn.00424d77
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4539ff
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x4d1abe
call fcn.004a55f6
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.0041a236
push eax
lea ecx, [ebp - 0x94]
call fcn.00417b31
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0041a23c
mov ecx, eax
call fcn.00418341
test al, al
je 0x453aed
push ebx
lea ecx, [ebp - 0x94]
call fcn.00417db1
push edi
push 0x80
push 3
push edi
push 1
push accept
lea ecx, [ebp - 0x94]
call fcn.00417d50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x453a90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00417c3d
jmp 0x453bce
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x453a7c
push esi
mov dword [ebp - 0x2c8], edi
call fcn.004a4c07
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x453bb9
push edi
call fcn.004a4c10
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00417c3d
jmp 0x453bcc
call fcn.0041a23c
push eax
lea ecx, [ebp - 0x94]
call fcn.00417d94
call fcn.0041a542
test al, al
je 0x453b0e
call fcn.0041a242
jmp 0x453b25
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00417d50
push eax
call fcn.00439ff4
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x453a7c
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.00439a35
add esp, 0x14
test eax, eax
jne 0x453a7c
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x453a7c
push esi
call fcn.004a4c07
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.0043a3b4
add esp, 0x18
test eax, eax
je 0x453ba9
cmp eax, 0x600
je 0x453ba9
push edi
call fcn.004a4c10
pop ecx
call fcn.0041a542
test al, al
jne 0x453ad9
push ebx
call fcn.0043988f
jmp 0x453ad8
call fcn.0041a542
test al, al
jne 0x453bb9
push ebx
call fcn.0043988f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00417c3d
test edi, edi
jne 0x453c40
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push accept
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x453c3c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x453c3c
push esi
mov dword [ebp - 0x2d0], edi
call fcn.004a4c07
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x453c38
push edi
call fcn.004a4c10
pop ecx
xor edi, edi
test edi, edi
jne 0x453c40
xor eax, eax
jmp 0x453c58
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.00453c60
push edi
mov esi, eax
call fcn.004a4c10
pop ecx
mov eax, esi
call fcn.004a55b1
ret 4
Function at 0x4556e2
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x4d1ca6
call fcn.004a55f6
mov esi, ecx
mov dword [ebp - 0x98], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x10], eax
mov dword [eax + 0x500], ebx
cmp dword [esi + 4], ebx
jne 0x45576b
lea eax, [ebp - 0xa8]
push eax
call fcn.004552a5
push ebx
sub esp, 0x10
lea esi, [ebp - 0xa8]
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x98]
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.0041a21a
push eax
mov ecx, esi
call fcn.0041fcd8
mov ecx, dword [esi + 0x10]
call fcn.0043fb11
mov ecx, dword [esi + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call fcn.00419f1b
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00418341
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00417c3d
mov edi, 0x4f0
test bl, bl
je 0x4557a6
mov eax, dword [esi + 0x10]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x10]
add eax, edi
push 0x10
push eax
lea eax, [esi + 0x1a]
push eax
call fcn.004a8230
mov eax, dword [esi + 0x10]
add esp, 0xc
add eax, edi
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esi + 0x18], 1
call fcn.004a55b1
ret 4

Function at 0x455bdb
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x455c07
xor eax, eax
jmp 0x455c7c
push esi
mov esi, 0xff
lea eax, [ebp - 0x104]
push esi
push 0
push eax
call fcn.004a7a60
add esp, 0xc
lea eax, [ebp - 0x104]
push esi
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
pop esi
test eax, eax
je 0x455c03
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.004a8230
mov ecx, dword [ebp - 0x298]
add esp, 0xc
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x455d79
Capabilities:
Hide graphical window

Disassembly:
push 0xa4
mov eax, 0x4d1d04
call fcn.004a55f6
mov esi, ecx
mov dword [ebp - 0x98], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x10], eax
mov dword [eax + 0x4f8], ebx
cmp dword [esi + 4], ebx
jne 0x455e2d
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 8
push eax
mov dword [ebp - 0x9c], 0x800
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x455e0a
lea eax, [ebp - 0xb0]
mov ecx, esi
push eax
call fcn.00455970
push ebx
sub esp, 0x10
lea esi, [ebp - 0xb0]
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
push 0x40030000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x98]
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.0041a21a
push eax
mov ecx, esi
call fcn.0041fcd8
mov ecx, dword [esi + 0x10]
call fcn.0043fb11
mov ecx, dword [esi + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call fcn.00419f1b
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00418341
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00417c3d
test bl, bl
je 0x455e65
call fcn.00455bdb
mov ecx, dword [esi + 0x10]
mov dword [ecx + 0x4f0], eax
mov eax, dword [esi + 0x10]
push dword [eax + 0x4f0]
push 0
push 0x465
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esi + 0x18], 1
call fcn.004a55b1
ret 4

Function at 0x459cf2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b33c

Function at 0x459cfb
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x638
jmp method.DuiLib::CMenuUI.virtual_312
Function at 0x45aab2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
and dword [ebx + 0x468], 0
mov edi, dword [ebp + 0x1c]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], esi
mov dword [ebx + 0x464], ecx
mov dword [ebx + 0x46c], eax
test ecx, ecx
jne 0x45ab1d
call fcn.0045a875
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test edi, edi
je 0x45ab1d
call fcn.0045a875
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0045a875
mov esi, ebx
lea edx, [ebx + 0x10]
neg esi
mov ecx, eax
mov edi, dword [eax]
sbb esi, esi
and esi, edx
push esi
call dword [edi]
mov ecx, dword [ebx + 0x464]
test ecx, ecx
jne 0x45ab43
mov ecx, dword [ebp - 0x18]
jmp 0x45ab4a
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0041a21a
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.00417b0d
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
push 0x88
movsd dword es:[edi], dword [esi]
push accept
push 0
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041fcd8
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x45ab8d
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x45ab88
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4606da
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
cmp esi, 0x21
jb 0x460728
cmp esi, 0x28
jbe 0x460722
lea eax, [esi - 0x2d]
cmp eax, 1
ja 0x460728
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a7a60
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x104
cmove ecx, edi
push eax
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00417b56
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x460a1b
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x4d2917
call fcn.004a55f6
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x460b22
lea eax, [ebp - 0xa4]
push eax
call fcn.004601ba
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0xa4]
xor eax, eax
push eax
sub esp, 0x10
mov ecx, dword [ecx + 0x44]
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a21a
push eax
mov ecx, ebx
call fcn.0041fcd8
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x460b22
mov ecx, dword [ebx + 0x10]
call fcn.0043fb11
mov ecx, dword [ebx + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call fcn.00419f1b
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
movzx eax, word [ecx + 0x70e]
push eax
movzx eax, word [ecx + 0x70c]
mov ecx, ebx
push eax
call fcn.00460f53
lea eax, [ebp - 0x94]
mov ecx, ebx
push eax
call fcn.0046052c
mov ecx, dword [ebx + 0x10]
and dword [ebp - 4], 0
add ecx, 0x1c8
push eax
call fcn.00417cbc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00417c3d
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x100]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x18], 1
call fcn.004a55b1
ret 4

Function at 0x461fb0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x462000
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x461ffa
shr eax, 8
cmp al, 2
jne 0x461ffa
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x464c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00464cc0
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.004bde17

Function at 0x46a1c0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x46a209
mov al, byte [esi]
push eax
call fcn.004761f0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x46a1e7
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x46b450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46b46e
cmp dword [esi + 0x6c], 0
je 0x46b46e
push 2
push 3
push esi
call fcn.004767b0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00476c10
add esp, 4
test esi, esi
je 0x46b48e
cmp dword [esi + 0x6c], 0
je 0x46b48e
push 3
push esi
call fcn.004767f0
add esp, 8
pop esi
pop ebp
ret
Function at 0x473d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1d0], 0
je 0x473da4
push esi
push 1
push edi
call fcn.00466720
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00466720
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x473dda
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x4e11f0
push 2
push eax
call fcn.004b1592
push dword [edi + 0x158]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004b1592
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x474190
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x1a8]
call fcn.004746a0
add esp, 8
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x474214
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4741ec
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0x51
xor eax, eax
pop ebp
ret
push esi
push edi
call fcn.004929a0
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.00473de0
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x48d4], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4746a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
shl eax, 4
push edi
mov edx, dword [ebx + ecx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x2b0]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x47475d
cmp dword [ebx + ecx*4 + 0x1bc], 0x4740e0
jne 0x47475d
cmp dword [esi], 0
je 0x4746ef
test edi, edi
je 0x47475d
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.00473910
add esp, 0x14
cmp eax, 0xffffffff
je 0x47475d
test al, 1
je 0x47475d
cmp dword [esi], 0
jne 0x474744
mov eax, dword [ebx]
mov eax, dword [eax + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x505330]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x474744
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x47475d
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x474840
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x1ec], 0
je 0x474853
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x1a8]
cmp eax, 0xffffffff
je 0x47484f
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
pop ebp
ret

Function at 0x474fe0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x507b90]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x475031
push 3
push 2
push eax
push 6
call fcn.004933a0
add esp, 0x10
test al, al
je 0x475025
mov dword [0x507b90], 2
mov esp, ebp
pop ebp
ret
mov dword [0x507b90], 1
jmp 0x475036
cmp eax, 2
je 0x475076
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x47505d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x475076
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret

Function at 0x475150
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x475198
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004929a0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00473ec0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00473ec0
add esp, 8
pop edi
pop esi
pop ebp
ret