joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c8b0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45ca4d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402ab4
cmp word [ebx + 0xa2], 0
je 0x45c8f9
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x45c90d
lea esi, [ebp - 8]
jmp 0x45c90f
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x45c91c
xor edi, edi
jmp 0x45c929
mov eax, dword [ebx + 0x80]
call fcn.00404af8
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404af8
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0045c018
mov eax, dword [ebp - 0x14]
call fcn.00404af8
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404af8
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404af8
push eax
mov eax, ebx
call fcn.0045c14c
push eax
mov eax, ebx
call fcn.0045c120
push eax
mov eax, ebx
call fcn.0045c0d4
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0045bee4
mov eax, dword [ebp - 0x18]
call fcn.00404af8
push eax
mov eax, dword [ebx + 8]
call fcn.00404af8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x45c9b2
call fcn.0040dc70
xor edx, edx
push ebp
push 0x45ca2b
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x45c9f0
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x45c9e6
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ca14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ca32
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x45ca5c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x45ca88
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404af8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45caad
call fcn.0040dc70
xor eax, eax
push ebp
push 0x45cae4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x45cacd
call fcn.0040dc70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45caeb
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x45d7dc
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d87b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x45d811
call fcn.0040407c
jmp 0x45d882
push 0xf01ff
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45d85d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x45d846
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ControlService
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d864
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45d888
Capabilities:
Continue service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45d974
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x45d8c4
call fcn.0040407c
jmp 0x45d97b
push 0xf01ff
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45d956
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x45d93f
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [ebp - 0x28]
dec eax
je 0x45d921
sub eax, 3
je 0x45d93b
sub eax, 3
jne 0x45d93f
lea eax, [ebp - 0x2c]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x45d93f
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x45d93f
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d95d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45e054
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x45e08c]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x45e06a
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x45e079
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x45e088
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x45e734
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4b2420]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x45e761
mov edx, dword [0x4b2420]
xor edx, edx
call fcn.00452960
push 0
mov eax, dword [0x4b2420]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x45e9bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45ea2b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.004095a4
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x45ea40
call fcn.00404944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ea32
lea eax, [ebp - 0x108]
call fcn.00404638
ret

Function at 0x45ffec
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x460075
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b3c50
push 0x202
call sub.ws2_32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x46005f
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040bd1c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x46008c
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4b2524]
mov dl, 1
mov eax, dword [0x45fbcc]
call fcn.0040c61c
call fcn.00403fd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46007c
lea eax, [ebp - 0x1c]
call fcn.00404638
ret
Function at 0x460280
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
lea edi, [ebp - 0x14]
xor eax, eax
push ebp
push 0x460429
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x34], 0
jne 0x4602c3
mov ecx, 0x460440
mov dl, 1
mov eax, dword [0x45fbcc]
call fcn.0040c524
call fcn.00403fd0
push 1
push 0
push 0
push 0
push 2
push 2
call sub.ws2_32.dll_WSASocketA
mov esi, eax
mov dword [ebx + 0x30], esi
cmp esi, 0xffffffff
jne 0x460304
call sub.ws2_32.dll_WSAGetLastError
lea ecx, [ebp - 0x18]
mov edx, 0x46045c
call fcn.0045ff48
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x45fbcc]
call fcn.0040c524
call fcn.00403fd0
mov word [edi], 2
push 0
call sub.ws2_32.dll_htonl
mov dword [edi + 4], eax
mov ax, word [ebx + 0x34]
push eax
call sub.ws2_32.dll_htons
mov word [edi + 2], ax
push 0x10
push edi
mov eax, dword [ebx + 0x30]
push eax
call sub.ws2_32.dll_bind
inc eax
jne 0x46037e
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2740
je 0x460347
cmp esi, 0x2726
jne 0x460352
cmp byte [ebx + 0x70], 0
je 0x460352
inc dword [ebx + 0x34]
jmp 0x460304
mov eax, ebx
call fcn.00460238
lea ecx, [ebp - 0x1c]
mov edx, 0x460470
mov eax, esi
call fcn.0045ff48
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x45fbcc]
call fcn.0040c524
call fcn.00403fd0
jmp 0x460304
mov dword [ebp - 4], 0x2000
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebx + 0x30]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
je 0x4603bd
push 4
lea eax, [ebp - 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 0x30]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
jne 0x4603ee
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
mov eax, ebx
call fcn.00460238
lea ecx, [ebp - 0x20]
mov edx, 0x460480
mov eax, esi
call fcn.0045ff48
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x45fbcc]
call fcn.0040c524
call fcn.00403fd0
mov eax, dword [ebx + 0x58]
cmp byte [eax + 4], 0
je 0x46040e
mov eax, ebx
call fcn.004607f8
test al, al
jne 0x46040e
mov edx, 0x460494
mov eax, ebx
call fcn.004601e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460430
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040465c
ret
Function at 0x4605b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x460685
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
mov eax, dword [ebx + 0x58]
cmp byte [eax + 4], 0
je 0x4605f9
mov eax, dword [ebp - 4]
push eax
push esi
mov ecx, edi
mov edx, dword [ebx + 0x30]
mov eax, ebx
call fcn.00460e98
jmp 0x460613
lea eax, [ebp - 8]
push eax
push esi
push 0
mov eax, dword [ebx + 0x48]
push eax
push edi
mov eax, dword [ebx + 0x30]
push eax
call sub.ws2_32.dll_recvfrom
mov edx, dword [ebp - 4]
mov dword [edx], eax
lea edi, [ebx + 0x4c]
push dword [esi + 4]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00404830
mov ax, word [esi + 2]
push eax
call sub.ws2_32.dll_ntohs
movzx eax, ax
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffff
jne 0x46066f
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2746
je 0x46066f
cmp esi, 0x2733
je 0x46066f
lea ecx, [ebp - 0xc]
mov edx, 0x4606a0
mov eax, esi
call fcn.0045ff48
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004601e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46068c
lea eax, [ebp - 0xc]
call fcn.00404638
ret

Function at 0x4606ac
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x460792
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x46077c
test di, di
je 0x46077c
test eax, eax
je 0x46077c
cmp dword [ebp + 8], 0
jl 0x46077c
mov word [ebp - 0x14], 2
push edi
call sub.ws2_32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x58]
cmp byte [eax + 4], 0
je 0x460733
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x30]
mov eax, esi
call fcn.00460d58
inc eax
setne bl
jmp 0x460750
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x30]
push eax
call sub.ws2_32.dll_sendto
inc eax
setne bl
test bl, bl
jne 0x46077c
call sub.ws2_32.dll_WSAGetLastError
mov edi, eax
cmp edi, 0x2733
je 0x46077c
lea ecx, [ebp - 0x18]
mov edx, 0x4607ac
mov eax, edi
call fcn.0045ff48
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.004601e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460799
lea eax, [ebp - 0x18]
call fcn.00404638
ret
Function at 0x4607f8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46094f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x5c], 0xffffffff
jne 0x460829
push 0
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [esi + 0x5c], eax
mov word [ebp - 0x10], 2
mov eax, dword [esi + 0x58]
mov ax, word [eax + 0x14]
push eax
call sub.ws2_32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 8]
call fcn.00404af8
push eax
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x5c]
push eax
call sub.ws2_32.dll_connect
inc eax
jne 0x46088e
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, 0x460968
mov dl, 1
mov eax, dword [0x4078a0]
call fcn.0040c560
call fcn.00403fd0
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0xc]
call fcn.00408768
cmp dword [ebp - 0x1c], 0
je 0x4608b0
mov cl, 1
mov edx, dword [esi + 0x5c]
mov eax, esi
call fcn.004609e0
jmp 0x4608bc
xor ecx, ecx
mov edx, dword [esi + 0x5c]
mov eax, esi
call fcn.004609e0
test al, al
jne 0x4608f1
mov eax, dword [esi + 0x5c]
push eax
call sub.ws2_32.dll_closesocket
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, 0x460994
mov dl, 1
mov eax, dword [0x4078a0]
call fcn.0040c560
call fcn.00403fd0
lea ecx, [esi + 0x60]
mov edx, dword [esi + 0x5c]
mov eax, esi
call fcn.00460c40
test al, al
jne 0x460933
mov eax, dword [esi + 0x5c]
push eax
call sub.ws2_32.dll_closesocket
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, 0x4609c0
mov dl, 1
mov eax, dword [0x4078a0]
call fcn.0040c560
call fcn.00403fd0
mov bl, 1
mov byte [esi + 0x71], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460956
lea eax, [ebp - 0x1c]
call fcn.00404638
ret
Function at 0x4609e0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x460c2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
sub cl, 1
jb 0x460a16
je 0x460a8e
jmp 0x460c13
mov byte [ebp - 0x110], 5
mov byte [ebp - 0x10f], 1
mov byte [ebp - 0x10e], 0
push 0
push 3
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_send
inc eax
je 0x460c13
lea eax, [ebp - 0x110]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004030a4
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_recv
cmp eax, 2
jl 0x460c13
cmp byte [ebp - 0x10f], 0
jne 0x460c13
mov byte [ebp - 5], 1
jmp 0x460c13
mov byte [ebp - 0x110], 5
mov byte [ebp - 0x10f], 2
mov byte [ebp - 0x10e], 0
mov byte [ebp - 0x10d], 2
push 0
push 4
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_send
inc eax
je 0x460c13
lea eax, [ebp - 0x110]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004030a4
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_recv
cmp eax, 2
jl 0x460c13
cmp byte [ebp - 0x10f], 2
jne 0x460c13
lea eax, [ebp - 0xc]
mov esi, dword [ebx + 0x58]
mov edx, dword [esi + 0xc]
call fcn.004046d0
lea eax, [ebp - 0x10]
mov edx, dword [esi + 0x10]
call fcn.004046d0
lea eax, [ebp - 0x110]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004030a4
mov byte [ebp - 0x110], 1
mov eax, dword [ebp - 0xc]
call fcn.004048f8
mov ebx, eax
mov byte [ebp - 0x10f], bl
mov esi, ebx
and esi, 0xff
dec esi
test esi, esi
jl 0x460b6a
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov al, byte [eax + ebx]
lea edx, [ebx + 2]
mov byte [ebp + edx - 0x110], al
inc ebx
dec esi
jne 0x460b56
mov eax, dword [ebp - 0x10]
call fcn.004048f8
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.004048f8
add eax, 2
mov byte [ebp + eax - 0x110], bl
mov eax, dword [ebp - 0xc]
call fcn.004048f8
add eax, 2
movzx esi, byte [ebp + eax - 0x110]
dec esi
test esi, esi
jl 0x460bbf
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004048f8
add eax, 3
add eax, ebx
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ebx]
mov byte [ebp + eax - 0x110], dl
inc ebx
dec esi
jne 0x460ba1
push 0
mov eax, dword [ebp - 0xc]
call fcn.004048f8
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.004048f8
add ebx, eax
add ebx, 3
push ebx
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_send
inc eax
je 0x460c13
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_recv
inc eax
je 0x460c13
cmp byte [ebp - 0x10f], 0
jne 0x460c13
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460c35
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040465c
ret
Function at 0x460c40
Capabilities:
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee4
mov edi, ecx
mov esi, edx
xor ebx, ebx
mov dword [esp], 0x10
push esp
lea edx, [esp + 0xe]
push edx
mov eax, dword [eax + 0x30]
push eax
call sub.ws2_32.dll_getsockname
mov byte [esp + 0x1a], 5
mov byte [esp + 0x1b], 3
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 1
lea edx, [esp + 0xe]
lea eax, [esp + 0x1e]
mov ecx, 4
call fcn.00407294
lea edx, [esp + 0xc]
lea eax, [esp + 0x22]
mov ecx, 2
call fcn.00407294
push 0
push 0xa
lea eax, [esp + 0x22]
push eax
push esi
call sub.ws2_32.dll_send
lea eax, [esp + 0x1a]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004030a4
push 0
push pe_nt_image_headers32
lea eax, [esp + 0x22]
push eax
push esi
call sub.ws2_32.dll_recv
cmp byte [esp + 0x1a], 5
je 0x460cdc
cmp byte [esp + 0x1b], 0
jne 0x460d17
lea edx, [esp + 0x1e]
lea eax, [esp + 4]
mov ecx, 4
call fcn.00407294
lea edx, [esp + 0x22]
lea eax, [esp + 8]
mov ecx, 2
call fcn.00407294
mov word [edi], 2
mov ax, word [esp + 8]
mov word [edi + 2], ax
mov eax, dword [esp + 4]
mov dword [edi + 4], eax
mov bl, 1
mov eax, ebx
add esp, 0x11c
pop edi
pop esi
pop ebx
ret

Function at 0x460d58
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff044
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
or esi, 0xffffffff
cmp byte [ebx + 0x71], 0
jne 0x460d8e
mov eax, ebx
call fcn.004607f8
test al, al
je 0x460e6d
mov word [ebp - 0x1fb4], 2
mov ax, word [ebp + 8]
push eax
call sub.ws2_32.dll_htons
mov word [ebp - 0x1fb2], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1fb0], eax
lea eax, [ebp - 0x1fa4]
mov edx, 0x1f9c
call fcn.0040729c
mov byte [ebp - 0x1fa4], 0
mov byte [ebp - 0x1fa3], 0
mov byte [ebp - 0x1fa2], 0
mov byte [ebp - 0x1fa1], 1
lea edx, [ebp - 0x1fb0]
lea eax, [ebp - 0x1fa0]
mov ecx, 4
call fcn.00407294
lea edx, [ebp - 0x1fb2]
lea eax, [ebp - 0x1f9c]
mov ecx, 2
call fcn.00407294
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1f9a]
mov ecx, edi
call fcn.00407294
push 0x10
lea eax, [ebx + 0x60]
push eax
push 0
add edi, 0xa
push edi
lea eax, [ebp - 0x1fa4]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_sendto
mov esi, eax
cmp esi, 0xffffffff
jne 0x460e6d
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x1fbc], eax
mov byte [ebp - 0x1fb8], 0
lea eax, [ebp - 0x1fbc]
push eax
push 0
mov ecx, 0x460e80
mov dl, 1
mov eax, dword [0x4078a0]
call fcn.0040c560
call fcn.00403fd0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x460e98
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff050
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp byte [ebx + 0x71], 0
jne 0x460ece
mov eax, ebx
call fcn.004607f8
test al, al
je 0x460fe5
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x1fa8]
mov edx, 0x1f9c
call fcn.0040729c
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebx + 0x48]
push eax
lea eax, [ebp - 0x1fa8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_recvfrom
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x460f38
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x1fb0], eax
mov byte [ebp - 0x1fac], 0
lea eax, [ebp - 0x1fb0]
push eax
push 0
mov ecx, 0x460ff8
mov dl, 1
mov eax, dword [0x4078a0]
call fcn.0040c560
call fcn.00403fd0
cmp byte [ebp - 0x1fa8], 0
je 0x460f55
mov ecx, 0x25d
mov edx, 0x461018
mov eax, 0x46105c
call fcn.00404594
cmp byte [ebp - 0x1fa7], 0
je 0x460f72
mov ecx, 0x25e
mov edx, 0x461018
mov eax, 0x46105c
call fcn.00404594
cmp byte [ebp - 0x1fa6], 0
je 0x460f8f
mov ecx, 0x25f
mov edx, 0x461018
mov eax, 0x46105c
call fcn.00404594
cmp byte [ebp - 0x1fa5], 1
je 0x460fac
mov ecx, 0x260
mov edx, 0x461018
mov eax, 0x46105c
call fcn.00404594
lea edx, [ebp - 0x1fa4]
lea eax, [edi + 4]
mov ecx, 4
call fcn.00407294
lea edx, [ebp - 0x1fa0]
lea eax, [edi + 2]
mov ecx, 2
call fcn.00407294
sub dword [esi], 0xa
mov ecx, dword [esi]
lea edx, [ebp - 0x1f9e]
mov eax, dword [ebp - 8]
call fcn.00407294
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x462ce8
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x462d06
and ecx, ecx
jle 0x462d06
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x462cf1
pop ebx
ret

Function at 0x462d4c
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x462d71
and ecx, ecx
jle 0x462d71
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x462d73]
mov bl, byte [edx]
xor bl, al
shr ax, 8
xor ax, word [edi + ebx*2]
inc edx
dec ecx
jne 0x462d5f
pop edi
pop ebx
ret

Function at 0x462f74
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x462f97
and ecx, ecx
jle 0x462f97
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x462f9d]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x462f87
pop edi
pop ebx
ret