joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1272
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov al, byte [ebp + 8]
cmp eax, 6
ja case.0x4f1284.0
jmp dword [eax*4 + 0x4f128b]
push 0
push 0x536cf0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4f1308
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4f12e3
cmp ebx, dword [0x537420]
je 0x4f12e3
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4f12b9
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4f12b9
cmp ebx, dword [0x537420]
jne 0x4f1308
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4f1308
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4f1308
call fcn.004f1362
test eax, eax
jne case.0x4f1284.0
cmp dword [0x5321ec], 0
je 0x4f1327
push 0
push 0
push 0x443
push dword [0x537420]
call sub.USER32.dll_PostMessageA
jmp case.0x4f1284.0
cmp dword [0x536ca8], 0
je 0x4f1344
push 0
push 2
push 0x447
push dword [0x537420]
call sub.USER32.dll_PostMessageA
push 5
push dword [0x537420]
call sub.USER32.dll_ShowWindow
call fcn.004f1171
jmp case.0x4f1284.0
call fcn.004f0e38
pop ebx
pop ebp
ret 4

Function at 0x4f1362
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4f1379
mov word [0x56368c], 1
jmp 0x4f1382
mov word [0x56368c], 0
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4f13b2
mov eax, dword [0x5321e0]
test eax, eax
je 0x4f139e
mov dword [0x5321ec], eax
jmp 0x4f13b2
push 1
push 0
push 0x443
push dword [0x537420]
call sub.USER32.dll_PostMessageA
cmp dword [0x536cb0], 0
jne 0x4f13de
cmp dword [0x536cac], 0
je 0x4f13d1
cmp word [0x56368c], 0
je 0x4f13de
xor eax, eax
ret
cmp word [0x56368c], 0
jne 0x4f13de
xor eax, eax
ret
push 1
call fcn.004f181f
test eax, eax
jne 0x4f13ec
xor eax, eax
ret
cmp dword [0x536cac], 0
je 0x4f141d
cmp word [0x56368c], 0
je 0x4f140e
push 6
push dword [0x537420]
call sub.USER32.dll_ShowWindow
jmp 0x4f1443
push 0
push dword [0x537420]
call sub.USER32.dll_ShowWindow
jmp 0x4f1443
cmp word [0x56368c], 0
je 0x4f1436
push 0
push dword [0x537420]
call sub.USER32.dll_ShowWindow
jmp 0x4f1443
push 6
push dword [0x537420]
call sub.USER32.dll_ShowWindow
mov eax, 1
ret
Function at 0x4f1c48
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x20006
push 0
push 0x536d6a
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallmIRC
push 0x80000002
call sub.ADVAPI32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
je 0x4f1c84
xor eax, eax
jmp 0x4f1cb4
push esi
call fcn.005183dc
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4f1caf
xor eax, eax
jmp 0x4f1cb4
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4f1cbc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 0xc]
cmp eax, 3
jne 0x4f1ce0
lea eax, [ebp - 4]
push eax
push str.SoftwareClasses
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x4f1d28
cmp eax, 2
jne 0x4f1cfc
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x4f1d28
dec eax
jne 0x4f1d16
lea eax, [ebp - 4]
push eax
push str.Software
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x4f1d28
lea eax, [ebp - 4]
push eax
push 0
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x4f1d30
xor eax, eax
jmp 0x4f1d52
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegDeleteKeyA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4f1d4d
xor eax, eax
jmp 0x4f1d52
mov eax, 1
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4f1d58
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
call fcn.00518300
add esp, 8
lea eax, [ebp - 0x140]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4f1d8e
mov edi, 1
jmp 0x4f1d90
xor edi, edi
push ebx
call fcn.005183dc
pop ecx
push eax
push dword [ebp + 0xc]
call fcn.005183dc
pop ecx
pop edx
sub edx, eax
mov byte [ebx + edx], 0
jmp 0x4f1e3d
test byte [ebp - 0x140], 0x10
je 0x4f1dce
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4f1e3d
mov edi, 1
jmp 0x4f1e3d
push esi
push edi
mov esi, 0x55219c
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [ebp - 0x114]
push eax
push 0x55219c
call fcn.00518300
add esp, 8
push 0
push 0
push 0x55219c
push dword [0x56387c]
call fcn.0049d9f0
test eax, eax
je 0x4f1e27
mov dword [0x56387c], eax
lea edx, [ebp - 0x140]
push edx
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4f1e3d
mov edi, 1
test edi, edi
je 0x4f1dad
cmp esi, 0xffffffff
je 0x4f1e50
push esi
call sub.KERNEL32.dll_FindClose
push 0x536dbd
push ebx
call fcn.00518300
add esp, 8
lea eax, [ebp - 0x140]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4f1e79
mov edi, 1
jmp 0x4f1e7b
xor edi, edi
push ebx
call fcn.005183dc
pop ecx
mov byte [ebx + eax - 3], 0
jmp 0x4f1f19
test byte [ebp - 0x140], 0x10
je 0x4f1f03
cmp byte [ebp - 0x114], 0x2e
je 0x4f1f03
lea eax, [ebp - 0x114]
push eax
push ebx
call fcn.00518300
add esp, 8
push 0
push 0
push ebx
push dword [0x563880]
call fcn.0049d9f0
test eax, eax
je 0x4f1ec7
mov dword [0x563880], eax
push 0x536dc2
push ebx
call fcn.00518300
add esp, 8
push dword [ebp + 0xc]
push ebx
call fcn.004f1d58
push 0x5c
push ebx
call fcn.005186c4
add esp, 8
test eax, eax
je 0x4f1f03
mov byte [eax], 0
push 0x5c
push ebx
call fcn.005186c4
add esp, 8
test eax, eax
je 0x4f1f03
inc eax
mov byte [eax], 0
lea edx, [ebp - 0x140]
push edx
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4f1f19
mov edi, 1
test edi, edi
je 0x4f1e8c
cmp esi, 0xffffffff
je 0x4f1f2c
push esi
call sub.KERNEL32.dll_FindClose
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f206f
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff78
mov esi, 0x555704
push 0xa
push 0x22
push dword [0x53741c]
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x4f2127
push ebx
push dword [0x53741c]
call sub.KERNEL32.dll_SizeofResource
mov ebp, eax
push ebx
push dword [0x53741c]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x4f2127
push eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x4f2127
push esi
push 0x180
call sub.KERNEL32.dll_GetTempPathA
push str.miunst_.exe
push esi
call fcn.00518300
add esp, 8
mov byte [esp], 0x88
push 0x1001
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4f2127
push ebp
push edi
push ebx
call sub.KERNEL32.dll__lwrite
push ebx
call sub.KERNEL32.dll__lclose
push 0x52feac
push str.__smirc32.exe
push esi
call fcn.005183dc
pop ecx
add eax, esi
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call sub.KERNEL32.dll_WinExec
add esp, 0x88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f260e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 2
jne 0x4f2652
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x537132
push 0
push ebx
push 0x53712c
push dword [0x537420]
call sub.SHELL32.dll_ShellExecuteA
push 0
call sub.KERNEL32.dll_SetErrorMode
jmp 0x4f2795
dec eax
jne 0x4f265c
mov esi, 1
jmp 0x4f265e
xor esi, esi
cmp dword [0x536f3c], 0
je 0x4f2674
cmp dword [0x536f40], 0
jne 0x4f26fa
cmp dword [0x536f3c], 0
je 0x4f2681
test esi, esi
je 0x4f2692
push ebx
push str.__s_____0xFFFFFFFF_0x4_________
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x4f26a1
push ebx
push str.__s_____0x0_0x4_________
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xffffffffffffffff
push 2
push 0x53717e
push edi
push str.WWW_OpenURL
call fcn.0044d928
test eax, eax
je 0x4f26fa
cmp dword [0x536f40], 0
je 0x4f2795
test esi, esi
jne 0x4f2795
push 0xffffffffffffffff
push 2
push 0x5371a0
push str.0xFFFFFFFF_0x0
push str.WWW_Activate
call fcn.0044d928
test eax, eax
jne 0x4f2795
push 0
call fcn.00415bea
jmp 0x4f2795
call fcn.004cf630
cmp byte [0x559ec0], 0
jne 0x4f2736
mov esi, 0x5371a4
mov edi, 0x559ec0
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [0x533fc4], 4
push 0
push 0x67
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
jmp 0x4f2795
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x52feac
push ebx
push 0x559ec0
push str.open
push dword [0x537420]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x4f278e
mov esi, str.unknown
mov edi, 0x559ec0
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
call fcn.00415bea
push 0
push 0x51a
push 0x111
push dword [0x537420]
call sub.USER32.dll_PostMessageA
push 0
call sub.KERNEL32.dll_SetErrorMode
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4f804c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x638]
test al, al
jne 0x4f8068
mov eax, 0x537620
jmp 0x4f8105
cmp al, 1
jne 0x4f8074
lea eax, [ebx + 4]
jmp 0x4f8105
cmp al, 2
jne 0x4f80ab
mov al, byte [ebx + 0x639]
cmp al, 1
jne 0x4f8087
lea eax, [ebx + 4]
jmp 0x4f8105
cmp al, 2
jne 0x4f8092
mov eax, 0x537629
jmp 0x4f8105
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.0051833c
add esp, 8
test eax, eax
jne 0x4f80a8
mov eax, esi
jmp 0x4f8105
inc eax
jmp 0x4f8105
mov al, byte [ebx + 0x638]
cmp al, 3
jne 0x4f80cc
cmp byte [ebx + 0x639], 1
jne 0x4f80c5
mov eax, str.odccs
jmp 0x4f8105
mov eax, str.odccg
jmp 0x4f8105
cmp al, 4
jne 0x4f80d7
mov eax, str.olist
jmp 0x4f8105
cmp al, 5
jne 0x4f80e2
mov eax, str.ofinger
jmp 0x4f8105
cmp al, 6
jne 0x4f80ed
mov eax, str.ourl
jmp 0x4f8105
cmp al, 7
jne 0x4f80f8
mov eax, str.onotify
jmp 0x4f8105
cmp al, 8
jne 0x4f8103
mov eax, str.olinks
jmp 0x4f8105
xor eax, eax
test eax, eax
je 0x4f8138
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x53766f
push eax
push str.ontop
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x555704], 0
je 0x4f8138
mov eax, 1
jmp 0x4f813a
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f900c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x537720
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f904b
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x537743
push 0x537739
push 0x537730
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4f9099
push 0x20
push ebx
call fcn.005186c4
add esp, 8
mov esi, eax
mov dword [0x564eb8], esi
test esi, esi
je 0x4f9074
inc dword [0x564eb8]
mov eax, dword [0x564eb8]
cmp byte [eax], 0
je 0x4f9074
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4f907a
inc ebx
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x537751
push ebx
push str.beeping
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x537756
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f90b6
mov eax, 1
jmp 0x4f90b8
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4f918d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x53777c
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f91cc
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x5377a0
push 0x537796
push 0x53778c
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4f921a
push 0x20
push ebx
call fcn.005186c4
add esp, 8
mov esi, eax
mov dword [0x564ebc], esi
test esi, esi
je 0x4f91f5
inc dword [0x564ebc]
mov eax, dword [0x564ebc]
cmp byte [eax], 0
je 0x4f91f5
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4f91fb
inc ebx
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x5377af
push ebx
push str.flashing
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x5377b4
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f9237
mov eax, 1
jmp 0x4f9239
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f943b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, str.FixedSys
mov al, byte [ebx + 0x638]
test al, al
jne 0x4f945e
lea eax, [esi + 0x25a]
jmp 0x4f9506
cmp al, 1
jne 0x4f946a
lea eax, [ebx + 4]
jmp 0x4f9506
cmp al, 2
jne 0x4f94a5
mov al, byte [ebx + 0x639]
cmp al, 1
jne 0x4f9480
lea eax, [ebx + 4]
jmp 0x4f9506
cmp al, 2
jne 0x4f948c
lea eax, [esi + 0x263]
jmp 0x4f9506
push 0x20
lea edi, [ebx + 4]
push edi
call fcn.0051833c
add esp, 8
test eax, eax
jne 0x4f94a2
mov eax, edi
jmp 0x4f9506
inc eax
jmp 0x4f9506
mov al, byte [ebx + 0x638]
cmp al, 3
jne 0x4f94c8
cmp byte [ebx + 0x639], 1
jne 0x4f94c0
lea eax, [esi + 0x26d]
jmp 0x4f9506
lea eax, [esi + 0x274]
jmp 0x4f9506
cmp al, 4
jne 0x4f94d4
lea eax, [esi + 0x27b]
jmp 0x4f9506
cmp al, 5
jne 0x4f94e0
lea eax, [esi + 0x282]
jmp 0x4f9506
cmp al, 6
jne 0x4f94ec
lea eax, [esi + 0x28b]
jmp 0x4f9506
cmp al, 7
jne 0x4f94f8
lea eax, [esi + 0x291]
jmp 0x4f9506
cmp al, 8
jne 0x4f9504
lea eax, [esi + 0x29a]
jmp 0x4f9506
xor eax, eax
mov ebx, 2
test eax, eax
je 0x4f958a
push 0x52ffb0
push 0x3e7
push 0x555704
lea edx, [esi + 0x2ab]
push edx
push eax
lea eax, [esi + 0x2a2]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea ecx, [esi + 0x2af]
push ecx
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f954e
xor ebx, ebx
jmp 0x4f958a
lea eax, [esi + 0x2b2]
push eax
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f956d
mov ebx, 1
jmp 0x4f958a
lea eax, [esi + 0x2b5]
push eax
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f958a
mov ebx, 3
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4f9662
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push str.Message_Window
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f96a1
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x5378ba
push 0x5378b0
push 0x5378a6
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4f96ef
push 0x20
push ebx
call fcn.005186c4
add esp, 8
mov esi, eax
mov dword [0x564ec0], esi
test esi, esi
je 0x4f96ca
inc dword [0x564ec0]
mov eax, dword [0x564ec0]
cmp byte [eax], 0
je 0x4f96ca
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4f96d0
inc ebx
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x5378c9
push ebx
push str.tracking
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x5378ce
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f970c
mov eax, 1
jmp 0x4f970e
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f9b3e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x638]
test al, al
jne 0x4f9b57
mov eax, str.ostatus
jmp 0x4f9b9b
cmp al, 1
jne 0x4f9b60
lea eax, [ebx + 4]
jmp 0x4f9b9b
cmp al, 2
jne 0x4f9b97
mov al, byte [ebx + 0x639]
cmp al, 1
jne 0x4f9b73
lea eax, [ebx + 4]
jmp 0x4f9b9b
cmp al, 2
jne 0x4f9b7e
mov eax, str.omessage
jmp 0x4f9b9b
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.0051833c
add esp, 8
test eax, eax
jne 0x4f9b94
mov eax, esi
jmp 0x4f9b9b
inc eax
jmp 0x4f9b9b
xor eax, eax
jmp 0x4f9bf6
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x53792d
push eax
push str.timestamp
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x537931
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f9bd4
xor eax, eax
jmp 0x4f9bf6
push 0x537936
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4f9bf1
mov eax, 1
jmp 0x4f9bf6
mov eax, 2
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4fda6e
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
mov ax, 0x101
push esp
push eax
call sub.WSOCK32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4fdaad
push 0x10
push 0x53747c
push ebx
call fcn.004fda18
push eax
push dword [0x537420]
call sub.USER32.dll_MessageBoxA
mov dword [0x537b84], 1
xor eax, eax
jmp 0x4fdabc
mov dword [0x537b84], 1
mov eax, 1
add esp, 0x190
pop ebx
ret

Function at 0x4fe25b
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
push edi
mov dword [0x537b80], 1
mov esi, 0x5535b5
mov edi, 0x533e20
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x533eec], 0
jne 0x4fe2bf
cmp byte [0x533e20], 0
je 0x4fe2bf
push 0
push 0x1774
call fcn.00415c87
push eax
push 0x533e20
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4fe2ff
push 0x64
push 0x533e20
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x4fe2ff
push 0
push 0x1774
call fcn.00415c87
mov edi, eax
mov esi, 0x533e20
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x537b80], 0
jne 0x4fe30f
xor eax, eax
jmp 0x4fe49f
cmp dword [0x533ef0], 0
jne 0x4fe351
cmp dword [0x533ee8], 0
je 0x4fe351
mov eax, 0x533e20
mov edx, 0x5535b5
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4fe34b
test cl, cl
je 0x4fe49d
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4fe34b
add eax, 2
add edx, 2
test cl, cl
jne 0x4fe32b
je 0x4fe49d
push 0
push 0x1774
call fcn.00415c87
push eax
push 0x533e20
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4fe3f3
push 0
push 0x1774
call fcn.00415c87
mov edi, eax
mov esi, 0x533e84
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [0x533ee8], eax
cmp dword [0x52b4d0], 0
je 0x4fe3ec
mov dword [0x534c44], 1
push dword [0x52a384]
push 0
push 0x1779
call fcn.00415c87
push eax
push dword [0x537430]
call fcn.004c8c63
mov dword [0x537b88], 1
push 1
call fcn.004fde43
xor eax, eax
jmp 0x4fe49f
cmp dword [0x537b80], 0
jne 0x4fe403
xor eax, eax
jmp 0x4fe49f
push 0x400
push 0
push 0x565628
call fcn.0051825c
add esp, 0xc
push 0x400
push 0x565628
push 0x533e20
push 0x40a
push dword [0x537420]
call sub.WSOCK32.dll_WSAAsyncGetHostByName
mov ebx, eax
mov dword [0x537b7c], ebx
test ebx, ebx
jne 0x4fe49d
cmp dword [0x52b4d4], 0
je 0x4fe44f
xor eax, eax
jmp 0x4fe49f
xor edx, edx
mov dword [0x533ee8], edx
cmp dword [0x52b4d0], 0
je 0x4fe499
mov dword [0x534c44], 1
push dword [0x52a384]
push 0
push 0x177a
call fcn.00415c87
push eax
push dword [0x537430]
call fcn.004c8c63
mov dword [0x537b88], 2
push 1
call fcn.004fde43
xor eax, eax
jmp 0x4fe49f
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4fe778
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x4fe7cf
cmp dword [0x52b4d4], 0
je 0x4fe79c
xor eax, eax
jmp 0x4fe9d2
cmp dword [0x52b4d0], 0
je 0x4fe7af
mov dword [0x537b88], 3
push 0
call fcn.004fde43
push 0
push 0x177b
call fcn.00415c87
push eax
call fcn.004fdac4
xor eax, eax
jmp 0x4fe9d2
xor edx, edx
mov dword [0x537b64], edx
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0051825c
add esp, 0xc
mov word [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 0xc], eax
mov dx, word [0x533e1c]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x565b2c]
cmp eax, 0xffffffff
je 0x4fe812
mov dword [ebp - 0xc], eax
jmp 0x4fe881
mov ebx, 0x565228
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0xc], ecx
cmp dword [0x537b68], 0
jne 0x4fe881
mov eax, dword [ebx + 0xc]
cmp dword [eax + 4], 0
je 0x4fe881
mov esi, 1
jmp 0x4fe877
mov edx, dword [ebx + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0x537bbc
push 0x5535b5
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
push 0x5535b5
push dword [0x537b68]
call fcn.0049d9f0
mov dword [0x537b68], eax
inc esi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + esi*4]
test eax, eax
jne 0x4fe83a
cmp dword [0x52e370], 0
je 0x4fe8c9
push 0
call fcn.004666df
push dword [ebp - 0xc]
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0x537bc0
push 0x5535b5
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
mov dx, word [0x533e1c]
push edx
push 0x5535b5
call fcn.00466a52
xor eax, eax
jmp 0x4fe9d2
push 0
push 2
push 0
mov dx, word [0x52c432]
push edx
mov cx, word [0x52c430]
push ecx
call fcn.004cb44e
mov ebx, eax
mov dword [0x537b60], ebx
cmp ebx, 0xffffffff
jne 0x4fe925
mov dword [0x534c44], 1
push dword [0x52a380]
push 0
push 0x177c
call fcn.00415c87
push eax
push dword [0x537430]
call fcn.004c8c63
call fcn.0043d96c
xor eax, eax
jmp 0x4fe9d2
push dword [0x537b60]
call fcn.004fe692
push 0x10
push 0x40d
push dword [0x537420]
push dword [0x537b60]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [0x537b60]
call sub.WSOCK32.dll_connect
test eax, eax
jne 0x4fe961
xor eax, eax
jmp 0x4fe9d2
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4fe971
xor eax, eax
jmp 0x4fe9d2
cmp dword [0x52b4d4], 0
je 0x4fe97e
xor eax, eax
jmp 0x4fe9d2
push eax
call fcn.004fe6bb
xor edx, edx
mov dword [0x534c34], edx
mov dword [0x534c44], 1
push dword [0x52a384]
push 0x5535b5
push dword [0x537430]
call fcn.004c8c63
cmp dword [0x52b4d0], 0
je 0x4fe9bf
mov dword [0x537b88], 4
push 0
call fcn.004fde43
push 0x537bc4
call fcn.004fdac4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4