joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8508
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffe68
xor ebx, ebx
push 0
push 0x20
lea eax, [esp + 0x150]
push eax
push 3
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4a8642
push 0
push 0x138
lea eax, [esp + 0x18]
push eax
push 2
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4a8642
push 0
push 0x2c
lea eax, [esp + 0x170]
push eax
push 0
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4a8642
cmp dword [0x505cbc], 0
jne 0x4a8572
cmp dword [0x505cb8], 0
je 0x4a8614
cmp byte [esp + 0x190], 0
je 0x4a8614
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [0x505cb8]
sbb edx, dword [0x505cbc]
jno 0x4a85a1
call fcn.004037ec
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 0x150]
mov edx, dword [esp + 0x154]
sub eax, dword [0x505cc0]
sbb edx, dword [0x505cc4]
jno 0x4a85c9
call fcn.004037ec
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], 0
jne 0x4a85dd
cmp dword [esp + 8], 0
je 0x4a8614
fild qword [esp]
fild qword [esp + 8]
fdivp st(1)
fmul dword [0x4a864c]
xor eax, eax
mov al, byte [esp + 0x190]
mov dword [esp + 0x194], eax
fild dword [esp + 0x194]
fdivp st(1)
fsubr dword [0x4a864c]
call fcn.00402bcc
mov ebx, eax
mov eax, dword [esp + 0x10]
mov dword [0x505cb8], eax
mov eax, dword [esp + 0x14]
mov dword [0x505cbc], eax
mov eax, dword [esp + 0x150]
mov dword [0x505cc0], eax
mov eax, dword [esp + 0x154]
mov dword [0x505cc4], eax
mov eax, ebx
add esp, 0x198
pop ebx
ret

Function at 0x4a9174
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
xor ebx, ebx
push pe_nt_image_headers32
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x24]
push eax
push esi
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4a91b3
mov ebx, dword [esp]
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
ret
Function at 0x4afde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.004afb58
mov edx, eax
mov eax, 4
call fcn.004afb60
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 0x4fd824
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x4afe60
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x4afe2e
cmp byte [ebp + 8], 0
jne 0x4aff8f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x4aff64
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x4aff3e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x4aff8f
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x4aff7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4aff98
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x4fd834
mov ecx, 0x48
call fcn.004029c4
lea edx, [ebp + 0x48]
mov eax, 0x4fd87c
mov ecx, 0x1000
call fcn.004029c4
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
xor ecx, ecx
mov cl, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x4afff3
xor edi, edi
dec eax
jne 0x4affe0
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x4affd9
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004b0074
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x4b0011
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004b0074
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x4b003c
add ebx, 0x400
dec edi
jne 0x4b003a
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b0074
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.004029c4
cmp byte [esp], 0
je 0x4b0127
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4b00a6
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4b01ac
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x4b0132
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4b0254
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.004029c4
xor eax, eax
mov dword [esp], eax
mov esi, 0x4fd724
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.004029c4
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x4b02d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.004029c4
dec edi
test edi, edi
jl 0x4b03ef
inc edi
mov dword [esp + 4], edi
mov esi, ebx
mov al, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x4b0320
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x4b03e4
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x4b0364
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x4b0302
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.004029c4
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b04f4
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
push ecx
shr ecx, 2
je 0x4b050e
cld
mov eax, dword [edi]
xor dword [esi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x4b0501
pop ecx
and ecx, 3
je 0x4b051d
mov al, byte [edi]
xor byte [esi], al
inc esi
inc edi
dec ecx
jne 0x4b0514
pop edi
pop esi
ret
Function at 0x4b0d64
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.00403178
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4b0ee9
mov edi, 1
xor esi, esi
jmp 0x4b0e29
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4fe884]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4fe884]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
mov al, byte [esp + edi + 0xd]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4fe884]
mov byte [esp + esi + 0x3b], dl
mov edx, eax
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4fe884]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x4b0daa
cmp edi, dword [esp + 8]
jg 0x4b0ecf
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4fe884]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x4b0e86
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4fe884]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x4b0ec7
mov edx, eax
shl edx, 4
and dl, 0x30
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4fe884]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
and dl, 0x3c
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4fe884]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x4b0d81
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x4d11bc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
test dl, dl
je 0x4d11d3
add esp, 0xfffffff0
call fcn.00403bf8
mov ebx, edx
mov esi, eax
mov byte [esi + 0x40], 0
xor eax, eax
mov dword [esi + 8], eax
lea eax, [esi + 0x28]
xor ecx, ecx
mov edx, 8
call fcn.00403178
mov dword [esi + 0x20], 0x2000
mov dword [esi + 0x24], 0x2000
mov dword [esi + 4], 0xffffffff
xor eax, eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x30], 0xffffffff
mov byte [esi + 0x41], 0
mov dword [esi + 0x58], 0xffffffff
lea eax, [ebp - 0x18e]
push eax
mov dl, 2
mov al, 2
call fcn.0040764c
push eax
call sub.ws2_32.dll_WSAStartup_1
test eax, eax
je 0x4d124b
mov ecx, 0x4d1270
mov dl, 1
mov eax, dword [0x4d108c]
call fcn.0040ca3c
call fcn.00404060
mov eax, esi
test bl, bl
je 0x4d1260
call fcn.00403c50
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d14f0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov esi, eax
xor ebx, ebx
push 1
push 0
push 0
push 0
push 2
push 2
call sub.ws2_32.dll_WSASocketA
mov edi, eax
mov dword [esi + 4], edi
cmp edi, 0xffffffff
je 0x4d15cc
mov byte [esp], 1
push 1
lea eax, [esp + 4]
push eax
push 4
push 0xffff
mov eax, dword [esi + 4]
push eax
call sub.ws2_32.dll_setsockopt
test eax, eax
jne 0x4d15cc
push 4
lea eax, [esi + 0x41]
push eax
push 0x20
push 0xffff
mov eax, dword [esi + 4]
push eax
call sub.ws2_32.dll_setsockopt
test eax, eax
jne 0x4d15cc
mov word [esp + 8], 2
mov eax, dword [esi + 8]
push eax
call sub.ws2_32.dll_htons
mov word [esp + 0xa], ax
xor eax, eax
mov dword [esp + 0xc], eax
push 0x10
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 4]
push eax
call sub.ws2_32.dll_bind
inc eax
jne 0x4d158d
mov eax, esi
call fcn.004d14c0
jmp 0x4d15cc
mov dword [esp + 4], 0x10
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 4]
push eax
call sub.ws2_32.dll_getsockname
mov ax, word [esp + 0xa]
push eax
call sub.ws2_32.dll_ntohs
movzx eax, ax
mov dword [esi + 8], eax
cmp byte [esi + 0x44], 0
je 0x4d15ca
mov eax, esi
call fcn.004d18dc
test al, al
je 0x4d15cc
mov bl, 1
mov eax, ebx
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x4d15f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d16c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x24], 2
mov dword [ebp - 0x20], esi
push edi
call sub.ws2_32.dll_htons
mov word [ebp - 0x22], ax
mov dword [ebp - 0x10], 0x10
cmp byte [ebx + 0x44], 0
je 0x4d1651
mov eax, dword [ebp - 8]
push eax
push esi
push edi
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.004d1f4c
mov edi, eax
jmp 0x4d166e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_recvfrom
mov edi, eax
lea esi, [ebx + 0x28]
mov eax, dword [ebp - 0x20]
mov dword [esi], eax
mov ax, word [ebp - 0x22]
push eax
call sub.ws2_32.dll_ntohs
movzx eax, ax
mov dword [esi + 4], eax
cmp edi, 0xffffffff
jne 0x4d16bc
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
je 0x4d16bf
cmp dword [ebp - 0x14], 0x2746
je 0x4d16bf
cmp word [ebx + 0x12], 0
je 0x4d16bf
lea eax, [ebp - 0x14]
push eax
mov cl, 2
mov edx, ebx
mov eax, dword [ebx + 0x14]
call dword [ebx + 0x10]
jmp 0x4d16bf
mov dword [ebp - 0xc], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d16d3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d16e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov byte [ebp - 9], 0
mov word [ebp - 0x20], 2
push ebx
call sub.ws2_32.dll_htons
mov word [ebp - 0x1e], ax
mov eax, edi
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x4d172b
mov ecx, 0x4d17a4
mov dl, 1
mov eax, dword [0x4d108c]
call fcn.0040ca3c
call fcn.00404060
cmp byte [esi + 0x44], 0
je 0x4d1746
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 4]
mov eax, esi
call fcn.004d1e28
jmp 0x4d175f
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 4]
push eax
call sub.ws2_32.dll_sendto
inc eax
jne 0x4d178a
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4d178e
cmp word [esi + 0x12], 0
je 0x4d178e
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, esi
mov eax, dword [esi + 0x14]
call dword [esi + 0x10]
jmp 0x4d178e
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d17c4
Capabilities:
Set socket configuration

Disassembly:
push ebx
add esp, 0xfffffff4
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x24]
cmp eax, dword [esp]
je 0x4d1823
push 4
lea eax, [esp + 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
jne 0x4d181d
call sub.kernel32.dll_GetLastError_1
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea eax, [esp + 4]
push eax
push 0
mov ecx, 0x4d1830
mov dl, 1
mov eax, dword [0x4d108c]
call fcn.0040ca78
call fcn.00404060
mov eax, dword [esp]
mov dword [ebx + 0x24], eax
add esp, 0xc
pop ebx
ret

Function at 0x4d1850
Capabilities:
Set socket configuration

Disassembly:
push ebx
add esp, 0xfffffff4
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x20]
cmp eax, dword [esp]
je 0x4d18af
push 4
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebx + 4]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
jne 0x4d18a9
call sub.kernel32.dll_GetLastError_1
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea eax, [esp + 4]
push eax
push 0
mov ecx, 0x4d18bc
mov dl, 1
mov eax, dword [0x4d108c]
call fcn.0040ca78
call fcn.00404060
mov eax, dword [esp]
mov dword [ebx + 0x20], eax
add esp, 0xc
pop ebx
ret
Function at 0x4d18dc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d1a21
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x58], 0xffffffff
jne 0x4d190c
push 0
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebx + 0x58], eax
mov word [ebp - 0x10], 2
mov eax, dword [ebx + 0x4c]
push eax
call sub.ws2_32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [ebx + 0x48]
call fcn.00404ba4
push eax
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x58]
push eax
call sub.ws2_32.dll_connect
inc eax
jne 0x4d196a
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, 0x4d1a38
mov dl, 1
mov eax, dword [0x407cb4]
call fcn.0040ca78
call fcn.00404060
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x50]
call fcn.00408c20
cmp dword [ebp - 0x1c], 0
je 0x4d1989
mov cl, 1
mov edx, dword [ebx + 0x58]
mov eax, ebx
call fcn.004d1ab0
jmp 0x4d1995
xor ecx, ecx
mov edx, dword [ebx + 0x58]
mov eax, ebx
call fcn.004d1ab0
test al, al
jne 0x4d19ca
mov eax, dword [ebx + 0x58]
push eax
call sub.ws2_32.dll_closesocket
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, 0x4d1a64
mov dl, 1
mov eax, dword [0x407cb4]
call fcn.0040ca78
call fcn.00404060
mov edx, dword [ebx + 0x58]
mov eax, ebx
call fcn.004d1d50
test al, al
jne 0x4d1a09
mov eax, dword [ebx + 0x58]
push eax
call sub.ws2_32.dll_closesocket
call sub.ws2_32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, 0x4d1a90
mov dl, 1
mov eax, dword [0x407cb4]
call fcn.0040ca78
call fcn.00404060
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1a28
lea eax, [ebp - 0x1c]
call fcn.004046e4
ret