joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454560
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0x1000
call fcn.00565660
push esi
push edi
push 0x57553c
push ecx
or esi, 0xffffffff
call fcn.00563d94
mov edi, eax
add esp, 8
test edi, edi
je 0x4545f4
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0056493a
add esp, 0x10
test eax, eax
jbe 0x4545e5
lea esp, [esp]
xor ecx, ecx
test eax, eax
jbe 0x4545c5
xor edx, edx
mov dl, byte [esp + ecx + 8]
xor edx, esi
and edx, 0xff
mov edx, dword [edx*4 + 0x589500]
shr esi, 8
xor esi, edx
inc ecx
cmp ecx, eax
jb 0x4545a6
cmp eax, 0x1000
jb 0x4545e5
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0056493a
add esp, 0x10
test eax, eax
ja 0x4545a0
test byte [edi + 0xc], 0x20
push edi
je 0x4545ff
call fcn.00563cbd
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x1000
ret
call fcn.00563cbd
add esp, 4
mov eax, esi
pop edi
not eax
pop esi
add esp, 0x1000
ret

Function at 0x454620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
push edi
mov edi, ecx
jg 0x45462b
xor eax, eax
pop edi
ret
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jle 0x454653
xor ecx, ecx
mov cl, byte [esi + edi]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x589500]
shr eax, 8
xor eax, ecx
inc esi
cmp esi, edx
jl 0x454635
pop esi
not eax
pop edi
ret
Function at 0x454660
Capabilities:
Hash data with crc32

Disassembly:
mov eax, 0x2210
call fcn.00565660
mov edx, 0x20
mov ecx, str.f341193f01535820s
call fcn.0041d7e0
cmp eax, 0x73824a00
jne 0x45468c
mov eax, 3
add esp, 0x2210
ret
mov ecx, dword [0x5a1afc]
push 0x104
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4546ae
add esp, 0x2210
ret
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x18]
push 0x57553c
push edx
call fcn.00563d94
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
je 0x4547eb
push 0x576f54
call fcn.00563a14
push edi
push 0x2000
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x22c]
push 1
push eax
or ebp, 0xffffffff
xor esi, esi
call fcn.0056493a
add esp, 0x14
test eax, eax
jbe 0x454795
xor ebx, ebx
test eax, eax
jbe 0x45475a
jmp 0x454710
cmp esi, dword [esp + 0x10]
jb 0x454737
mov ecx, str.f341193f01535820s
lea edi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x454720
mov edx, dword [esp + 0x10]
sub ecx, edi
mov edi, dword [esp + 0x14]
add ecx, edx
cmp esi, ecx
jb 0x454754
xor ecx, ecx
mov cl, byte [esp + ebx + 0x220]
xor ecx, ebp
and ecx, 0xff
mov edx, dword [ecx*4 + 0x589500]
shr ebp, 8
xor ebp, edx
inc esi
inc ebx
cmp ebx, eax
jb 0x454710
cmp eax, 0x2000
jb 0x454795
push 1
push 0xffffffffffffffce
push edi
call fcn.00564a23
add esp, 0xc
test eax, eax
push edi
jne 0x4547e3
push 0x2000
lea eax, [esp + 0x228]
push 1
push eax
sub esi, 0x32
call fcn.0056493a
add esp, 0x10
test eax, eax
ja 0x454705
test byte [edi + 0xc], 0x20
push edi
jne 0x4547e3
call fcn.00563cbd
not ebp
push ebp
lea ecx, [esp + 0x124]
push str._08lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 8
lea edx, [esp + 0x130]
push edx
push str.f341193f01535820s
call fcn.00572b89
add esp, 0x1c
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop esi
pop ebp
pop ebx
inc ecx
mov eax, ecx
add esp, 0x2210
ret
call fcn.00563cbd
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2210
ret
Function at 0x46ba90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, ecx
push 2
mov dword [ebx], 0
mov eax, dword [0x5a1afc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x5a1afc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46bb3f
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x46bb3d
mov edx, dword [0x5a1b00]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x46bb3d
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x46bb0c
movzx ecx, word [esi + 0xe]
lea eax, [ecx - 1]
cmp eax, 7
ja case.0x46bafa.3
movzx eax, byte [eax + 0x46bb4c]
jmp dword [eax*4 + 0x46bb44]
mov eax, 1
shl eax, cl
jmp 0x46bb0c
xor eax, eax
lea ecx, [eax*4]
movzx eax, word [esi]
movzx edx, cx
push 0
mov ecx, esi
push esi
add ecx, edx
add eax, ecx
push eax
push 4
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebx], eax
mov edx, dword [0x5a1b00]
push edi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
ret
Function at 0x46d3f0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x595ca4]
sub esp, 0x104
test eax, eax
push esi
mov esi, ecx
jne 0x46d40c
xor eax, eax
pop esi
add esp, 0x104
ret
test esi, esi
je 0x46d424
mov ecx, dword [esi + 0x540]
call fcn.004dbea0
test eax, eax
je 0x46d402
mov eax, dword [0x595ca4]
mov ecx, dword [eax + 0x138]
test ecx, ecx
push ebp
push edi
je 0x46d4f5
test esi, esi
je 0x46d4e6
mov ecx, dword [esi + 0x12c]
test ecx, ecx
je 0x46d4e6
cmp esi, eax
je 0x46d4e6
lea eax, [esi + 0x64]
push eax
xor edx, edx
mov ecx, 0x7d2
call fcn.0041c9e0
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x14]
push ecx
call ebp
mov eax, dword [0x595ca4]
add esp, 0xc
xor ecx, ecx
test eax, eax
je 0x46d4bb
mov edi, edi
mov eax, dword [eax + 0x544]
inc ecx
test eax, eax
jne 0x46d480
cmp ecx, 1
jle 0x46d4bb
lea eax, [esp + 0xc]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46d497
sub eax, edi
dec ecx
push ecx
xor edx, edx
mov ecx, 0x7d3
mov edi, eax
call fcn.0041c9e0
push eax
lea edx, [esp + edi + 0x14]
push edx
call ebp
add esp, 0xc
mov eax, dword [0x5940a4]
mov dword [0x589b90], 0
mov dword [0x59c69c], 1
mov ecx, dword [esi + 0x540]
mov ecx, dword [ecx]
push eax
lea edx, [esp + 0x10]
call fcn.004fc570
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x104
ret
test esi, esi
jne 0x46d4fb
mov esi, eax
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x46d5a0
lea edx, [esi + 0x64]
push edx
xor edx, edx
mov ecx, 0x7d1
call fcn.0041c9e0
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x14]
push eax
call ebp
mov eax, dword [0x595ca4]
add esp, 0xc
xor ecx, ecx
test eax, eax
je 0x46d574
mov eax, dword [eax + 0x544]
inc ecx
test eax, eax
jne 0x46d535
cmp ecx, 1
jle 0x46d574
lea eax, [esp + 0xc]
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46d550
sub eax, edi
dec ecx
push ecx
xor edx, edx
mov ecx, 0x7d3
mov edi, eax
call fcn.0041c9e0
push eax
lea ecx, [esp + edi + 0x14]
push ecx
call ebp
add esp, 0xc
mov edx, dword [0x5940a4]
mov dword [0x589b90], 0
mov dword [0x59c69c], 1
mov eax, dword [esi + 0x540]
mov ecx, dword [eax]
push edx
lea edx, [esp + 0x10]
call fcn.004fc570
mov ecx, dword [esi + 0x540]
call fcn.004dbea0
test eax, eax
jne 0x46d5b9
pop edi
pop ebp
pop esi
add esp, 0x104
ret
lea edi, [esi + 0x64]
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x46d61f
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, eax
shr ecx, 0x10
mov edx, ecx
push 0x400
shr edx, 8
lea edi, [esi + 0x13c]
mov byte [edi], dl
movzx eax, ax
lea edx, [esi + 0x140]
push edx
push 2
mov byte [esi + 0x13d], cl
mov ecx, eax
push 4
shr ecx, 8
push edi
mov byte [esi + 0x13e], cl
mov byte [esi + 0x13f], al
mov eax, dword [0x5a1b00]
push 0x800b
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByAddr]
jmp 0x46d63d
mov eax, dword [0x5a1b00]
push 0x400
lea edx, [esi + 0x140]
push edx
push edi
push 0x800b
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
xor ecx, ecx
test eax, eax
setne cl
pop edi
mov dword [esi + 0x138], eax
pop ebp
pop esi
mov eax, ecx
add esp, 0x104
ret
Function at 0x46e330
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
push ebx
push esi
lea eax, [esp + 0xc]
push eax
mov bl, dl
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [esp + esi + 0xc]
lea eax, [esp + esi + 0xc]
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0xf], cl
mov byte [eax], bl
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x46e370
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x114
push esi
lea eax, [esp + 0x18]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46e3a7
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
je 0x46e3b1
cmp eax, 2
je 0x46e3b1
xor eax, eax
pop esi
add esp, 0x114
ret
movzx eax, word [esp + 4]
pop esi
add esp, 0x114
ret
Function at 0x475d70
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, edx
mov edi, esi
mov dword [esp + 0x14], ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x475d84
mov eax, 0x5899f4
sub edi, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x475d95
sub eax, edx
test ebx, ebx
mov ebp, eax
mov dword [esp + 0x10], 0
je 0x475e27
test edi, edi
jle 0x475e27
mov ecx, esi
call fcn.004758a0
mov ecx, esi
call fcn.004758e0
movzx ecx, byte [edi + esi - 1]
dec edi
sub ecx, 0x78
test ecx, ecx
jle 0x475dcd
sub edi, ecx
movzx eax, byte [edi + esi - 1]
dec edi
sub eax, 0x6e
dec edi
mov dword [esp + 0x10], eax
movzx eax, byte [edi + esi]
sub eax, 0x64
add eax, ecx
cmp eax, ebp
mov byte [edi + esi], 0
jle 0x475dee
sub eax, ebp
mov edi, esi
lea edx, [edi + 1]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x475df3
sub edi, edx
test eax, eax
jl 0x475ec4
cmp eax, ebp
jg 0x475ec4
xor ecx, ecx
test edi, edi
jle 0x475e27
mov dl, byte [eax + 0x5899f4]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x475e22
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x475e12
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x475e30
sub eax, edx
lea ecx, [eax - 1]
test ecx, ecx
jle 0x475e5b
dec ecx
shr ecx, 1
lea eax, [esi + 1]
inc ecx
mov dl, byte [eax - 1]
mov bl, byte [eax]
mov byte [eax - 1], bl
mov byte [eax], dl
add eax, 2
dec ecx
jne 0x475e47
mov ebx, dword [esp + 0x14]
mov ecx, esi
call fcn.004758e0
xor eax, eax
xor ecx, ecx
test edi, edi
jle 0x475e85
lea ebx, [ebx]
mov dl, byte [eax + 0x5899f4]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x475e80
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x475e70
test ebx, ebx
je 0x475ef9
xor ecx, ecx
xor ebx, ebx
test edi, edi
jle 0x475eb0
movzx eax, byte [ebx + esi]
add ecx, eax
cmp ecx, 0x1e
jl 0x475eab
mov eax, 0x88888889
mul ecx
shr edx, 4
imul edx, edx, 0xffffffe2
add ecx, edx
inc ebx
cmp ebx, edi
jl 0x475e91
cmp ecx, dword [esp + 0x10]
je 0x475ef9
cmp dword [esp + 0x14], 1
jne 0x475ee8
push 0
call fcn.00565941
cmp ebx, 1
jne 0x475ed0
push 0
call fcn.00565941
mov eax, dword [0x577870]
mov dword [esi], eax
mov cl, byte [0x577874]
pop edi
mov byte [esi + 4], cl
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [0x577870]
mov dword [esi], ecx
mov dl, byte [0x577874]
mov byte [esi + 4], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x47e280
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
mov esi, edx
test esi, esi
push edi
mov edi, ecx
je 0x47e310
cmp byte [esi], 0
je 0x47e310
mov edx, 0x3e7
lea ecx, [esp + 8]
call fcn.0041e210
lea edx, [esp + 8]
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x47e2b0
mov eax, dword [0x59f668]
test eax, eax
je 0x47e2d6
mov eax, dword [edi + 0x540]
test eax, eax
je 0x47e2d6
lea ecx, [esp + 8]
call fcn.00512d60
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47e2e0
mov ecx, dword [edi + 0x884]
sub eax, edx
push 0
mov esi, eax
push esi
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_send]
sub eax, esi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x3e8
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3e8
ret
Function at 0x4827e0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [0x596770]
sub esp, 0x10
cmp ecx, eax
jne 0x4827f3
shr edx, 0x10
test edx, edx
je 0x48280c
mov ecx, 0x9c7
xor edx, edx
call fcn.0041c9e0
mov ecx, eax
call fcn.00482720
add esp, 0x10
ret 4
mov dx, word [0x589910]
mov cx, word [0x58990c]
push 0
push 2
push 0
mov dword [0x596770], 0
call fcn.004fd380
cmp eax, 0xffffffff
mov dword [0x589a24], eax
jne 0x482852
mov ecx, 0x9c8
xor edx, edx
call fcn.0041c9e0
mov ecx, eax
call fcn.00482720
add esp, 0x10
ret 4
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push 0x4f
mov dword [esp + 0x10], eax
mov word [esp + 4], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
jne 0x48288b
mov ecx, dword [0x596784]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [0x5a1b00]
mov edx, dword [0x589a24]
push 0x10
push 0x8023
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov ecx, dword [0x589a24]
push 0x10
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x4828e2
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4828e2
mov ecx, 0x9c9
xor edx, edx
call fcn.0041c9e0
mov ecx, eax
call fcn.00482720
add esp, 0x10
ret 4

Function at 0x4828f0
Capabilities:
Send data
Send data on socket

Disassembly:
shr ecx, 0x10
sub esp, 0x104
test ecx, ecx
je 0x482907
mov ecx, 0x9c9
jmp 0x482a31
mov al, byte [0x5966a0]
push esi
xor edx, edx
test al, al
push 0x596708
je 0x48295a
push 0x5966a0
mov ecx, 0x9ca
call fcn.0041c9e0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x10]
push eax
call esi
mov ecx, dword [0x594098]
add esp, 0x10
push ecx
mov ecx, dword [0x5a1b18]
lea edx, [esp + 8]
call fcn.004fb730
push 0x5966a0
push 0x575690
jmp 0x482995
mov ecx, 0x9cb
call fcn.0041c9e0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0xc]
push eax
call esi
mov ecx, dword [0x594098]
add esp, 0xc
push ecx
mov ecx, dword [0x5a1b18]
lea edx, [esp + 8]
call fcn.004fb730
push 0x596708
push 0x578730
lea edx, [esp + 0xc]
push edx
call esi
mov edx, dword [0x594094]
mov ecx, dword [0x5a1b18]
add esp, 0xc
call fcn.004fb620
mov edx, 0x64
mov ecx, 0x5966a0
call fcn.0041e210
mov edx, 0x64
mov ecx, 0x596708
call fcn.0041e210
mov edx, 0x3e7
mov ecx, 0x596b78
call fcn.0041e210
mov eax, dword [0x5a1b00]
mov ecx, dword [0x589a24]
push 0x21
push 0x8024
push eax
push ecx
mov dword [0x596f60], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x482a08
sub eax, edx
push 0
mov esi, eax
mov eax, dword [0x589a24]
push esi
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
pop esi
je 0x482a3f
mov ecx, 0x9cc
xor edx, edx
call fcn.0041c9e0
mov ecx, eax
call fcn.00482720
add esp, 0x104
ret
Function at 0x482a50
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [0x59676c]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x482a74
mov ecx, 0x574b10
call fcn.00482720
pop ebx
add esp, 0x10c
ret
mov edx, dword [0x589a24]
push 1
push 1
mov ecx, 0x8024
call fcn.0053f9b0
test eax, eax
jne 0x482c45
push ebp
push esi
push edi
mov eax, dword [0x596f64]
inc eax
cmp eax, 0x14
mov dword [0x596f64], eax
jl 0x482ac4
mov edx, dword [0x589a24]
push ebx
push 1
mov ecx, 0x8024
mov dword [0x596f64], ebx
call fcn.0053f9b0
test eax, eax
jne 0x482c42
mov ecx, dword [0x589a24]
push ebx
push 0x103
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x482bea
cmp edi, ebx
jle 0x482c07
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x18], bl
mov dword [esp + 0x10], ebp
jle 0x482a93
mov edx, dword [0x596f60]
jmp 0x482b10
cmp edx, 0x3b5
jae 0x482ba0
mov al, byte [esp + ebp + 0x18]
cmp al, 0xd
je 0x482bd8
cmp al, 0xa
jne 0x482b4b
cmp edx, ebx
jne 0x482b3c
mov byte [0x596b78], 0x20
mov edx, 1
mov byte [edx + 0x596b78], bl
mov edx, dword [0x59409c]
push edx
jmp 0x482bbc
cmp al, 9
jne 0x482b91
xor esi, esi
cmp edx, ebx
jl 0x482b5e
lea esi, [edx + 8]
shr esi, 3
shl esi, 3
sub esi, edx
cmp esi, ebx
jle 0x482bd8
mov ecx, esi
mov ebp, ecx
shr ecx, 2
lea edi, [edx + 0x596b78]
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, ebp
mov ebp, dword [esp + 0x10]
and ecx, 3
add edx, esi
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
mov dword [0x596f60], edx
jmp 0x482bd8
mov byte [edx + 0x596b78], al
inc edx
mov dword [0x596f60], edx
jmp 0x482bd8
cmp edx, ebx
jne 0x482bb0
mov byte [0x596b78], 0x20
mov edx, 1
mov eax, dword [0x59409c]
mov byte [edx + 0x596b78], bl
push eax
mov ecx, dword [0x5a1b18]
mov edx, 0x596b78
mov dword [0x596f60], ebx
call fcn.004fb730
mov edx, dword [0x596f60]
inc ebp
cmp ebp, edi
mov dword [esp + 0x10], ebp
jl 0x482b10
jmp 0x482a93
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x482c42
xor edx, edx
mov ecx, 0x9cd
call fcn.0041c9e0
mov ecx, eax
jmp 0x482c0c
mov ecx, 0x574b10
call fcn.00482720
mov edx, dword [0x594094]
mov ecx, dword [0x5a1b18]
call fcn.004fb620
mov ecx, dword [0x594098]
push ecx
xor edx, edx
mov ecx, 0x9ce
call fcn.0041c9e0
mov ecx, dword [0x5a1b18]
mov edx, eax
call fcn.004fb730
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x482c50
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
push edi
call fcn.004dbff0
mov edi, eax
test edi, edi
je 0x482cf3
push 0x596708
mov edx, 0x104
lea ecx, [esp + 0xc]
call fcn.0041e120
lea eax, [esp + 8]
push 0x20
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x482c8f
mov byte [eax], 0
push esi
lea ecx, [esp + 0xc]
push 0x40
push ecx
call fcn.00563730
mov esi, eax
add esp, 8
test esi, esi
mov ecx, 0x5966a0
je 0x482cd2
lea edx, [esp + 0xc]
push edx
mov edx, 0x64
mov byte [esi], 0
call fcn.0041e120
mov byte [esi], 0x40
inc esi
push esi
mov edx, 0x64
mov ecx, 0x596708
call fcn.0041e120
jmp 0x482cdc
mov edx, 0x64
call fcn.0041e210
mov edx, 0xf
lea ecx, [esp + 0xc]
call fcn.00518d60
mov al, byte [esp + 0xc]
test al, al
pop esi
jne 0x482d04
xor ecx, ecx
call fcn.0041c8e0
xor eax, eax
pop edi
add esp, 0x108
ret
push 0
push 0x598350
push 0
mov edx, 0x574d20
mov ecx, str.finger
call fcn.004ac870
push 0
push 1
lea edx, [esp + 0x10]
mov ecx, eax
mov dword [esp + 0xc], eax
call fcn.004c2f40
test eax, eax
je 0x482d4f
push 0x598350
push 0x14
push 0x574d20
mov edx, str.finger
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.004aca10
lea ecx, [esp + 4]
call fcn.004c29d0
mov ecx, dword [0x5a1b18]
test ecx, ecx
je 0x482deb
mov edx, dword [0x594094]
call fcn.004fb620
mov dword [0x59676c], 1
call fcn.00525650
push 0x596708
xor edx, edx
mov ecx, 0x9c5
call fcn.0041c9e0
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x594098]
mov ecx, dword [0x5a1b18]
add esp, 0xc
push edx
lea edx, [esp + 0xc]
call fcn.004fb730
push 0x596708
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x482e4e
push eax
xor edx, edx
xor ecx, ecx
mov dword [0x596770], 0
call fcn.004827e0
mov eax, 1
pop edi
add esp, 0x108
ret
mov eax, dword [str.Finger_Window]
mov ecx, dword [0x57873c]
mov edx, dword [0x578740]
push edi
mov dword [esp + 0xc], eax
mov ax, word [0x578744]
push 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
push 0
mov edx, 5
lea ecx, [esp + 0x14]
mov word [esp + 0x20], ax
call fcn.0053c810
test eax, eax
mov dword [0x5a1b18], eax
jne 0x482d71
xor ecx, ecx
call fcn.0041c8e0
mov ecx, 0x574b10
call fcn.00482720
xor eax, eax
pop edi
add esp, 0x108
ret
mov edx, 0x400
mov ecx, 0x596778
call fcn.0041e210
mov eax, dword [0x5a1b00]
push 0x400
push 0x596778
push 0x596708
push 0x8022
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [0x596770], eax
jne 0x482dde
xor edx, edx
mov ecx, 0x9c7
call fcn.0041c9e0
mov ecx, eax
call fcn.00482720
xor eax, eax
pop edi
add esp, 0x108
ret
Function at 0x483450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x596f68]
test eax, eax
mov edx, ecx
mov ecx, dword [0x5a1b00]
je 0x483468
xor ecx, ecx
jmp fcn.0041c8e0
mov eax, dword [0x59676c]
test eax, eax
mov dword [0x596f68], 1
je 0x4834b8
mov eax, dword [0x5a1b18]
test eax, eax
je 0x4834a3
mov eax, dword [0x594090]
push eax
xor edx, edx
mov ecx, 0x2f3
call fcn.0041c9e0
mov ecx, dword [0x5a1b18]
mov edx, eax
call fcn.004fb730
mov ecx, 0x574b10
call fcn.00482720
mov dword [0x596f68], 0
ret
mov eax, dword [0x5a1b0c]
test eax, eax
mov dword [0x599094], edx
je 0x4834e2
cmp eax, dword [0x5a1b18]
jne 0x4834db
mov dword [0x599094], 2
jmp 0x4834e0
cmp edx, 2
jne 0x4834e2
mov ecx, eax
push 0
push 0x483060
mov edx, 0x1b8
call fcn.00464b70
mov dword [0x599094], 0
mov dword [0x596f68], 0
ret

Function at 0x4835c0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x589a2c], 0xffffffff
mov dword [0x589a28], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x589a28], eax
je 0x48360c
mov edx, 0x4f
mov ecx, eax
call fcn.004fd2b0
test eax, eax
je 0x48360c
mov eax, dword [0x589a28]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x483613
xor ecx, ecx
jmp fcn.00483510
mov ecx, dword [0x5a1b00]
mov edx, dword [0x589a28]
push 8
push 0x802e
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x483be0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov eax, ecx
shr eax, 0x10
test eax, eax
push esi
push edi
jne 0x483e1f
cmp cx, 0x20
je 0x483e1f
mov edx, dword [0x589a2c]
cmp edx, 0xffffffff
je 0x483e1f
cmp dword [0x589a28], 0xffffffff
je 0x483e1f
push 1
push 2
mov ecx, 0x8030
call fcn.0053f9b0
test eax, eax
jne 0x483e2d
mov ebp, dword [sym.imp.WSOCK32.dll_send]
xor ebx, ebx
mov eax, dword [0x5974d0]
inc eax
cmp eax, 0x14
mov dword [0x5974d0], eax
jl 0x483c66
mov edx, dword [0x589a2c]
push ebx
push 2
mov ecx, 0x8030
mov dword [0x5974d0], ebx
call fcn.0053f9b0
test eax, eax
jne 0x483e2d
cmp byte [0x5970e8], bl
jne 0x483d96
mov ecx, dword [0x59707c]
push ecx
push 0x3e7
push 0x5970e8
call fcn.00563d13
add esp, 0xc
test eax, eax
je 0x483e1f
mov ecx, 0x5970e8
call fcn.004ac820
test eax, eax
jne 0x483e1f
mov ecx, 0x5970e8
call fcn.004836d0
test eax, eax
je 0x483dfe
push 0xa
push 0x5970e8
call fcn.00563730
add esp, 8
test eax, eax
jne 0x483ce2
mov edi, 0x5970e8
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x483cd0
mov dx, word [0x575404]
mov word [edi], dx
push 0x575404
push 0x5970e8
call fcn.00572b46
add esp, 8
test eax, eax
jne 0x483d96
mov eax, dword [0x59707c]
push eax
call fcn.005654bf
mov ecx, dword [0x59707c]
push ecx
push 0x3e7
push 0x5970e8
mov edi, eax
mov esi, 1
call fcn.00563d13
add esp, 0x10
test eax, eax
je 0x483d75
jmp 0x483d30
mov ecx, 0x5970e8
call fcn.004ac820
test eax, eax
jne 0x483d75
push 0x575404
push 0x5970e8
call fcn.00572b46
add esp, 8
test eax, eax
jne 0x483d73
mov edx, dword [0x59707c]
push edx
push 0x3e7
push 0x5970e8
call fcn.00563d13
add esp, 0xc
test eax, eax
jne 0x483d30
jmp 0x483d75
xor esi, esi
mov eax, dword [0x59707c]
push ebx
push edi
push eax
call fcn.00564a23
add esp, 0xc
cmp esi, ebx
jne 0x483dfe
mov byte [0x5970e8], 0xa
mov byte [0x5970e9], bl
mov eax, 0x5970e8
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x483da0
sub eax, edx
mov esi, eax
mov eax, 0x5970e8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x483db3
mov ecx, dword [0x589a2c]
push ebx
sub eax, edx
push eax
push 0x5970e8
push ecx
call ebp
cmp eax, 0xffffffff
je 0x483e12
cmp eax, esi
jge 0x483dfe
lea edx, [eax + 0x5970e8]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x483de0
sub eax, esi
inc eax
push eax
push edx
push 0x5970e8
call fcn.005641d0
add esp, 0xc
jmp 0x483c35
mov edx, 0x3e7
mov ecx, 0x5970e8
call fcn.0041e210
jmp 0x483c35
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x483e2d
pop edi
pop esi
pop ebp
mov ecx, 2
pop ebx
jmp fcn.00483510
pop edi
pop esi
pop ebp
pop ebx
ret