joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a5ed
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 3], cl
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48a783
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004050b8
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 8], eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
and eax, dword [ebp - 8]
je 0x48a739
lea eax, [ebp - 0xb8]
mov edx, ebx
add dl, 0x41
call fcn.004052a0
mov edx, dword [ebp - 0xb8]
lea eax, [ebp - 0xc]
mov ecx, 0x48a79c
call fcn.004053c4
mov eax, dword [ebp - 0xc]
call fcn.00405578
push eax
call sub.kernel32.dll_GetDriveTypeA
mov edi, eax
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00405380
cmp byte [ebp - 1], 0
je 0x48a65b
mov eax, edi
cmp eax, 6
ja case.default.0x48a5ca
jmp dword [eax*4 + 0x48a5d1]
mov eax, esi
mov edx, 0x48a7a8
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7c0
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7d8
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7ec
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a800
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a814
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a828
call fcn.00405380
jmp 0x48a65b
mov eax, esi
mov edx, 0x48a7a8
call fcn.00405380
mov al, byte [ebp - 3]
or al, byte [ebp - 2]
je 0x48a72d
test edi, edi
je 0x48a72d
cmp edi, 2
je 0x48a72d
push 0x50
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x50
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xbc]
mov edx, ebx
add dl, 0x41
call fcn.004052a0
lea eax, [ebp - 0xbc]
mov edx, 0x48a79c
call fcn.00405380
mov eax, dword [ebp - 0xbc]
call fcn.00405578
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48a72d
cmp byte [ebp - 2], 0
je 0x48a6f6
push dword [esi]
push 0x48a83c
lea eax, [ebp - 0xc0]
lea edx, [ebp - 0xb4]
call fcn.004052b0
push dword [ebp - 0xc0]
mov eax, esi
mov edx, 3
call fcn.00405438
cmp byte [ebp - 3], 0
je 0x48a72d
push dword [esi]
push 0x48a83c
push 0x48a848
lea eax, [ebp - 0xc4]
lea edx, [ebp - 0x64]
call fcn.004052b0
push dword [ebp - 0xc4]
push 0x48a854
mov eax, esi
mov edx, 5
call fcn.00405438
mov eax, esi
mov edx, 0x48a860
call fcn.00405380
inc ebx
cmp ebx, 0x20
jne 0x48a566
lea edx, [ebp - 0xc8]
mov eax, dword [esi]
call fcn.00409aa8
mov edx, dword [ebp - 0xc8]
mov eax, esi
call fcn.0040510c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a78a
lea eax, [ebp - 0xc8]
mov edx, 5
call fcn.004050dc
lea eax, [ebp - 0xc]
call fcn.004050b8
ret
Function at 0x48bcc4
Capabilities:
Connect network resource

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x20
call fcn.004037dc
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], ebx
push 0
push esi
push edi
lea eax, [esp + 0xc]
push eax
call sub.mpr.dll_WNetAddConnection2A
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x48bd9c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff978
push ebx
xor ebx, ebx
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x684], ebx
mov dword [ebp - 0x680], ebx
mov dword [ebp - 0x67c], ebx
mov dword [ebp - 0x678], ebx
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x658], ebx
mov ebx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x48c44e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x18], 0
je 0x48be13
mov eax, dword [ebp - 0x18]
call fcn.00405578
mov dword [ebp - 0x50], eax
jmp 0x48be41
lea eax, [ebp - 0x654]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x654], 0x5c
mov byte [ebp - 0x653], 0x5c
mov dword [ebp - 0x24], 0xfe
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x652]
push eax
call sub.kernel32.dll_GetComputerNameA
test ebx, ebx
je 0x48be60
mov eax, dword [ebp + 8]
call fcn.00405578
push eax
mov eax, ebx
call fcn.00405578
mov edx, eax
mov eax, dword [ebp - 0x50]
pop ecx
call fcn.0048bcc4
push 0x4df524
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x48bf12
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4dbf48], 0
je 0x48befa
cmp dword [0x4dbf4c], 0
je 0x48befa
lea edx, [ebp - 0x658]
mov eax, dword [ebp - 0x18]
call fcn.0040984c
mov edx, dword [ebp - 0x658]
mov eax, dword [0x4dbf58]
call fcn.004054c4
jne 0x48befa
push 0
mov cx, 2
xor edx, edx
xor eax, eax
call fcn.0040bc9c
fstp qword [ebp - 0x660]
wait
call fcn.0040c0bc
fsub qword [0x4dbf50]
fabs
fcomp qword [ebp - 0x660]
fnstsw ax
sahf
jae 0x48befa
mov byte [ebp - 0x1d], 1
cmp dword [ebp - 0x1c], 0
je 0x48bef0
mov edx, dword [0x4dbf4c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.00404af4
jmp 0x48c41a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bf19
push 0x4df524
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c455
lea eax, [ebp - 0x688]
mov edx, 5
call fcn.004050dc
lea eax, [ebp - 0x664]
call fcn.004050b8
lea eax, [ebp - 0x658]
call fcn.004050b8
ret

Function at 0x48c674
Capabilities:
Connect network resource

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x20
call fcn.004037dc
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], ebx
push 0
push esi
push edi
lea eax, [esp + 0xc]
push eax
call sub.mpr.dll_WNetAddConnection2A
add esp, 0x20
pop edi
pop esi
pop ebx
ret
Function at 0x493180
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
test dl, dl
je 0x493193
add esp, 0xfffffff0
call fcn.004045e0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421d08
lea eax, [ebx + 0x34]
mov edx, 0x493244
call fcn.0040510c
lea eax, [ebx + 0x3c]
call fcn.004050b8
mov dl, 1
mov eax, dword [0x41941c]
call fcn.00404278
mov dword [ebx + 0x50], eax
mov eax, 0x40
mov dword [ebx + 0x54], eax
mov edx, eax
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov dl, 1
mov eax, dword [0x492fb4]
call fcn.0049439c
mov dword [ebx + 0x60], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebx + 0x6c]
call fcn.00405704
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00405578
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, dword [ebx + 0x6c]
call fcn.00405578
mov edx, eax
lea eax, [ebx + 0x6c]
call fcn.004052b0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x493234
call fcn.00404638
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4935cc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405568
xor eax, eax
push ebp
push 0x493779
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004050b8
mov edx, dword [ebp - 4]
mov eax, 0x493790
call fcn.004056bc
test eax, eax
je 0x493635
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x493790
call fcn.004056bc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004055d8
push 0x104
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00405328
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x68]
call fcn.004054c4
je 0x4936c3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x64]
test eax, eax
je 0x493691
mov edx, dword [ebp + 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
push 2
push 0
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x64], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x68
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00405328
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x64], 0
je 0x493758
xor eax, eax
push ebp
push 0x493751
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x64]
push eax
push 0xb00
call sub.kernel32.dll_FormatMessageA
test eax, eax
jbe 0x493743
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004052b0
mov edx, dword [ebx]
mov eax, 0x49379c
call fcn.004056bc
test eax, eax
jle 0x49373a
push ebx
mov edx, dword [ebx]
mov eax, 0x49379c
call fcn.004056bc
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.004055d8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493758
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493780
lea eax, [ebp - 0x114]
call fcn.004050b8
lea eax, [ebp - 4]
call fcn.004050b8
ret
Function at 0x494a0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ecx, eax
xor eax, eax
push ebp
push 0x494aa1
push dword fs:[eax]
mov dword fs:[eax], esp
test ecx, ecx
setl byte [ebp - 1]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
cmp byte [ebp - 1], 0
je 0x494a44
dec ebx
not ebx
mov eax, esi
call fcn.004050b8
mov edi, ebx
and edi, 0xff
shr ebx, 8
lea eax, [ebp - 8]
mov edx, edi
call fcn.004052a0
mov edx, dword [ebp - 8]
mov ecx, dword [esi]
mov eax, esi
call fcn.004053c4
test ebx, ebx
jne 0x494a4b
cmp byte [ebp - 1], 0
jne 0x494a8b
mov eax, dword [esi]
cmp byte [eax], 0x7f
jbe 0x494a8b
mov ecx, dword [esi]
mov eax, esi
mov edx, 0x494ab8
call fcn.004053c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494aa8
lea eax, [ebp - 8]
call fcn.004050b8
ret

Function at 0x4953a0
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x4953b3
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x4953c2
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret
Function at 0x495ec8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405568
mov eax, dword [ebp - 8]
call fcn.00405568
xor eax, eax
push ebp
push 0x49602c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405378
cmp eax, 0x40
jle 0x495f34
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 8]
call fcn.00495e98
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 8]
call fcn.00405150
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.00405768
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.00405768
mov eax, dword [ebp - 8]
call fcn.00405378
mov esi, eax
test esi, esi
jle 0x495f9d
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.004055d0
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.004055d0
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x495f65
lea eax, [ebp - 0xac]
call fcn.004953a0
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0xc]
call fcn.00495bf0
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 4]
call fcn.00495bf0
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xac]
call fcn.00495d1c
lea eax, [ebp - 0xac]
call fcn.004953a0
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x10]
call fcn.00495bf0
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x14]
call fcn.00495bf0
mov edx, edi
lea eax, [ebp - 0xac]
call fcn.00495d1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496033
lea eax, [ebp - 0xb0]
call fcn.004050b8
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004050dc
ret
Function at 0x4965fc
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405568
mov eax, dword [ebp - 8]
call fcn.00405568
xor eax, eax
push ebp
push 0x496760
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405378
cmp eax, 0x40
jle 0x496668
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 8]
call fcn.004965d4
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 8]
call fcn.00405150
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.00405768
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.00405768
mov eax, dword [ebp - 8]
call fcn.00405378
mov esi, eax
test esi, esi
jle 0x4966d1
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.004055d0
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.004055d0
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x496699
lea eax, [ebp - 0x88]
call fcn.004960fc
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0xc]
call fcn.00496430
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 4]
call fcn.00496430
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x88]
call fcn.004964c8
lea eax, [ebp - 0x88]
call fcn.004960fc
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0x10]
call fcn.00496430
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0x14]
call fcn.00496430
mov edx, edi
lea eax, [ebp - 0x88]
call fcn.004964c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496767
lea eax, [ebp - 0x8c]
call fcn.004050b8
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004050dc
ret
Function at 0x498d8c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x19c], ebx
test dl, dl
je 0x498dbd
add esp, 0xfffffff0
call fcn.004045e0
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x498ee3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00421d08
xor eax, eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], 3
mov dword [ebx + 0x44c], 0xffffffff
mov byte [ebx + 0x450], 0
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov esi, eax
mov dword [ebx + 0x454], esi
test esi, esi
jne 0x498ebc
mov byte [ebx + 0x450], 1
lea edx, [ebp - 0x198]
mov ax, word [ebp - 0x194]
shr ax, 8
movzx eax, ax
call fcn.00409d50
push dword [ebp - 0x198]
push 0x498f14
lea edx, [ebp - 0x19c]
mov ax, word [ebp - 0x194]
and ax, 0xff
movzx eax, ax
call fcn.00409d50
push dword [ebp - 0x19c]
lea eax, [ebx + 0x30]
mov edx, 3
call fcn.00405438
lea edx, [ebp - 0x1a0]
lea eax, [ebp - 0x190]
call fcn.0040ae70
mov edx, dword [ebp - 0x1a0]
lea eax, [ebx + 0x34]
call fcn.0040510c
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x8f]
call fcn.0040ae70
mov edx, dword [ebp - 0x1a4]
lea eax, [ebx + 0x38]
call fcn.0040510c
movzx eax, word [ebp - 0xe]
mov dword [ebx + 0x3c], eax
movzx eax, word [ebp - 0xc]
mov dword [ebx + 0x40], eax
jmp 0x498ec5
mov edx, esi
mov eax, ebx
call fcn.00499218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498eea
lea eax, [ebp - 0x1a4]
mov edx, 4
call fcn.004050dc
ret
Function at 0x498f70
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405568
mov eax, dword [ebp - 8]
call fcn.00405568
xor eax, eax
push ebp
push 0x4990b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, edi
xor ecx, ecx
mov edx, 0x10
call fcn.004037dc
mov word [edi], 2
mov eax, dword [esi + 0x44]
push eax
call sub.wsock32.dll_getprotobynumber
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x498fe1
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, esi
call fcn.00499218
jmp 0x499091
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 8]
call fcn.00405578
push eax
call sub.wsock32.dll_getservbyname
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x499012
mov eax, dword [ebp - 8]
call fcn.00409ebc
push eax
call sub.wsock32.dll_htons
mov word [edi + 2], ax
jmp 0x499044
mov eax, dword [ebp - 0x10]
mov ax, word [eax + 8]
mov word [edi + 2], ax
lea edx, [ebp - 0x18]
movzx eax, word [edi + 2]
call fcn.00409d50
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004054c4
jne 0x499044
mov ax, word [edi + 2]
push eax
call sub.wsock32.dll_htons
mov word [edi + 2], ax
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
call sub.wsock32.dll_inet_addr
mov dword [edi + 4], eax
cmp dword [edi + 4], 0xffffffff
jne 0x49908f
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x499082
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, esi
call fcn.00499218
jmp 0x499091
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [edi + 4], eax
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4990bb
lea eax, [ebp - 0x18]
call fcn.004050b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050dc
ret

Function at 0x499168
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.00405568
xor eax, eax
push ebp
push 0x499205
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
je 0x4991ef
xor edi, edi
xor ebx, ebx
mov eax, dword [ebp + 8]
call fcn.00405378
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
sub eax, ebx
push eax
lea eax, [ebp + 8]
call fcn.004055d0
add eax, ebx
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x4991e4
inc edi
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4991e6
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00499218
jmp 0x4991ef
add ebx, eax
cmp esi, ebx
jle 0x4991ef
cmp edi, 0x64
jle 0x4991a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49920c
lea eax, [ebp + 8]
call fcn.004050b8
ret
Function at 0x499f44
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov ebx, eax
cmp byte [ebx + 0x450], 1
jne 0x49a01f
push esp
mov ecx, dword [ebx + 0x468]
mov edx, dword [ebx + 0x464]
mov eax, ebx
call fcn.00498f70
test al, al
je 0x49a01f
push 0
mov eax, dword [ebx + 0x48]
push eax
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x44c], esi
inc esi
jne 0x499f9f
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, ebx
call fcn.00499218
jmp 0x49a01f
push 1
push 0x401
mov eax, dword [ebx + 0x460]
push eax
mov eax, dword [ebx + 0x44c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
test eax, eax
je 0x499fd9
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, ebx
call fcn.00499218
mov eax, dword [ebx + 0x44c]
push eax
call sub.wsock32.dll_closesocket
jmp 0x49a01f
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x44c]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x49a018
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x49a018
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, ebx
call fcn.00499218
mov eax, dword [ebx + 0x44c]
push eax
call sub.wsock32.dll_closesocket
jmp 0x49a01f
mov byte [ebx + 0x450], 4
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x49ff6c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov edi, 0x4dc0a0
xor eax, eax
push ebp
push 0x4a0197
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x49ffa1
push 0x4a01a8
call sub.kernel32.dll_LoadLibraryA
mov dword [edi], eax
cmp dword [edi], 0
je 0x4a013c
push 0x4a01b8
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfa90], eax
push 0x4a01c0
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfa94], eax
push 0x4a01c8
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfa98], eax
push 0x4a01d0
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfa9c], eax
push 0x4a01d8
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov dword [0x4dfaa0], esi
test esi, esi
jne 0x4a001d
push 0x4a01e4
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfaa0], eax
push 0x4a01f0
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfaa4], eax
push 0x4a01f8
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfaa8], eax
push 0x4a0200
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfaac], eax
push 0x4a020c
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfab0], eax
push 0x4a0218
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfab4], eax
cmp dword [0x4dfa90], 0
je 0x4a0124
cmp dword [0x4dfa94], 0
je 0x4a0124
cmp dword [0x4dfa98], 0
je 0x4a0124
cmp dword [0x4dfa9c], 0
je 0x4a0124
cmp dword [0x4dfaa0], 0
je 0x4a0124
cmp dword [0x4dfaa4], 0
je 0x4a0124
cmp dword [0x4dfaa8], 0
je 0x4a0124
cmp dword [0x4dfaac], 0
je 0x4a0124
cmp dword [0x4dfab0], 0
je 0x4a0124
cmp dword [0x4dfab4], 0
je 0x4a0124
mov bl, 1
call dword [0x4dfa94]
dec eax
jne 0x4a0100
push 0x49ff4c
call dword [0x4dfab0]
push 0x49fef4
call dword [0x4dfaac]
jmp 0x4a017c
mov eax, dword [edi]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [edi], eax
mov ecx, 0x4a022c
mov dl, 1
mov eax, dword [0x408b20]
call fcn.0040df48
call fcn.00404a48
jmp 0x4a017c
mov ecx, 0x4a0244
mov dl, 1
mov eax, dword [0x408b20]
call fcn.0040df48
call fcn.00404a48
jmp 0x4a017c
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, 0xf67c
call fcn.0040a24c
mov eax, dword [ebp - 8]
push eax
mov eax, 0x4a026c
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
pop eax
call fcn.0040b388
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x408b20]
call fcn.0040df48
call fcn.00404a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a019e
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050dc
ret