joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ae3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
or edx, 0x6aee
pop edx
push edi
push eax
add esp, 4
or edi, 0x82a9
sub edi, 0xb323
pop edi
push eax
add eax, 0x9bef
sub eax, 0x7132
xor eax, 0xe67
pop eax
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push esi
or esi, 0x1a36
pop esi
push eax
push ebx
add esp, 4
call 0x44adeb
add byte [edx], dh
inc ecx
inc ebp
dec esi
push eax
dec esi
cmp dword [ebx], esi
dec eax
add esp, 4
sub eax, 0x184a0
and eax, 0xf16e
add eax, 0x11e0e
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x44ae1e
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x44ae78
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x44ad46
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x44ad46
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x44ae62
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x44ae6c
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x44aec1
push edx
push ecx
add esp, 4
xor edx, 0xfe6d
sub edx, 0x6903
xor edx, 0x13da4
and edx, 0x6f2e
pop edx
push ebx
xor ebx, 0x14768
add ebx, 0x8b33
jmp 0x44aeb2
pop ebx
invalid
Function at 0x464ce7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
push ebx
push esi
push edi
lea ecx, [ebp - 8]
mov edi, eax
call fcn.0048ea4a
mov byte [ebp - 1], 1
mov dword [0x54b024], 0x682f
call fcn.00463f71
mov esi, 0x104
push esi
lea eax, [ebp - 0x438]
push eax
push dword [0x548878]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
xor ebx, ebx
mov ecx, edi
cmp edi, ebx
jne 0x464d37
lea ecx, [ebp - 0x438]
push 6
lea edx, [ebp - 0x14]
call fcn.0046bf38
push ebx
push ebx
push ebx
push ebx
push 0x54b9b4
push esi
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
cmp dword [ebp + 8], ebx
jne 0x464d80
cmp edi, ebx
jne 0x464d80
cmp byte [0x54afdc], bl
jne 0x464d88
mov bl, 1
lea ecx, [ebp - 8]
call fcn.00446401
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0xc
cmp byte [0x54afdc], bl
je 0x464db3
mov edx, esi
lea ecx, [ebp - 0x230]
call fcn.004a4126
lea edi, [ebp - 0x230]
push 0x207
mov edx, edi
mov ecx, 0x5497a8
call fcn.0042260d
or dword [ebp + 8], 0x800
cmp dword [ebp + 8], 0xffffffff
je 0x464e6f
cmp dword [0x5484dc], ebx
je 0x464e02
push 0x14
pop edx
lea ecx, [ebp - 0x28]
call fcn.004a1f9d
push 0x29
pop ecx
call fcn.0046b3f1
lea ecx, [ebp - 0x28]
push ecx
push 0x29
pop edx
mov ecx, eax
mov dword [0x5484e0], eax
call fcn.00422537
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
mov edx, 0x502cc8
lea ecx, [ebp - 0x28]
call fcn.0044b549
call fcn.00489dd0
lea eax, [ebp - 1]
push eax
push dword [0x5484dc]
mov edx, edi
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.004640c4
test al, al
jne 0x464e23
test byte [ebp + 8], 0x80
je 0x464e74
cmp byte [ebp - 1], bl
je 0x464d6f
push dword [ebp + 8]
push str.INSTALLDEBUG:_InstallEverything_succeeded__flags___d__n
call fcn.004448e5
mov ecx, dword [ebp + 8]
mov eax, 0x400
and ecx, eax
add esp, 8
cmp ecx, eax
sete al
test byte [ebp + 8], 0x80
mov byte [0x54b1a5], al
jne 0x464e6f
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.00464af4
test al, al
je 0x464e74
test byte [ebp + 8], 0x40
jne 0x464e6f
call fcn.0042efe0
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
mov bl, byte [ebp - 1]
jmp 0x464d6f

Function at 0x4663ac
Capabilities:
Reference l3 dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
mov ebx, edx
cmp cl, 2
jne 0x4663ec
test byte [0x548844], 1
jne 0x4663dd
or dword [0x548844], 1
push str.4.2.2.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x548840], eax
push ebx
push dword [0x548840]
call dword [0x548818]
jmp 0x466439
cmp dword [0x54881c], 0
jne 0x4663fc
mov eax, 0x2741
jmp 0x466439
test byte [0x548844], 2
push esi
mov esi, 0x54882c
jne 0x466420
or dword [0x548844], 2
push 0
mov edx, str.2001:db8::1428:57ab
mov ecx, esi
call fcn.0048b0df
push 0
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.00466321
push ebx
lea eax, [ebp - 0x80]
push eax
call dword [0x54881c]
pop esi
pop ebx
leave
ret
Function at 0x46643c
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push edi
mov edi, ecx
mov bl, dl
mov dword [ebp - 4], edi
call fcn.00465fa9
test al, al
je 0x46648d
lea edx, [ebp - 8]
mov cl, bl
call fcn.004663ac
test eax, eax
jne 0x46648d
push dword [ebp - 8]
mov dl, bl
lea ecx, [ebp - 0x1c]
call fcn.00466155
lea ecx, [ebp - 0x1c]
call fcn.00408e34
test al, al
jne 0x46648d
mov eax, dword [ebp - 4]
push esi
push 5
pop ecx
lea esi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4664ea
cmp bl, 2
jne 0x4664e1
push 0x100
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4664e1
cmp word [eax + 8], 2
jne 0x4664e1
cmp word [eax + 0xa], 4
jne 0x4664e1
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x4664e1
mov eax, dword [eax]
push 0
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, edi
call fcn.0048adff
jmp 0x4664e8
mov ecx, edi
call fcn.0048adc4
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x4676ee
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
mov edi, ecx
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebx
je 0x4677fb
push esi
cmp eax, 0xffffffff
je 0x4677e5
mov eax, dword [ebp - 0x1c]
cmp eax, 0x8012
je 0x4677fa
cmp dword [edi + 0xc], ebx
je 0x46779e
lea ecx, [eax - 0x100]
cmp ecx, 9
ja 0x46779e
cmp byte [edi + 8], bl
jne 0x4677e5
mov esi, 0x100
cmp eax, esi
jne 0x467762
push dword [ebp - 0x20]
mov ecx, dword [edi + 0xc]
push dword [ebp - 0x18]
mov eax, dword [ecx]
push 0xfffffffffffffffd
pop edx
call dword [eax + 0x18]
test eax, eax
jne 0x4677e5
lea eax, [ebp - 4]
push eax
push 0x4676af
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 4], ebx
jne 0x46779e
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 0x10]
jne 0x46778f
cmp dword [ebp - 0x1c], esi
jne 0x46779e
cmp dword [ebp - 0x18], 9
jne 0x4677d1
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x4677e5
cmp dword [ebp - 0x1c], 0x20a
jne 0x4677d1
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, eax
cmp esi, ebx
je 0x4677d1
cmp esi, dword [ebp - 0x20]
je 0x4677d1
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x548890]
jne 0x4677d1
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebx
jne 0x467710
pop esi
mov eax, dword [ebp - 0x18]
pop edi
pop ebx
leave
ret

Function at 0x468c29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
movzx eax, dx
push 5
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x468ca6
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x468c82
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
push ebx
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x468c86
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
xor eax, eax
jmp 0x468ca5
push esi
push dword [ebp - 4]
push ebx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x468ca3
mov dword [eax], esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46b98b
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0
push 2
push 2
mov esi, ecx
call fcn.004707ce
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x46b9c5
mov ebx, dword [esi]
push 0
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, esi
call dword [ebx + 0xc]
xor al, al
jmp 0x46baa5
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
push eax
mov dword [ebp - 4], edi
call ebx
test eax, eax
jne 0x46b9be
push 0x1a73
push eax
lea ecx, [ebp - 0x24]
call fcn.0048adff
push eax
mov ecx, esi
call fcn.0046eb5e
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
push str.239.192.0.0
call edi
push str.0.0.0.0
mov dword [ebp - 0x10], eax
call edi
push 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0xc
push 0
push dword [esi + 4]
call ebx
test eax, eax
jne 0x46b9be
mov byte [ebp - 8], al
lea edi, [ebp - 7]
stosw word es:[edi], ax
push 4
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
push 9
push 0
push dword [esi + 4]
call ebx
test eax, eax
jne 0x46b9be
push 4
lea eax, [ebp - 4]
push eax
push 0xb
push 0
push dword [esi + 4]
mov dword [ebp - 4], 1
call ebx
test eax, eax
jne 0x46b9be
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push dword [esi + 4]
mov edi, 0xff
mov dword [ebp - 4], edi
call ebx
test eax, eax
jne 0x46b9be
push 4
lea eax, [ebp - 4]
push eax
push 0xa
push 0
push dword [esi + 4]
mov dword [ebp - 4], edi
call ebx
test eax, eax
jne 0x46b9be
mov ecx, esi
call fcn.0046f22d
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46bab4
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
movzx edi, word [esi + 0x10]
call fcn.0048e964
push eax
movzx eax, di
push eax
push str.BT_SEARCH__HTTP_1.1_r_nHost:_239.192.0.0:6771_r_nPort:__u_r_nInfohash:__s_r_n_r_n_r_n
lea eax, [ebp - 0x194]
push 0x100
push eax
call fcn.0048d4e6
add esp, 0x14
push 5
pop ecx
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x1a73
mov word [ebp - 4], ax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x95], 0
call fcn.00466321
lea eax, [ebp - 0x194]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46bb23
push dword [ebp + 8]
sub eax, ecx
lea ecx, [ebp - 0x94]
push ecx
push 0
push eax
lea eax, [ebp - 0x194]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
test eax, eax
pop edi
setg cl
pop esi
mov al, cl
pop ebx
leave
ret 8
Function at 0x46c146
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 1
push 0
push 2
push 2
mov esi, ecx
call fcn.004707ce
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [esi + 4]
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x46c181
xor al, al
jmp 0x46c1a5
push 0x14e7
call fcn.0046c0fb
push eax
lea ecx, [ebp - 0x18]
call fcn.0048adff
push eax
mov ecx, esi
call fcn.0046eb5e
mov ecx, esi
call fcn.0046f22d
mov al, 1
pop esi
leave
ret

Function at 0x46c1a8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x14], ax
mov eax, 0xe714
mov esi, ecx
mov byte [ebp - 4], 0
mov byte [ebp - 3], 0
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
test eax, eax
setg cl
pop edi
mov al, cl
pop esi
leave
ret 4

Function at 0x46c205
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dl, byte [ebp + 0xc]
push esi
push edi
push dword [ebp + 0x14]
mov esi, ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.0046c10a
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x1c], ax
mov eax, 0xe714
mov word [ebp - 0x1a], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xc
lea eax, [ebp - 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
test eax, eax
setg cl
pop edi
mov al, cl
pop esi
leave
ret 0x10
Function at 0x46c9b1
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push edi
mov ebx, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x46c9e4
or eax, eax
jmp 0x46ca90
mov ecx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00466321
call fcn.0046e5c1
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x46ca45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
je 0x46ca3d
cmp esi, 0x2734
je 0x46ca3d
push esi
push dword [0x5515bc]
mov ecx, ebx
call fcn.0046c90c
mov eax, esi
jmp 0x46ca8f
mov ecx, dword [ebp + 0xc]
call fcn.0046f4ee
call fcn.0046e5dd
push dword [ebp + 0x10]
mov ecx, ebx
push edi
call fcn.0046c80a
mov dword [ebp + 8], eax
call fcn.0046e5c1
cmp dword [ebp + 8], 0
je 0x46ca7f
mov esi, dword [0x5518e4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push esi
mov ecx, ebx
call fcn.0046c90c
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp + 0xc]
call fcn.0046ea94
call fcn.0046e5dd
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x46ca96
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
and dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x46caf9
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
call fcn.0046c788
test eax, eax
jne 0x46cafd
push eax
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x46cb0b
mov eax, dword [ebp + 0xc]
add dword [ebp - 8], eax
sub esi, eax
add ebx, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x46cb26
test eax, eax
je 0x46cb26
test esi, esi
jg 0x46cab5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
pop esi
pop ebx
leave
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
mov esi, eax
push esi
push dword [0x5515c0]
call fcn.0046c90c
mov eax, esi
jmp 0x46cb03
mov eax, ebx
jmp 0x46cb05
Function at 0x46cd44
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push esi
push edi
push 0
mov edi, ecx
push 0
lea ecx, [ebp - 0x28]
call fcn.0048adff
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x46cd78
push 0xfffffffffffffffe
pop eax
jmp 0x46cdf3
lea eax, [ebp - 0x28]
push eax
push esi
mov ecx, edi
call fcn.0046cd15
test eax, eax
je 0x46cd9c
push 0xa
push dword [0x5518a0]
mov ecx, edi
call fcn.0046c8ba
or eax, 0xffffffff
jmp 0x46cdf3
lea ecx, [ebp - 0x14]
call fcn.0048adc4
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0046cc65
test eax, eax
jne 0x46cdf3
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00466321
lea eax, [ebp - 0x14]
push eax
push 0x4f33e8
lea eax, [ebp - 0x38]
push 0x10
push eax
call fcn.0048d4e6
add esp, 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push dword [esi]
mov ecx, edi
call fcn.0046c9b1
pop edi
pop esi
leave
ret 0x10

Function at 0x46cdf9
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x46ce51
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
call fcn.0046c80a
test eax, eax
jne 0x46ce55
push eax
push eax
push eax
lea eax, [ebp + 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x46ce63
mov eax, dword [ebp + 0x10]
add dword [ebp - 8], eax
sub esi, eax
add ebx, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x46ce7e
test esi, esi
jg 0x46ce14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
pop esi
pop ebx
leave
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
mov esi, eax
push esi
push dword [0x5515c4]
call fcn.0046c90c
mov eax, esi
jmp 0x46ce5b
mov eax, ebx
jmp 0x46ce5d

Function at 0x46e3c3
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ecx + 4]
mov dword [ebp - 4], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x46e3f6
call fcn.0048adc4
jmp 0x46e402
lea eax, [ebp - 0x84]
push eax
call fcn.0048ae50
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x46e527
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 0x98
cmp eax, 0xffffffff
jne 0x46e53d
or eax, 0xffffffff
leave
ret
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x98]
push ecx
push eax
mov dword [ebp - 4], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x46e538
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.0048ae50
movzx eax, word [eax + 0x10]
leave
ret
Function at 0x46f258
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x46f34d
cmp byte [ebp + 8], 0
je 0x46f295
xor ecx, ecx
inc ecx
mov word [ebp + 8], cx
xor ecx, ecx
push 4
mov word [ebp + 0xa], cx
lea ecx, [ebp + 8]
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test byte [esi + 0xe], 0x20
je 0x46f31f
mov eax, dword [esi + 0x50]
push ebx
xor ebx, ebx
cmp eax, ebx
jge 0x46f2b0
neg eax
mov dword [ebp + 8], eax
jmp 0x46f2b3
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x64]
cmp eax, ebx
jge 0x46f2c1
neg eax
mov dword [ebp - 4], eax
jmp 0x46f2c4
mov dword [ebp - 4], ebx
cmp dword [esi + 0xc0], ebx
push edi
jle 0x46f2f0
lea edi, [esi + 0xac]
cmp dword [edi], 0
je 0x46f2e4
mov eax, dword [ebp + 8]
mov ecx, dword [edi]
cdq
add dword [ecx + 0x28], eax
adc dword [ecx + 0x2c], edx
inc ebx
add edi, 4
cmp ebx, dword [esi + 0xc0]
jl 0x46f2d3
xor ebx, ebx
cmp dword [esi + 0xc0], ebx
jle 0x46f31d
lea edi, [esi + 0xac]
cmp dword [edi], 0
je 0x46f311
mov eax, dword [ebp - 4]
mov ecx, dword [edi]
cdq
add dword [ecx + 0x30], eax
adc dword [ecx + 0x34], edx
inc ebx
add edi, 4
cmp ebx, dword [esi + 0xc0]
jl 0x46f300
pop edi
pop ebx
mov ecx, dword [esi + 4]
call fcn.0046e4d8
or dword [esi + 4], 0xffffffff
test byte [esi + 0xe], 0x20
je 0x46f34d
cmp byte [esi + 0x18], 6
jb 0x46f34d
push 2
push 0x40
mov ecx, esi
call fcn.0046e04b
push 2
push 0x40
mov ecx, esi
call fcn.0046e02c
and byte [esi + 0xe], 0xdf
test byte [esi + 0xe], 0x80
je 0x46f378
lea eax, [esi + 0xc4]
mov esi, dword [eax]
and dword [eax], 0
test esi, esi
je 0x46f378
mov ecx, esi
call fcn.004e40ec
push 0
xor edx, edx
mov ecx, esi
call fcn.004e20cf
pop esi
leave
ret 4
Function at 0x470815
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
xor esi, esi
push 0
mov ebx, ecx
mov ecx, dword [ebp + 8]
inc esi
push esi
call fcn.004078ca
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xffffffeb
add eax, 0x17
push eax
mov ecx, ebx
call fcn.004707ce
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jne 0x470853
xor al, al
jmp 0x470905
push edi
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x470893
call sub.MSVCRT.dll__errno
mov esi, eax
call sub.MSVCRT.dll__errno
push dword [esi]
mov edi, eax
call sub.MSVCRT.dll_strerror
push eax
push dword [edi]
push dword [ebx + 4]
call fcn.004448e5
add esp, 0x10
mov esi, dword [ebp + 8]
push esi
mov ecx, ebx
call fcn.0046eb5e
cmp eax, 0xffffffff
jne 0x4708d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x4708fa
push 5
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 8], ax
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.0046eb5e
cmp eax, 0xffffffff
jne 0x4708dc
jmp 0x4708fa
push esi
push dword [ebx + 4]
call fcn.004448e5
add esp, 8
push 0xa
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4708fe
push dword [ebp + 8]
push dword [ebx + 4]
call fcn.004448e5
add esp, 8
xor al, al
jmp 0x470904
mov byte [ebx + 0xe], 0
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4