joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4054d4
Capabilities:
Extract resource via kernel32 functions
Resume thread
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405668
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
je 0x40553c
push 0x405678
push esi
call sub.KERNEL32.DLL_SearchPathA
mov ebx, eax
test ebx, ebx
je 0x40553c
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x40553c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEvent
jmp 0x40565e
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x40557c
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x40565e
mov eax, dword [ebp - 4]
add eax, 2
call fcn.004054c0
mov esi, eax
cmp byte [esi], 0
je 0x40565e
lea eax, [esi + 1]
call fcn.004054c0
mov esi, eax
cmp byte [esi], 0
je 0x40565e
jmp 0x405582
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetEvent
jmp 0x405641
lea eax, [esi + 1]
call fcn.004054c0
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x40565e
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SetEvent
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_MulDiv
mov esi, eax
cmp esi, 0xffffffff
je 0x40565e
push esi
call sub.KERNEL32.DLL_LockResource
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x40565e
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SetEvent
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x4055a0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEvent
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40568c
Capabilities:
Clear file content
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_ResetEvent
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058bc
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x40570f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058bc
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x40570f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058d8
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x405798
xor eax, eax
push ebp
push 0x405791
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004054d4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405776
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4058f8
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405776
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405798
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEvent
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SetEndOfFile
push eax
call sub.KERNEL32.DLL_ReleaseMutex
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4058b2
cmp byte [ebp - 0xd], 0
jne 0x4057df
cmp byte [ebp - 0x12], 0
je 0x4058b2
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4057f8
dec ebx
cmp byte [ebx], 0x2e
je 0x405807
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4057f7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4058b2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405844
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
test esi, esi
jne 0x4058b2
cmp byte [ebp - 0xd], 0
je 0x4058b2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
test esi, esi
jne 0x4058b2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a398
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a4e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040412c
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x12]
mov word [ebp - 0xe], ax
lea eax, [ebp - 4]
mov edx, 0x40a4fc
call fcn.004041c4
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.004045ec
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.user32.dll_GetSubMenu
push eax
call sub.user32.dll_GetKeyNameTextA
test eax, eax
je 0x40a4c5
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.0040439c
dec esi
jne 0x40a4c5
mov eax, dword [0x47c748]
sub eax, 4
je 0x40a468
sub eax, 0xd
jne 0x40a4c5
push ebx
mov eax, dword [ebx]
mov edx, 1
call fcn.0040cb10
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.0040464c
jmp 0x40a4c5
cmp dword [0x47c74c], 1
jne 0x40a4c5
mov eax, dword [ebx]
call fcn.004043ec
mov edx, eax
mov eax, dword [ebx]
call fcn.0040c99c
cmp eax, 4
jne 0x40a4c5
mov eax, dword [ebx]
mov edx, 3
call fcn.0040caac
mov esi, eax
lea eax, [ebp - 0x114]
add esi, eax
dec esi
lea eax, [ebp - 0x118]
mov edx, esi
call fcn.00404324
mov eax, dword [ebp - 0x118]
mov edx, 2
call fcn.0040cb10
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.0040421c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a4ed
lea eax, [ebp - 0x118]
call fcn.0040412c
lea eax, [ebp - 4]
call fcn.0040412c
ret

Function at 0x40a500
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a5de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040412c
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x12]
mov word [ebp - 0xe], ax
cmp esi, 2
jg 0x40a55e
lea eax, [ebp - 4]
mov edx, 0x40a5f4
call fcn.004041c4
jmp 0x40a56b
lea eax, [ebp - 4]
mov edx, 0x40a600
call fcn.004041c4
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.004045ec
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.user32.dll_GetSubMenu
push eax
call sub.user32.dll_GetKeyNameTextA
test eax, eax
je 0x40a5c8
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.0040439c
dec esi
jne 0x40a5c8
mov eax, dword [ebx]
cmp byte [eax], 0x30
jne 0x40a5c8
push ebx
mov eax, dword [ebx]
call fcn.004043ec
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 2
call fcn.0040464c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a5e5
lea eax, [ebp - 4]
call fcn.0040412c
ret
Function at 0x40c7f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c8ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004041c4
lea eax, [ebp - 8]
call fcn.0040463c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004045ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c8b4
mov eax, ebx
call fcn.0040271c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c8ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004045ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c897
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c8dc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c897
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8b4
mov eax, dword [ebp - 0x10]
call fcn.0040273c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8d1
lea eax, [ebp - 8]
call fcn.0040412c
ret

Function at 0x41f1c0
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call sub.user32.dll_GetIconInfo
mov edx, dword [0x47b39c]
cmp eax, dword [edx]
jne 0x41f235
xor ebx, ebx
mov eax, dword [0x47c854]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x41f1ff
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.00406d10
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call fcn.00406cf0
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.0041eefc
cmp ebx, 1
jne 0x41f22f
xor eax, eax
call fcn.0041eaf4
test ebx, ebx
jne 0x41f1e8
jmp 0x41f241
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_ReleaseDC
push esp
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_GetKeyboardLayoutList
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.0041eefc
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x42158c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x421592
ret
Function at 0x4580fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4581a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dl, 1
mov eax, dword [0x416b78]
call fcn.00403328
mov esi, eax
mov dword [ebx + 0xc], esi
mov eax, dword [ebx + 8]
cdq
push edx
push eax
mov eax, esi
call fcn.0041ae64
mov esi, dword [ebx + 0xc]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, esi
call fcn.0041ae00
lea eax, [ebp - 4]
mov edx, 0x4581c0
call fcn.004041c4
mov eax, dword [ebp - 4]
call fcn.004045ec
mov edx, eax
mov ecx, 1
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4581b0
lea eax, [ebp - 4]
call fcn.0040412c
ret
Function at 0x458ee8
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459239
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x459250
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0045a598
mov eax, dword [ebp - 4]
mov byte [eax + 0x10090], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100b0]
call fcn.0045843c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10110], 0
je 0x458f50
mov ecx, 0x459264
mov dl, 1
mov eax, dword [0x458544]
call fcn.0040bf5c
call fcn.00403ae4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x458f75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045a774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458fb0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x100e0], 0
jne 0x459034
cmp dword [ebp - 8], 0
jle 0x458fda
mov ecx, 0x4592c0
mov dl, 1
mov eax, dword [0x458544]
call fcn.0040bf5c
call fcn.00403ae4
jmp 0x459034
mov eax, dword [ebp - 4]
cmp word [eax + 0x10062], 0
jne 0x458fff
mov ecx, 0x4592c0
mov dl, 1
mov eax, dword [0x458544]
call fcn.0040bf5c
call fcn.00403ae4
jmp 0x459034
mov byte [ebp - 9], 0
lea edx, [ebp - 9]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x10064]
call dword [ebx + 0x10060]
cmp byte [ebp - 9], 0
jne 0x459031
mov ecx, 0x4592c0
mov dl, 1
mov eax, dword [0x458544]
call fcn.0040bf5c
call fcn.00403ae4
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x100e0], 0
je 0x458f55
mov eax, dword [ebp - 4]
mov word [eax + 0x100dc], 2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x100a4], 0
jne 0x459078
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x100b8]
push eax
call sub.wsock32.dll_htons
mov edx, dword [ebp - 4]
mov word [edx + 0x100de], ax
jmp 0x459092
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x100a8]
push eax
call sub.wsock32.dll_htons
mov edx, dword [ebp - 4]
mov word [edx + 0x100de], ax
mov eax, dword [ebp - 4]
mov byte [eax + 0x100d8], 0
mov eax, 0x10
mov edx, dword [ebp - 4]
mov byte [edx + 0x100b4], 1
push eax
mov eax, dword [ebp - 4]
add eax, 0x100dc
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10108]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x4590d7
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0045a4cc
mov eax, dword [ebp - 4]
call fcn.00459f94
xor eax, eax
push ebp
push 0x45913d
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4590f7
mov eax, dword [ebp - 4]
call fcn.00459368
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10110], 0
jne 0x459127
mov eax, dword [ebp - 4]
cmp byte [eax + 0x100b5], 0
jne 0x459127
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x459127
mov eax, dword [ebp - 4]
cmp byte [eax + 0x100b4], 0
jne 0x4590ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459144
mov eax, dword [ebp - 4]
call fcn.00459ff8
ret
Function at 0x45948c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4595d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4595ec
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0045a598
mov eax, dword [ebp - 4]
call fcn.00459f94
xor edx, edx
push ebp
push 0x4595b7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x459556
test si, si
jne 0x4594fc
mov eax, dword [ebp - 8]
call fcn.00408e70
mov esi, eax
cmp esi, 0xffff
jbe 0x4594fc
call fcn.00403298
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10108]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x459556
cmp eax, 0xffffffff
jle 0x45952b
sub ebx, eax
jmp 0x45953a
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0045a4cc
test ebx, ebx
je 0x459556
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x459556
mov eax, dword [ebp - 4]
cmp byte [eax + 0x100b5], 0
je 0x4594ff
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x4595a1
mov eax, dword [ebp - 4]
mov byte [eax + 0x10090], 0
mov ecx, 0x459604
mov dl, 1
mov eax, dword [0x45859c]
call fcn.0040bf5c
call fcn.00403ae4
mov eax, dword [ebp - 4]
cmp word [eax + 0x10102], 0
je 0x4595a1
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10104]
call dword [ebx + 0x10100]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4595be
mov eax, dword [ebp - 4]
call fcn.00459ff8
ret
Function at 0x459a80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x459c2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x459c40
mov dl, 8
mov eax, ebx
call fcn.0045a598
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0041ae00
cmp byte [ebx + 0x10090], 0
jne 0x459bd7
xor eax, eax
mov dword [ebx + 0x1008c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x459ae4
call fcn.00403298
mov dword [ebx + 0x100bc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041ade0
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x459b12
call fcn.00403298
cmp eax, 0x10000
jle 0x459b1e
mov eax, 0x10000
lea edx, [ebx + 0x30]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x459b45
call fcn.00403298
lea eax, [ebx + eax + 0x30]
push eax
movzx eax, word [ebx + 0x10108]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x459c15
test eax, eax
jle 0x459b85
sub esi, eax
add dword [ebx + 0x1008c], eax
cmp word [ebx + 0x100d2], 0
je 0x459b93
mov edx, ebx
mov eax, dword [ebx + 0x100d4]
call dword [ebx + 0x100d0]
jmp 0x459b93
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.0045a4cc
mov eax, dword [0x47b200]
mov eax, dword [eax]
call fcn.00454614
test esi, esi
je 0x459bac
cmp byte [ebx + 0x10090], 0
je 0x459b31
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041ade0
cmp edx, dword [esp + 4]
jne 0x459bc6
cmp eax, dword [esp]
pop edx
pop eax
je 0x459bd7
cmp byte [ebx + 0x10090], 0
je 0x459aea
cmp byte [ebx + 0x10090], 0
je 0x459c15
mov byte [ebx + 0x10090], 0
mov ecx, 0x459c54
mov dl, 1
mov eax, dword [0x45859c]
call fcn.0040bf5c
call fcn.00403ae4
cmp word [ebx + 0x10102], 0
je 0x459c15
mov edx, ebx
mov eax, dword [ebx + 0x10104]
call dword [ebx + 0x10100]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459c32
lea eax, [ebp - 0xc]
call fcn.0040412c
ret
Function at 0x45a02c
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a135
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45a14c
mov dl, 8
mov eax, ebx
call fcn.0045a598
test byte [ebx + 0x1c], 0x10
setne al
xor al, 1
and al, byte [0x47cc58]
je 0x45a11f
xor eax, eax
push ebp
push 0x45a0ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x45a095
call fcn.00403298
mov word [ebx + 0x10108], si
mov word [ebp - 4], 0
mov word [ebp - 2], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xff7f
movzx eax, si
push eax
call sub.wsock32.dll_setsockopt
cmp word [ebx + 0x10108], 0xffff
jne 0x45a0da
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.0045a4cc
push 0x3f
push 0x465
mov eax, dword [ebx + 0x1010c]
push eax
movzx eax, word [ebx + 0x10108]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a11f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a13c
lea eax, [ebp - 8]
call fcn.0040412c
ret

Function at 0x45a418
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov ecx, 0x45a4b4
mov dl, 4
mov eax, ebx
call fcn.0045a598
mov byte [ebx + 0x10110], 0
mov ax, word [ebx + 0x10108]
cmp ax, 0xffff
je 0x45a4a6
movzx eax, ax
push eax
call sub.wsock32.dll_closesocket
test byte [ebx + 0x1c], 8
jne 0x45a465
cmp word [ebx + 0x10052], 0
je 0x45a465
mov edx, ebx
mov eax, dword [ebx + 0x10054]
call dword [ebx + 0x10050]
cmp byte [ebx + 0x10091], 0
jne 0x45a4a6
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x45a488
call fcn.00403298
mov word [ebx + 0x10108], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1010c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
pop esi
pop ebx
ret
Function at 0x45a640
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100b0]
cmp dword [eax + 4], 0
setg byte [ebp - 5]
cmp byte [ebp - 5], 0
jne 0x45a704
push 2
push 1
lea eax, [ebp - 6]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10108]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x45a691
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.0045a3c4
jmp 0x45a704
test eax, eax
jne 0x45a704
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x45a6cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10110], 0
je 0x45a6c3
mov eax, dword [ebp - 4]
call fcn.0045a710
mov eax, dword [ebp - 4]
call fcn.0045a418
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a6d7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10034]
call fcn.00429c58
mov eax, dword [ebp - 4]
cmp word [eax + 0x10052], 0
je 0x45a704
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10054]
call dword [ebx + 0x10050]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45a710
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x45a717
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x45a764
mov dl, 8
mov eax, ebx
call fcn.0045a598
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10108]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret