joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462488
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4624b4
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
neg al
sbb eax, eax
mov dword [ebp - 8], eax
jmp 0x4624b9
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4625a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x46261b
cmp dword [ebp - 8], 0
je 0x462614
cmp dword [ebp - 0xc], 0
jbe 0x462614
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x46260b
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x462602
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x462622
mov dword [ebp - 0x10], 0xfffffffc
jmp 0x462622
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x462622
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x462622
mov dword [ebp - 0x10], 0xfffffffe
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x46f2a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
dec edx
add byte [edx], ch
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x46f389
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46f398
push 0x46f3ac
call sub.kernel32.dll_LoadLibraryA
push eax
call fcn.00406ee0
mov esi, eax
lea eax, [ebx + 4]
call fcn.0040493c
test esi, esi
je 0x46f31c
mov dword [ebp - 4], 0x400
mov eax, dword [ebp - 4]
call fcn.00402764
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
jne 0x46f315
lea esi, [edi + 0x10c]
test esi, esi
je 0x46f315
lea eax, [ebx + 4]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404bac
mov eax, edi
call fcn.00402784
cmp dword [ebx + 4], 0
jne 0x46f350
call fcn.00402b9c
mov eax, 4
call fcn.004032a4
mov eax, dword [eax*4 + 0x48d2d8]
lea ecx, [ebp - 8]
mov edx, 0x46f3c4
call fcn.004584b4
mov edx, dword [ebp - 8]
lea eax, [ebx + 4]
call fcn.00404990
lea eax, [ebp - 0xc]
mov ecx, dword [ebx + 4]
mov edx, 0x46f3d8
call fcn.00404c48
mov eax, dword [ebp - 0xc]
call fcn.00404dfc
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f390
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404960
ret
Function at 0x46f4bc
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
cmp eax, 0x40
jge 0x46f4fa
mov dword [esp + eax*4 + 0xc], ebx
inc dword [esp + 8]
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x46f514
Capabilities:
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46f63a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 1
xor esi, esi
mov edi, dword [ebp + 0xc]
push 0x11
push 2
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46f630
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403284
mov word [ebp - 0x28], 2
push 0x35
call fcn.00458914
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404dfc
push eax
call fcn.0045891c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.wsock32.dll_sendto
inc eax
jne 0x46f5c4
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46f644
cmp dword [ebp - 0x18], 0
jle 0x46f627
mov ecx, 0xbb8
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046f4bc
test eax, eax
jle 0x46f627
lea eax, [ebp - 0x18]
push eax
push 0x4004667f
push ebx
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x46f5f5
cmp dword [ebp - 0x18], 0
jle 0x46f627
mov eax, dword [ebp - 0x18]
add eax, esi
cmp eax, dword [ebp + 8]
jle 0x46f604
add esi, dword [ebp - 0x18]
jmp 0x46f627
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
push edi
push ebx
call sub.wsock32.dll_recvfrom
mov dword [ebp - 0x10], eax
add esi, dword [ebp - 0x10]
add edi, esi
cmp dword [ebp - 0x18], 0
jg 0x46f5ca
mov dword [ebp - 0x10], esi
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46f644
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46fa54
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
test dl, dl
je 0x46fa6b
add esp, 0xfffffff0
call fcn.00403e70
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
test bl, bl
je 0x46fa95
call fcn.00403ec8
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4735ac
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4735b5
mov eax, dword [esp + 0x2000]
add esp, 4
mov esi, edx
lea edi, [esp]
push ecx
mov ecx, 0x800
rep movsd dword es:[edi], dword [esi]
pop ecx
dec ecx
test ecx, ecx
jl 0x473606
inc ecx
mov edx, esp
mov ebx, dword [eax]
movzx esi, byte [edx]
xor ebx, esi
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x48d8f8]
mov esi, dword [eax]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov dword [eax], ebx
inc edx
dec ecx
jne 0x4735df
add esp, 0x2000
pop edi
pop esi
pop ebx
ret

Function at 0x473610
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x473619
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404dec
xor eax, eax
push ebp
push 0x47370e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
setne byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4736f6
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [ebp - 8]
add edx, ebx
cmp eax, edx
jge 0x473693
mov byte [ebp - 9], 0
jmp 0x4736f8
test ebx, ebx
jg 0x47369c
mov ebx, eax
sub ebx, dword [ebp - 8]
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
test ebx, ebx
jle 0x4736f0
cmp ebx, 0x2000
jle 0x4736bf
mov dword [ebp - 0x10], 0x2000
jmp 0x4736c2
mov dword [ebp - 0x10], ebx
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x2010]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
mov eax, edi
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x2010]
call fcn.004735ac
sub ebx, dword [ebp - 0x10]
test ebx, ebx
jg 0x4736ae
push esi
call fcn.00406d20
not dword [edi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473715
lea eax, [ebp - 4]
call fcn.0040493c
ret
Function at 0x4739e0
Capabilities:
Read file via mapping

Disassembly:
push ebx
add esp, 0xffffffe0
mov dword [0x4903ac], 0x94
push 0x4903ac
call fcn.00406f48
cmp dword [0x4903b0], 5
je 0x473a08
xor eax, eax
jmp 0x473aea
mov eax, dword [0x4903b4]
sub eax, 1
jb 0x473a16
je 0x473a1d
jmp 0x473a24
mov ebx, 0x30000
jmp 0x473a2b
mov ebx, 0x39000
jmp 0x473a2b
xor eax, eax
jmp 0x473aea
push 0x473af0
lea eax, [esp + 4]
push eax
call dword [0x48dcf8]
mov dword [esp + 8], 0x18
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, esp
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push eax
push 6
push 0x48dd08
call dword [0x48dcfc]
cmp eax, 0xc0000022
jne 0x473ab6
lea eax, [esp + 8]
push eax
push 0x60000
push 0x48dd08
call dword [0x48dcfc]
mov eax, dword [0x48dd08]
call fcn.004738d4
mov eax, dword [0x48dd08]
push eax
call fcn.00406d20
lea eax, [esp + 8]
push eax
push 6
push 0x48dd08
call dword [0x48dcfc]
test eax, eax
jge 0x473abe
xor eax, eax
jmp 0x473aea
push 0x1000
push ebx
push 0
push 6
mov eax, dword [0x48dd08]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x48dd04], eax
cmp dword [0x48dd04], 0
jne 0x473ae5
xor eax, eax
jmp 0x473aea
mov eax, dword [0x48dd08]
add esp, 0x20
pop ebx
ret

Function at 0x473b20
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, esi
shr edx, 0x16
shl edx, 2
add edx, eax
mov ebx, dword [edx]
test bl, 1
jne 0x473b3a
xor eax, eax
pop esi
pop ebx
ret
mov eax, ebx
and eax, 0x80
test eax, eax
je 0x473b57
and ebx, 0xffc00000
and esi, 0x3fffff
add ebx, esi
mov esi, ebx
jmp 0x473ba3
push 0x1000
and ebx, 0xfffff000
push ebx
push 0
push 4
mov eax, dword [0x48dd08]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov eax, esi
and eax, 0x3ff000
shr eax, 0xc
shl eax, 2
add eax, ebx
mov eax, dword [eax]
test al, 1
jne 0x473b8e
xor eax, eax
pop esi
pop ebx
ret
and eax, 0xfffff000
and esi, 0xfff
add eax, esi
mov esi, eax
push ebx
call sub.kernel32.dll_UnmapViewOfFile
mov eax, esi
pop esi
pop ebx
ret

Function at 0x473ba8
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, eax
mov edx, ebx
mov eax, dword [0x48dd04]
call fcn.00473b20
mov ebx, eax
push 0x1000
mov eax, ebx
and eax, 0xfffff000
push eax
push 0
push 6
mov eax, dword [0x48dd08]
push eax
call sub.kernel32.dll_MapViewOfFile
test eax, eax
jne 0x473bdd
xor eax, eax
pop ebx
ret
and ebx, 0xfff
shr ebx, 2
mov edx, ebx
shl edx, 2
add edx, eax
mov ebx, dword [edx]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, ebx
pop ebx
ret
Function at 0x47ac04
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x47ad92
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47ad70
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 4]
push eax
push edx
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
je 0x47ac51
call fcn.00404384
jmp 0x47ad77
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
call fcn.00402764
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x47acb5
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 0x10]
call fcn.00402784
mov eax, dword [ebp - 0xc]
call fcn.00402764
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x47ad2f
test eax, eax
je 0x47acc5
call fcn.0040caf0
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 8], 0
jbe 0x47ac63
cmp dword [ebx + 8], 3
jne 0x47ad15
cmp dword [ebx + 4], 1
jne 0x47ad15
mov edi, dword [ebx + 0x14]
test edi, edi
je 0x47ad15
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00409c30
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0x40]
call fcn.00404990
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x18]
mov edx, 0x47ada8
call fcn.00404c48
mov edx, dword [ebp - 0x18]
mov eax, dword [0x48e2d0]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, ebx
mov eax, esi
call fcn.0047ac04
add ebx, 0x20
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
ja 0x47acce
jmp 0x47ac63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ad77
xor eax, eax
push ebp
push 0x47ad65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
mov eax, dword [ebp - 0x10]
call fcn.00402784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ad6f
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ad99
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404960
ret
Function at 0x47b4dc
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b5c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040493c
xor edx, edx
push ebp
push 0x47b59a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.ws2_32.dll_gethostname_1
lea eax, [ebp - 0x48]
push eax
call sub.ws2_32.dll_gethostbyname_1
test eax, eax
jne 0x47b538
pop dword fs:[0]
add esp, 8
jmp 0x47b5a4
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x47b567
push dword [ebp - 8]
push dword [edi]
call sub.ws2_32.dll_inet_ntoa_1
lea edx, [ebp - 0x4c]
call fcn.00409c30
push dword [ebp - 0x4c]
push 0x47b5d8
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404cbc
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x47b53f
mov eax, dword [ebp - 8]
call fcn.00404bfc
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 1
call fcn.00404e9c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b5a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b5c9
lea eax, [ebp - 0x4c]
call fcn.0040493c
lea eax, [ebp - 8]
call fcn.0040493c
ret
Function at 0x47c340
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x47c4e6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47c4bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x48dfc0]
mov byte [eax], 0
mov eax, dword [0x48e388]
cmp dword [eax], 0
je 0x47c4b5
mov eax, dword [0x48e070]
mov eax, dword [eax]
mov edx, dword [0x48df98]
mov dword [edx], eax
mov ecx, dword [0x48e050]
mov ecx, dword [ecx]
mov edx, dword [0x48e388]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.00404c48
mov eax, dword [ebp - 8]
mov edx, dword [0x48e168]
call fcn.00483798
xor al, al
jle 0x47c4b3
mov eax, dword [0x48e168]
mov eax, dword [eax]
mov edx, 0x47c500
call fcn.00404d48
jne 0x47c3e9
mov eax, dword [0x48dfc0]
mov byte [eax], 1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c4cb
mov eax, dword [0x48e168]
mov eax, dword [eax]
mov edx, 0x47c510
call fcn.00404d48
jne 0x47c469
lea eax, [ebp - 4]
call fcn.0040493c
xor esi, esi
jmp 0x47c444
inc esi
mov ecx, dword [0x48e050]
mov ecx, dword [ecx]
mov edx, dword [0x48e388]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
call fcn.00404c48
mov edx, dword [ebp - 0xc]
mov eax, dword [0x490d64]
call 0xff47f8a4
lea eax, [ebp - 4]
mov edx, dword [0x490d64]
mov edx, dword [edx + 0xc]
call fcn.004049d4
cmp esi, 4
ja 0x47c44a
cmp dword [ebp - 4], 0
je 0x47c408
cmp dword [ebp - 4], 0
je 0x47c4b5
mov eax, dword [0x48e168]
mov edx, dword [ebp - 4]
call fcn.00404990
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c4cb
mov eax, dword [0x48e168]
mov eax, dword [eax]
mov edx, 0x47c520
call fcn.00404d48
jne 0x47c494
push 0
push 0
push 0x3400
mov eax, esi
call fcn.0043d018
push eax
call fcn.00407758
jmp 0x47c4b5
mov eax, dword [0x48e168]
mov eax, dword [eax]
mov edx, 0x47c530
call fcn.00404d48
je 0x47c4b5
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c4cb
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c4cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c4ed
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404960
ret
Function at 0x481bd4
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x481bde
mov eax, dword [esp + 0x8000]
mov edi, ecx
mov esi, edx
lea ebp, [esp + 4]
mov dword [esp], 1
push esp
push 0x8004667e
mov eax, dword [esi + 0x90]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
push esp
push 0x8004667e
mov eax, dword [edi + 0x90]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x481ca3
mov edx, ebp
mov eax, dword [edi + 0x90]
mov ecx, 0x8000
call fcn.0045c090
mov ebx, eax
test ebx, ebx
jle 0x481c5d
jmp 0x481c4b
push 5
call fcn.0040e100
mov edx, ebp
mov ecx, ebx
mov eax, dword [esi + 0x90]
call fcn.0045bf08
inc eax
je 0x481c44
mov edx, ebp
mov ecx, 0x8000
mov eax, dword [esi + 0x90]
call fcn.0045c090
mov ebx, eax
test ebx, ebx
jle 0x481c90
jmp 0x481c7e
push 5
call fcn.0040e100
mov edx, ebp
mov eax, dword [edi + 0x90]
mov ecx, ebx
call fcn.0045c090
inc eax
je 0x481c77
push 1
call fcn.0040e100
mov eax, dword [0x48e3d0]
mov eax, dword [eax]
call fcn.00455cf8
mov eax, dword [esi + 0x90]
cmp byte [eax + 8], 0
je 0x481cbf
mov eax, dword [edi + 0x90]
cmp byte [eax + 8], 0
jne 0x481c2a
mov eax, dword [0x48e3b8]
mov byte [eax], 0
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [esi + 0x90]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
push esp
push 0x8004667e
mov eax, dword [edi + 0x90]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
add esp, 0x8004
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x482d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x482dc8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.00404bac
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx]
call fcn.00404bfc
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404e5c
mov eax, dword [ebp - 0x104]
mov edx, 0x482ddc
call fcn.00404d48
je 0x482daf
mov eax, ebx
mov edx, 0x482ddc
call fcn.00404c04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482dcf
lea eax, [ebp - 0x104]
call fcn.0040493c
ret
Function at 0x483054
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
push ebp
push 0x483167
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov byte [ebp - 1], 0
push eax
push edx
mov eax, dword [0x48f664]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x48315d
push ebx
mov eax, dword [0x48f664]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x48315d
push ebx
mov eax, dword [0x48f664]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
dec edi
je 0x4830bb
dec edi
je 0x483138
jmp 0x48315d
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00404dfc
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x48315d
xor eax, eax
push ebp
push 0x483131
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
call sub.kernel32.dll_LockResource
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x483111
cmp ebx, dword [ebp - 8]
je 0x483115
xor eax, eax
jmp 0x483117
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48315d
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406d20
ret
mov eax, dword [ebp + 8]
mov edx, ebx
call fcn.00404f88
mov eax, dword [ebp + 8]
call fcn.00404e54
push eax
push esi
call fcn.00406fde
mov ecx, ebx
pop edx
call fcn.00402a10
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x483171
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x483798
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dec
xor eax, eax
push ebp
push 0x4838ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4838c2
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x100
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.00409ab4
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4838ab
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4838a5
mov ebx, dword [edx]
test ebx, ebx
je 0x48389f
lea eax, [ebp - 0x29c]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x483904
call fcn.0040a120
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00404990
mov byte [ebp - 5], 1
jmp 0x4838af
mov byte [ebp - 5], 0
jmp 0x4838af
mov byte [ebp - 5], 0
jmp 0x4838af
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4838c9
call fcn.004589c2
ret