joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467a20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467a53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x14], 0
jne 0x467a49
mov eax, dword [ebp - 4]
call fcn.0046645c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467a5d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
jne 0x467b13
call sub.kernel32.dll_GetTickCount
sub eax, 0xa
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x1c]
jb 0x467b13
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
xor edx, edx
push ebp
push 0x467b09
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00409218
cmp eax, 0xffffffff
jne 0x467ab3
pop dword fs:[0]
add esp, 8
jmp 0x467b13
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x18]
jle 0x467aff
mov eax, dword [ebp - 4]
cmp byte [eax + 0x16], 0
je 0x467ace
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467b13
mov eax, dword [ebp - 4]
mov byte [eax + 0x2a], 1
xor eax, eax
push ebp
push 0x467af5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046645c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467aff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467b13
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4687bc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402bd8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x549a90]
cmp byte [edx + 8], 0
je 0x468823
mov edx, dword [0x549a80]
cmp dword [edx], 2
jne 0x468823
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
pop ebp
ret
Function at 0x468828
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4688e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004687bc
test al, al
je 0x4688c2
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403cf8
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4688c2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404054
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404054
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403dc8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x46887b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4688e7
lea eax, [ebp - 0x2c]
call fcn.00403c14
lea eax, [ebp - 0xc]
call fcn.00403c14
ret

Function at 0x4688f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 8
call fcn.00402bd8
lea eax, [ebx + 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.00404054
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.00468480
mov byte [ebx], al
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x468a94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x468b25
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00468450
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404054
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x468b0f
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x5496d0]
call fcn.00405c6c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x468300]
call fcn.0040bbf4
call fcn.00403688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468b2c
lea eax, [ebp - 0x10]
call fcn.00403c14
ret
Function at 0x468b38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x468bd3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404054
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x468bad
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x549a9c]
call fcn.00405c6c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x468300]
call fcn.0040bbf4
call fcn.00403688
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00468480
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468bda
lea eax, [ebp - 0x10]
call fcn.00403c14
ret

Function at 0x469f50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46a007
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404054
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x469f92
call fcn.00403728
jmp 0x46a00e
mov eax, ebx
call fcn.00402714
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404054
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x469fbb
call fcn.00403728
jmp 0x46a00e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46a018
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x469fdc
call fcn.00403728
jmp 0x46a00e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a00e
mov eax, dword [ebp - 8]
call fcn.0040272c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a2cc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ecx, ecx
push ebp
push 0x46a311
push dword fs:[ecx]
mov dword fs:[ecx], esp
or edx, 0x4008
push edx
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46a31d
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a328
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46a378
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46a384
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a4d0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
xor eax, eax
push ebp
push 0x46a67d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46a68c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46a664
xor eax, eax
push ebp
push 0x46a65d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.0046a484
mov eax, dword [ebp - 0x168]
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.0046a484
mov eax, dword [ebp - 0x168]
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00422c20
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00422c20
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00422c20
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00422c20
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x546118], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a664
cmp dword [ebp - 4], 0
je 0x46a65c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a684
lea eax, [ebp - 0x168]
call fcn.00403c14
ret
Function at 0x46a698
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
xor edx, edx
mov dword [ebp - 0x164], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46a733
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00469f44
test al, al
je 0x46a6dd
cmp dword [0x54b9b8], 0x40047
jl 0x46a6dd
cmp byte [0x546118], 0
jne 0x46a6dd
call fcn.0046a4d0
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x54611c]
or eax, 0x4000
push eax
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
lea eax, [ebp - 0x164]
call fcn.0046a484
mov eax, dword [ebp - 0x164]
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a73a
lea eax, [ebp - 0x164]
call fcn.00403c14
ret

Function at 0x46b968
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b9bb
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4000
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0x90
mov eax, ebx
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b9c7
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46b9d0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ba20
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46ba2c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473bd4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473cac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x54ba80], 0
jne 0x473c90
lea eax, [ebp - 4]
mov edx, 0x473cc4
call fcn.00403cac
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404054
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x473c90
mov eax, ebx
call fcn.00402714
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x473c89
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x473c73
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x473cd4
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x473c73
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x54ba80], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473c90
mov eax, dword [ebp - 0xc]
call fcn.0040272c
ret
mov ebx, dword [0x54ba80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473cb3
lea eax, [ebp - 4]
call fcn.00403c14
ret

Function at 0x485de0
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x54baa8], 0
jne 0x485e06
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x485d64
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x54baa8], eax
pop ebp
ret

Function at 0x486c88
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.004473ec
test al, al
je 0x486ce5
cmp bl, 7
jne 0x486cc1
push 2
lea eax, [ebp - 2]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [ebp - 2]
sub edi, 0x30
jmp 0x486cc6
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
test eax, eax
je 0x486ce5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
mov edx, edi
call fcn.00423478
mov byte [esi + 0x204], bl
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4906d8
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4907e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x33c], esi
inc esi
jne 0x49071c
lea ecx, [ebp - 0x18]
mov dx, 0x2733
mov eax, edi
call fcn.00491bb4
mov dl, 1
mov eax, edi
call fcn.0048e268
mov byte [edi + 0x340], 1
mov byte [edi + 0x1361], 1
lea eax, [ebp - 0x12]
mov edx, 0x4907fc
call fcn.0040998c
push eax
call sub.wsock32.dll_inet_addr
mov dword [edi + 0x2b8], eax
mov word [edi + 0x2b4], 2
mov ax, word [edi + 0xf0]
push eax
call sub.wsock32.dll_htons
mov word [edi + 0x2b6], ax
mov byte [edi + 0x120], 0
push 0x10
lea eax, [edi + 0x2b4]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_bind
test bl, bl
je 0x4907a5
push 8
push 0x466
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4907bf
push 8
push 0x465
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 1
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_listen
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4907ea
lea eax, [ebp - 0x18]
call fcn.00403c14
ret

Function at 0x490da0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x33c]
cmp eax, 0xffffffff
jne 0x490dc3
or esi, 0xffffffff
jmp 0x490e79
or esi, 0xffffffff
cmp byte [ebx + 0x2eb], 0
je 0x490e6a
cmp byte [ebx + 0x301], 0
jne 0x490de5
cmp byte [ebx + 0x310], 0
jne 0x490e01
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x5497e8]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
jmp 0x490e79
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x490e61
mov edx, dword [ebp - 4]
push edx
push edi
push eax
mov eax, dword [0x5497e8]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x490e5c
cmp dword [ebp - 8], 0xfa0
jg 0x490e61
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x490e61
push esi
push eax
mov eax, dword [0x5499c4]
mov eax, dword [eax]
call eax
add esp, 8
test eax, eax
je 0x490e61
inc dword [ebp - 8]
mov dx, 2
mov eax, ebx
call fcn.00492158
cmp esi, 0xffffffff
je 0x490e06
test esi, esi
jne 0x490e79
or esi, 0xffffffff
jmp 0x490e79
push 0
mov edx, dword [ebp - 4]
push edx
push edi
push eax
call sub.wsock32.dll_recv
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x490e84
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [eax + 0x33c]
cmp esi, 0xffffffff
jne 0x490e99
or eax, 0xffffffff
pop esi
pop ebp
ret
cmp byte [eax + 0x2eb], 0
je 0x490eb9
push ecx
push edx
mov eax, dword [eax + 0x2ec]
push eax
mov eax, dword [0x549534]
mov eax, dword [eax]
call eax
add esp, 0xc
jmp 0x490ec3
push 0
push ecx
push edx
push esi
call sub.wsock32.dll_send
pop esi
pop ebp
ret

Function at 0x4921ac
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403cac
cmp dword [ebx + 0x33c], 0xffffffff
je 0x492220
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_getsockname
push esi
mov bx, word [ebp - 0x12]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
shr bx, 8
movzx eax, bx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x492230
call fcn.0040a05c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x492f3c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x492fe4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2c8]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
jne 0x492fa0
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_getsockname
push dword [ebp - 0x10]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.00409b14
jmp 0x492fad
mov eax, esi
mov edx, dword [ebx + 0x2c8]
call fcn.00403cac
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esi]
mov ecx, 0x492ffc
mov edx, 0x493008
call fcn.00460dcc
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.00403cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492feb
lea eax, [ebp - 0x18]
call fcn.00403c14
ret

Function at 0x4930b4
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, edx
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.00402bd8
lea eax, [ebp - 0x22]
mov edx, 0x493140
call fcn.0040998c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.wsock32.dll_bind
test eax, eax
sete bl
xor bl, 1
test bl, bl
jne 0x493128
push 1
push esi
call sub.wsock32.dll_listen
test eax, eax
sete bl
xor bl, 1
push esi
call sub.wsock32.dll_closesocket
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493774
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402bd8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
pop ebp
ret

Function at 0x494300
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00402bd8
pop ebp
ret
Function at 0x49d778
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, eax
cmp byte [0x548f10], 0
jne 0x49d7d1
push 0x54bcb4
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x49d7ca
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 6
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, 0x49d7e4
mov dl, 1
mov eax, dword [0x49cd1c]
call fcn.0040bbf4
call fcn.00403688
mov byte [0x548f10], 1
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49dd6c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, eax
mov bl, 1
jmp 0x49de97
cmp dword [edi + 0x24], 0xffffffff
jne 0x49dd90
mov byte [edi + 0x190], 0
jmp 0x49de9f
mov esi, 0xfffffffe
cmp byte [edi + 0x58], 4
jne 0x49dddc
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [edi + 0x24]
push eax
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x49ddc3
mov byte [edi + 0x190], 0
mov eax, edi
call fcn.0049f7c4
jmp 0x49de9f
cmp dword [ebp - 8], 0
jle 0x49dddc
push 0
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi + 0x24]
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 1
jne 0x49de4e
inc dword [edi + 0x194]
cmp byte [ebp - 1], 0xa
je 0x49de15
cmp byte [ebp - 1], 0xd
je 0x49de15
inc dword [edi + 0x18c]
mov eax, dword [edi + 0x18c]
mov dl, byte [ebp - 1]
mov byte [edi + eax + 0x8a], dl
mov eax, dword [edi + 0x18c]
mov byte [edi + 0x8a], al
cmp dword [edi + 0x18c], 0xfe
jl 0x49de3d
mov byte [ebp - 1], 0xa
cmp word [edi + 0x5da], 0
je 0x49de3d
mov edx, edi
mov eax, dword [edi + 0x5dc]
call dword [edi + 0x5d8]
cmp byte [ebp - 1], 0xa
jne 0x49de97
xor ebx, ebx
mov byte [edi + 0x190], 0
jmp 0x49de97
test esi, esi
jne 0x49de64
xor ebx, ebx
mov byte [edi + 0x190], 0
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x64]
jmp 0x49de97
inc esi
jne 0x49de95
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2746
jne 0x49de85
xor ebx, ebx
mov byte [edi + 0x190], 0
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x64]
jmp 0x49de97
cmp eax, 0x2733
je 0x49de97
mov eax, edi
call fcn.0049f7c4
jmp 0x49de9f
xor ebx, ebx
test bl, bl
jne 0x49dd7e
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret