joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b390
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0047ab14
xor eax, eax
push ebp
push 0x47b502
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x47b4ec
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
je 0x47b3db
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
jne 0x47b3e5
call fcn.00404024
jmp 0x47b509
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00419698
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 8]
mov ebx, eax
test ebx, ebx
jle 0x47b4e1
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x47b493
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x47b480
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004039a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0047b348
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x47b514]
cmp dl, byte [eax + 0x38]
je 0x47b4e8
call fcn.0040c550
jmp 0x47b4e8
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004196b8
jmp 0x47b4e8
cmp ecx, ebx
jge 0x47b4af
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004196b8
jmp 0x47b3e5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00419698
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004196cc
cmp edx, dword [esp + 4]
jne 0x47b4d0
cmp eax, dword [esp]
pop edx
pop eax
jne 0x47b3e5
push ebp
call fcn.0047b348
pop ecx
jmp 0x47b4e8
push ebp
call fcn.0047b348
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b509
mov eax, dword [ebp - 4]
call fcn.0047ab20
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b518
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b63a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047ab14
xor eax, eax
push ebp
push 0x47b61d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
jne 0x47b568
call fcn.00404024
jmp 0x47b624
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47b607
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47b607
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004039a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47b607
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bd58
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47b654
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x53ec80]
mov dl, 1
mov eax, dword [0x479684]
call fcn.0040c6b0
call fcn.00403f78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b624
mov eax, dword [ebp - 4]
call fcn.0047ab20
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b641
lea eax, [ebp - 0x28]
call fcn.004045b8
ret
Function at 0x47b6a0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b7ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047ab14
xor eax, eax
push ebp
push 0x47b7cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x47b705
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x47b705
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x47b7b7
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
jne 0x47b718
call fcn.00404024
jmp 0x47b7d4
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47b7b7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47b7b7
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004039a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47b7b7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bd58
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47b804
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x53ec80]
mov dl, 1
mov eax, dword [0x479684]
call fcn.0040c6b0
call fcn.00403f78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b7d4
mov eax, dword [ebp - 4]
call fcn.0047ab20
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b7f1
lea eax, [ebp - 0x28]
call fcn.004045b8
ret
Function at 0x47fe18
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x47fe46
mov eax, ebx
call fcn.004808d0
cmp dword [ebx + 0x3c], 0
je 0x47fe3f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47feb7
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x47fea9
cmp dword [ebx + 8], 0
je 0x47fe68
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x47fe7a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47fea9
cmp dword [ebx + 8], 0
je 0x47fe5b
cmp eax, 3
je 0x47fe8d
dec eax
jne 0x47fe5b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47fe5b
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x47fe5b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x47fed5
cmp dword [ebx + 0x10], 0xcc
je 0x47fed5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047fee0
pop ebx
ret

Function at 0x4902b8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x413b90]
call fcn.00405278
xor eax, eax
push ebp
push 0x4903fc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x503d40], 0
jne 0x49030b
mov ecx, dword [0x53e448]
mov dl, 1
mov eax, dword [0x408150]
call fcn.0040c674
call fcn.00403f78
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403098
mov eax, ebx
call fcn.00404ea0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x49040c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004066f4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404eb0
test eax, eax
jle 0x4903a3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x49039c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404854
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408ffc
test eax, eax
jne 0x49039c
mov ebx, 0x15
jmp 0x4903a8
mov ebx, 0x10
jmp 0x4903a8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x503d40]
call fcn.00490210
mov eax, dword [ebp - 8]
call fcn.00490210
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040670c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490403
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x10]
mov edx, dword [0x413b90]
call fcn.00405348
ret
Function at 0x492c74
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x492cc5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x492cac
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x492c9c
jmp 0x492cc5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x492cad
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a0184
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.004172cc
mov esi, eax
xor eax, eax
push ebp
push 0x4a01fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x4a01e2
mov edx, ebx
mov eax, esi
call fcn.00416e60
test byte [eax + 0x48], 1
je 0x4a01dc
push 0
mov edx, ebx
mov eax, esi
call fcn.00416e60
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.00416d50
dec ebx
cmp ebx, 0xffffffff
jne 0x4a01b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0205
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00417330
ret

Function at 0x4a08dc
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x4a08eb
or edx, 0x200
test eax, 0x20000000
je 0x4a091f
test eax, 0x40000000
je 0x4a090a
test eax, 0x80000000
je 0x4a0905
or edx, 0x40
jmp 0x4a0946
or edx, 0x20
jmp 0x4a0946
test eax, 0x80000000
je 0x4a0919
or edx, 0x80
jmp 0x4a0946
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x4a0937
test eax, 0x80000000
je 0x4a0932
or edx, 4
jmp 0x4a0946
or edx, 2
jmp 0x4a0946
test eax, 0x80000000
je 0x4a0943
or edx, 8
jmp 0x4a0946
or edx, 1
mov eax, edx
ret
Function at 0x4a1010
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, 0x53ff30
xor eax, eax
push ebp
push 0x4a1143
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
mov eax, esi
mov ecx, 1
mov edx, dword [0x4a0630]
call fcn.00405f1c
add esp, 4
mov eax, dword [esi]
mov edx, 0x4a115c
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 4], 0x53ff08
mov eax, dword [esi]
add eax, 8
mov edx, 0x4a1178
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 0xc], 0x53ff0c
mov eax, dword [esi]
add eax, 0x10
mov edx, 0x4a1194
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 0x14], 0x53ff10
mov eax, dword [esi]
add eax, 0x18
mov edx, 0x4a11ac
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 0x1c], 0x53ff14
mov eax, dword [esi]
add eax, 0x20
mov edx, 0x4a11c4
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 0x24], 0x53ff18
mov eax, dword [esi]
add eax, 0x28
mov edx, 0x4a11d8
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 0x2c], 0x53ff1c
mov eax, dword [esi]
add eax, 0x30
mov edx, 0x4a11ec
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 0x34], 0x53ff20
mov eax, dword [esi]
add eax, 0x38
mov edx, 0x4a11fc
call fcn.0040460c
mov eax, dword [esi]
mov dword [eax + 0x3c], 0x53ff24
lea ecx, [ebp - 0xc]
mov eax, dword [0x53ff2c]
mov eax, dword [eax + 4]
mov edx, dword [esi]
call fcn.004a0d50
lea edx, [ebp - 0xc]
mov eax, 0x53ff34
mov ecx, dword [0x4a0610]
call fcn.00405564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a114a
lea eax, [ebp - 0xc]
mov edx, dword [0x4a0610]
call fcn.00405348
ret

Function at 0x4a2f84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4a2fe8
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404820
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004094cc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2fef
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4abc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4abd23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4abd0d
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, 0x4abd38
call fcn.00404bc8
test eax, eax
jle 0x4abcd6
lea edx, [ebp - 0xc]
mov ecx, 0x400
xchg edx, eax
call fcn.00404b24
mov eax, dword [ebp - 0xc]
call fcn.0040488c
mov edx, eax
test edx, edx
jle 0x4abcf5
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor byte [ecx + eax - 1], 0x80
inc eax
dec edx
jne 0x4abce9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4abca7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abd2a
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4af5dc
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
add esp, 0xffffffc0
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x4af60b
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4af60b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
cmp ebx, 0x100007f
jne 0x4af60b
xor ebx, ebx
mov eax, ebx
add esp, 0x40
pop ebx
ret

Function at 0x4af614
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [ebp - 8], 1
call fcn.004af5dc
mov dword [0x5413b0], eax
cmp byte [0x53b914], 0
jne 0x4af663
lea eax, [ebp - 0x19c]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4af741
mov byte [0x53b914], 1
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [edi], eax
cmp dword [edi], 0xffffffff
je 0x4af741
mov word [ebp - 0x1ac], 2
xor eax, eax
mov dword [ebp - 0x1a8], eax
mov ax, word [ebp - 4]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1aa], ax
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0xffff
mov eax, dword [edi]
push eax
call sub.wsock32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x1ac]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x4af6ce
mov eax, dword [edi]
push eax
call sub.wsock32.dll_closesocket
jmp 0x4af741
push 4
lea eax, [ebp - 8]
push eax
push 0x20
push 0xffff
mov eax, dword [edi]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4af6f0
mov eax, dword [edi]
push eax
call sub.wsock32.dll_closesocket
jmp 0x4af741
mov dword [ebp - 0xc], 0x20000
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1002
push 0xffff
mov eax, dword [edi]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4af71c
mov eax, dword [edi]
push eax
call sub.wsock32.dll_closesocket
jmp 0x4af741
push 0x23
mov eax, dword [ebp + 8]
push eax
mov eax, esi
call fcn.0045de20
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_WSAAsyncSelect
inc eax
jne 0x4af73f
mov eax, dword [edi]
push eax
call sub.wsock32.dll_closesocket
jmp 0x4af741
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4af76c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov esi, edx
mov edi, eax
cmp dword [esi + 8], 1
jne 0x4af902
cmp dword [esi], 0x501
jne 0x4af790
mov ebx, 0x542420
jmp 0x4af795
mov ebx, 0x5413fc
mov dword [esp], 0x10
mov eax, 0x1020
push esp
lea edx, [esp + 8]
push edx
push 0
push eax
lea eax, [ebx + 4]
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x4af808
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2745
je 0x4af7d3
cmp eax, 0x274a
jne 0x4af902
inc dword [0x53b918]
cmp dword [0x53b918], 0x64
jle 0x4af902
xor eax, eax
mov dword [0x53b918], eax
push 0
push 0
push 0x635
mov eax, edi
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
jmp 0x4af902
xor edx, edx
mov dword [0x53b918], edx
mov edx, dword [0x53ed80]
cmp byte [edx], 0
jne 0x4af831
mov dword [0x5413fc], 0xffffffff
mov dword [0x542420], 0xffffffff
jmp 0x4af841
mov edx, dword [esp + 8]
cmp edx, dword [0x5413ac]
jne 0x4af781
test eax, eax
jle 0x4af902
lea ebp, [ebx + 4]
cmp eax, 0x20
jl 0x4af781
cmp dword [ebp], 0x13572469
jne 0x4af781
cmp eax, dword [ebp + 4]
jl 0x4af781
mov edx, dword [ebp + 4]
mov eax, ebp
call fcn.004710e0
test al, 0xff
jne 0x4af902
mov eax, dword [ebp + 8]
mov edx, eax
sub edx, dword [ebx]
test edx, edx
jle 0x4af902
mov dword [ebx], eax
mov al, byte [ebp + 0xd]
sub al, 0xa
je 0x4af89a
sub al, 2
je 0x4af8ad
jmp 0x4af781
mov eax, dword [0x53e578]
mov eax, dword [eax]
mov edx, ebp
call fcn.004df5cc
jmp 0x4af781
cmp byte [ebp + 0xc], 0xd2
je 0x4af8c1
mov eax, dword [0x53ed80]
cmp byte [eax], 4
jne 0x4af781
add dword [0x53b8f8], 1
adc dword [0x53b8fc], 0
mov eax, dword [0x53e854]
cmp dword [eax + 4], 0
jne 0x4af8e5
cmp dword [eax], 0
jbe 0x4af781
jmp 0x4af8eb
jle 0x4af781
mov eax, dword [0x53e578]
mov eax, dword [eax]
mov ecx, dword [esp + 8]
mov edx, ebp
call fcn.004dd2c0
jmp 0x4af781
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4af92c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov edi, ecx
mov esi, edx
mov dword [esp], eax
cmp dword [edi + 8], 1
jne 0x4afac0
mov dword [esp + 4], 0x10
mov eax, 0x1020
lea edx, [esp + 4]
push edx
lea edx, [esp + 0xc]
push edx
push 0
push eax
lea eax, [esi + 0x14]
push eax
mov eax, dword [edi + 4]
push eax
call sub.wsock32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x4af9be
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2745
je 0x4af987
cmp eax, 0x274a
jne 0x4afac0
inc dword [0x53b918]
cmp dword [0x53b918], 0x64
jle 0x4afac0
xor eax, eax
mov dword [0x53b918], eax
push 0
push 0
push 0x635
mov eax, dword [esp + 0xc]
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
jmp 0x4afac0
xor edx, edx
mov dword [0x53b918], edx
mov edx, dword [0x53ed80]
cmp byte [edx], 0
jne 0x4af9ed
mov edx, dword [0x5413b4]
mov dword [edx + 0x10], 0xffffffff
mov edx, dword [0x5413b8]
mov dword [edx + 0x10], 0xffffffff
jmp 0x4af9fd
mov edx, dword [esp + 0xc]
cmp edx, dword [0x5413ac]
jne 0x4af944
test eax, eax
jle 0x4afac0
lea ebx, [esi + 0x14]
cmp eax, 8
jl 0x4af944
cmp dword [ebx], 0x13572469
jne 0x4af944
mov ebp, dword [ebx + 4]
cmp eax, ebp
jl 0x4af944
mov edx, ebp
mov eax, ebx
call fcn.004710e0
test al, 0xff
jne 0x4afac0
mov eax, dword [ebx + 8]
mov edx, eax
sub edx, dword [esi + 0x10]
test edx, edx
jle 0x4afac0
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0xd]
sub al, 0xa
je 0x4afa58
sub al, 2
je 0x4afa6b
jmp 0x4af944
mov eax, dword [0x53e578]
mov eax, dword [eax]
mov edx, ebx
call fcn.004df5cc
jmp 0x4af944
cmp byte [ebx + 0xc], 0xd2
je 0x4afa7f
mov eax, dword [0x53ed80]
cmp byte [eax], 4
jne 0x4af944
add dword [0x53b8f8], 1
adc dword [0x53b8fc], 0
mov eax, dword [0x53e854]
cmp dword [eax + 4], 0
jne 0x4afaa3
cmp dword [eax], 0
jbe 0x4af944
jmp 0x4afaa9
jle 0x4af944
mov eax, dword [0x53e578]
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
mov edx, ebx
call fcn.004dd2c0
jmp 0x4af944
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4afccc
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4afe46
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0xc], 0xffffffff
jne 0x4afe30
lea eax, [esi + 4]
mov edx, dword [ebp - 4]
call fcn.0040460c
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0x10], 0xffffffff
cmp byte [0x53b914], 0
jne 0x4afd40
lea eax, [ebp - 0x1b8]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4afe30
mov byte [0x53b914], 1
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov ebx, eax
test ebx, ebx
jl 0x4afe30
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
test eax, eax
jl 0x4afe30
mov word [ebp - 0x28], 2
mov ax, word [esi + 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
xor eax, eax
mov dword [ebp - 0x24], eax
push 0x10
lea eax, [ebp - 0x28]
push eax
push ebx
call sub.wsock32.dll_bind
test eax, eax
jge 0x4afdab
push ebx
call sub.wsock32.dll_closesocket
jmp 0x4afe30
mov eax, dword [esi + 4]
call fcn.00404a84
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 0x10], eax
push 8
lea eax, [ebp - 0x14]
push eax
push 5
push 0
push ebx
call sub.wsock32.dll_setsockopt
test eax, eax
jge 0x4afde2
push ebx
call sub.wsock32.dll_closesocket
jmp 0x4afe30
mov dword [ebp - 0x18], 0x20000
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1002
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4afe0a
push ebx
call sub.wsock32.dll_closesocket
jmp 0x4afe30
push 0x23
push edi
mov eax, dword [0x54139c]
call fcn.0045de20
push eax
push ebx
call sub.wsock32.dll_WSAAsyncSelect
inc eax
jne 0x4afe29
push ebx
call sub.wsock32.dll_closesocket
jmp 0x4afe30
mov dword [esi + 0xc], ebx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afe4d
lea eax, [ebp - 4]
call fcn.004045b8
ret