joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe6d0
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
mov eax, dword [0x676ea8]
test eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadAcceleratorsA]
je 0x4fe6ef
push 0x5a
push eax
call esi
mov dword [0x676e84], eax
mov eax, dword [0x676ea8]
mov ecx, dword [0x676e84]
test ecx, ecx
jne 0x4fe715
mov eax, dword [0x6a0f3c]
push 0x5a
push eax
call esi
test eax, eax
mov dword [0x676e84], eax
jne 0x4fe710
xor eax, eax
pop esi
ret
mov eax, dword [0x676ea8]
test eax, eax
je 0x4fe723
push 0x5b
push eax
call esi
mov dword [0x676e88], eax
mov eax, dword [0x676e88]
test eax, eax
jne 0x4fe740
mov ecx, dword [0x6a0f3c]
push 0x5b
push ecx
call esi
test eax, eax
mov dword [0x676e88], eax
je 0x4fe70c
mov edx, dword [0x6a0f40]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push edi
push 0
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
mov eax, dword [0x6a0f3c]
push eax
push 0x4a8c60
push 2
call edi
test eax, eax
mov dword [0x669818], eax
jne 0x4fe776
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [0x6a0f40]
push 0
push ecx
call esi
mov edx, dword [0x6a0f3c]
push eax
push edx
push 0x4a9db0
push 3
call edi
test eax, eax
mov dword [0x669824], eax
je 0x4fe771
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.MSWHEEL_ROLLMSG
call esi
test eax, eax
mov dword [0x676edc], eax
je 0x4fe771
push str.TaskbarCreated
call esi
xor ecx, ecx
test eax, eax
setne cl
pop edi
mov dword [0x676ee0], eax
pop esi
mov eax, ecx
ret
Function at 0x500a90
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x6a0f40]
push esi
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x64
push 0x89
push eax
call esi
mov ecx, dword [0x6a0f40]
push 0
push 0x3e8
push 0x78
push ecx
call esi
mov edx, dword [0x67b0c8]
push edx
call fcn.00508aa0
add esp, 4
test eax, eax
je 0x500b4a
mov ecx, dword [0x67b0c8]
mov dl, byte [ecx + 0x15ee]
test dl, dl
lea eax, [ecx + 0x15ee]
je 0x500b4a
mov edx, dword [ecx + 0x1720]
test edx, edx
jne 0x500b4a
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov ecx, dword [0x67b0c8]
mov dword [ecx + 0x1720], eax
mov ecx, dword [0x67b0c8]
mov eax, dword [ecx + 0x1720]
cmp eax, 0xffffffff
jne 0x500b37
add ecx, 0x15ee
push 0x132
push ecx
call fcn.004232e0
mov edx, dword [0x67b0c8]
add esp, 8
mov dword [edx + 0x1720], 0
jmp 0x500b4a
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, dword [0x67b0c8]
mov dword [ecx + 0x1720], eax
call fcn.004e76c0
call fcn.00424800
call fcn.00476170
call fcn.005340b0
mov edx, dword [0x6a0f40]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x8047
push edx
call esi
mov eax, dword [0x66ada8]
test eax, eax
je 0x500b90
mov eax, dword [0x6a0f40]
push 0
push 0
push 0x8029
push eax
call esi
mov eax, dword [0x6476a8]
test eax, eax
je 0x500bab
mov ecx, dword [0x6a0f40]
push 0
push 0
push 0x802d
push ecx
call esi
mov eax, dword [0x679ac0]
test eax, eax
je 0x500bc6
mov edx, dword [0x6a0f40]
push 0
push 0
push 0x8033
push edx
call esi
mov eax, dword [0x670140]
test eax, eax
pop esi
je 0x500be9
mov eax, dword [0x6a0f40]
push 1
push 0xc4
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
ret
push 0x66c768
push 0x1068
push 0x676ee8
call fcn.00423310
add esp, 8
push eax
push 0x676ee8
push 0x5f48ec
push 0x5f48e4
push str.about
call fcn.004ce2e0
push 0x5f48f0
push 0x676ee8
call fcn.005f1860
add esp, 0x20
test eax, eax
je 0x500c3e
mov al, byte [0x66e068]
test al, al
je 0x500c3e
jmp fcn.004fe7d0
mov ecx, dword [0x6a0f40]
push 1
push 0xc3
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
ret
Function at 0x5074b0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x61a3bc], 0xffffffff
mov dword [0x61a3b8], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x61a3b8], eax
je 0x507504
xor ecx, ecx
mov cx, word [0x61a3b4]
push ecx
push eax
call fcn.0052f7d0
add esp, 8
test eax, eax
je 0x507504
mov edx, dword [0x61a3b8]
push 5
push edx
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x50750f
push 0
call fcn.00507420
add esp, 4
ret
mov eax, dword [0x6a0f40]
mov ecx, dword [0x61a3b8]
push 8
push 0x8034
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x508fa0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [0x67b0c8]
mov ecx, edx
test ecx, ecx
je 0x50901e
lea esp, [esp]
mov eax, edx
test eax, eax
je 0x508fe0
cmp ecx, eax
je 0x508fc6
mov eax, dword [eax + 0x819c]
test eax, eax
jne 0x508fb6
jmp 0x508fe0
mov eax, dword [ecx + 0x41c]
test eax, eax
je 0x508fe0
cmp dword [ecx + 4], 0xffffffff
je 0x508fe0
mov eax, dword [ecx + 0x4a00]
test eax, eax
je 0x509048
mov eax, edx
test eax, eax
je 0x509014
cmp ecx, eax
je 0x508ff6
mov eax, dword [eax + 0x819c]
test eax, eax
jne 0x508fe6
jmp 0x509014
mov eax, dword [ecx + 0x420]
test eax, eax
jne 0x509048
mov eax, dword [ecx + 0x43c]
test eax, eax
jne 0x509048
mov eax, dword [ecx + 0x42c]
test eax, eax
jne 0x509048
mov ecx, dword [ecx + 0x819c]
test ecx, ecx
jne 0x508fb0
mov eax, dword [0x698854]
test eax, eax
je 0x509043
mov ecx, dword [0x6a0f40]
push 0x84
push ecx
mov dword [0x698854], 0
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x573ae0
mov eax, dword [0x698854]
test eax, eax
jne 0x509043
mov eax, dword [0x6a0f40]
push 0
push 0xc8
push 0x84
push eax
mov dword [0x698854], 1
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x573ae0
mov eax, dword [esp + 4]
mov ecx, 1
cmp eax, ecx
jne 0x573b22
test byte [0x698850], cl
jne 0x573b86
mov eax, dword [0x698850]
or eax, ecx
push 0
mov dword [0x698850], eax
call fcn.005d9ec8
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x82
jmp 0x573b5a
mov ecx, 2
cmp eax, ecx
jne 0x573b67
test byte [0x698850], cl
jne 0x573b86
mov eax, dword [0x698850]
or eax, ecx
push 0
mov dword [0x698850], eax
call fcn.005d9ec8
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x83
mov edx, dword [0x6a0f40]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x61adec]
test eax, eax
je 0x573b86
mov eax, dword [0x698854]
test eax, eax
jne 0x573b86
mov dword [esp + 4], 5
jmp fcn.00573450
ret
Function at 0x50fd70
Capabilities:
Capture screenshot
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
and esi, 1
jne 0x50fd9c
test bl, 2
je 0x50fd9c
mov eax, dword [0x67ba9c]
test eax, eax
je 0x50fe44
mov eax, dword [0x67baa0]
test eax, eax
je 0x50fe44
call fcn.00508b70
test eax, eax
jne 0x50fdb0
pop esi
pop ebx
mov dword [esp + 4], eax
jmp fcn.00421dc0
mov ecx, dword [0x6a0f54]
test ecx, ecx
je 0x50fdd7
call fcn.0050f180
push 0
call fcn.005697b0
add esp, 4
test esi, esi
je 0x50fe35
mov eax, dword [0x6a0f54]
push 0
push eax
jmp 0x50fe2d
push 0x6a0f54
push eax
push 0
push 0
push 7
push str.Notify_List
call fcn.00596330
add esp, 0x18
test eax, eax
mov dword [0x6a0f54], eax
je 0x50fe44
call fcn.0050f180
push 0
call fcn.005697b0
add esp, 4
test esi, esi
je 0x50fe17
mov ecx, dword [0x6a0f54]
push 0
push ecx
jmp 0x50fe2d
test bl, 2
je 0x50fe35
call fcn.00543060
test eax, eax
jne 0x50fe35
mov edx, dword [0x6a0f54]
push eax
push edx
call fcn.004a8560
add esp, 8
pop esi
pop ebx
mov dword [esp + 4], 0
jmp fcn.0055f1c0
pop esi
pop ebx
ret
Function at 0x51bd00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push 0
push 0
push 0x18b
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x51bd35
pop ebp
pop ebx
add esp, 4
mov dword [esp + 4], 0
jmp fcn.00421dc0
dec ebx
mov dword [esp + 8], 0
js 0x51be5e
push esi
push edi
jmp 0x51bd50
push 0x628dc0
push ebx
push 0x189
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, 0xffffffff
je 0x51be5c
mov eax, dword [0x685f48]
xor edi, edi
test eax, eax
jne 0x51bddc
mov esi, dword [0x624634]
test esi, esi
je 0x51be5c
lea esp, [esp]
mov eax, dword [0x685f48]
test eax, eax
je 0x51bda2
cmp dword [esi + 0x564], 2
jne 0x51bdcb
push 0x5c
push esi
call fcn.005da7f0
add esp, 8
test eax, eax
je 0x51bdcb
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x51bdcb
push 0x628dc0
push eax
call fcn.005f1860
add esp, 8
test eax, eax
je 0x51bdfd
mov edi, esi
mov esi, dword [esi + 0x59c]
test esi, esi
jne 0x51bd90
jmp 0x51be5c
mov esi, dword [0x688fc4]
test esi, esi
je 0x51be5c
cmp dword [esi + 0x564], 2
je 0x51bd81
mov edi, esi
mov esi, dword [esi + 0x59c]
test esi, esi
jne 0x51bde6
jmp 0x51be5c
test edi, edi
je 0x51be19
mov eax, dword [esi + 0x59c]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x59c], eax
mov dword [esi + 0x59c], ecx
jmp 0x51be51
mov eax, dword [0x685f48]
test eax, eax
jne 0x51be35
mov edx, dword [0x624634]
mov eax, dword [edx + 0x59c]
mov dword [0x624634], eax
jmp 0x51be47
mov ecx, dword [0x688fc4]
mov edx, dword [ecx + 0x59c]
mov dword [0x688fc4], edx
mov eax, dword [esp + 0x10]
mov dword [esi + 0x59c], eax
dec ebx
mov dword [esp + 0x10], esi
jns 0x51bd50
pop edi
pop esi
mov eax, dword [0x685f48]
test eax, eax
jne 0x51be9b
mov edx, dword [esp + 8]
test edx, edx
mov eax, edx
je 0x51bec2
mov ecx, dword [eax + 0x59c]
test ecx, ecx
je 0x51be85
mov eax, ecx
test eax, eax
jne 0x51be71
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [0x624634]
pop ebp
mov dword [eax + 0x59c], ecx
mov dword [0x624634], edx
pop ebx
pop ecx
ret
mov eax, dword [0x688fc4]
test eax, eax
je 0x51bec2
mov ecx, dword [eax + 0x59c]
test ecx, ecx
je 0x51beb8
mov eax, ecx
test eax, eax
jne 0x51bea4
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 8]
mov dword [eax + 0x59c], edx
pop ebp
pop ebx
pop ecx
ret
Function at 0x52f7d0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x687440]
sub esp, 0x10
test eax, eax
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_htons]
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_bind]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x28]
je 0x52f85b
mov al, byte [0x687448]
test al, al
je 0x52f85b
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0x687448
mov dword [esp + 0x20], eax
mov word [esp + 0x14], 2
call dword [sym.imp.WSOCK32.dll_inet_addr]
push edi
mov dword [esp + 0x18], eax
call ebx
push 0x10
lea ecx, [esp + 0x14]
push ecx
push esi
mov word [esp + 0x1e], ax
call ebp
test eax, eax
jne 0x52f848
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
cmp dword [0x687440], 2
jne 0x52f85b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
push edi
mov dword [esp + 0x20], edx
mov word [esp + 0x14], 2
mov dword [esp + 0x18], edx
call ebx
mov word [esp + 0x12], ax
push 0x10
lea eax, [esp + 0x14]
push eax
push esi
call ebp
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x10
ret
Function at 0x533790
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x438
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push 0x432
push eax
call fcn.00423310
mov ebx, dword [esp + 0x454]
mov ebp, dword [esp + 0x450]
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
push 0
push ebx
push ebp
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x5337e2
pop esi
pop ebp
mov eax, 0x3f3
pop ebx
add esp, 0x438
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea esp, [esp]
mov eax, dword [esp + 0x10]
push esi
lea edx, [esp + 0x18]
push edx
push 0
push eax
call edi
test eax, eax
jne 0x533819
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.00533790
add esp, 8
test eax, eax
je 0x5337f0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x438
ret
Function at 0x5340b0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov eax, dword [0x636b78]
test eax, eax
jne 0x5340c7
mov eax, dword [0x61b0a0]
test eax, eax
je 0x5340c7
jmp fcn.00533e30
ret
Function at 0x542106
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2f9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 1
mov dword [esp + 8], esi
call fcn.0059b52d
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 8
call fcn.005aa4ef
lea ecx, [esi + 0x48]
mov byte [esp + 0x10], 9
call fcn.005aa4ef
mov ecx, dword [esp + 8]
mov byte [esi + 0x5c], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x543470
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x68d3e4]
test eax, eax
push esi
push edi
jl 0x543495
cmp eax, 2
jg 0x543495
mov esi, dword [esp + 0xc]
push 0
push 0x132
push esi
call fcn.00518d80
push 4
jmp 0x5434f0
cmp eax, 3
jne 0x5434d8
mov esi, dword [esp + 0xc]
push 0
push 0x132
push esi
call fcn.00518d80
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 0
push 0x132
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x132
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x543526
cmp eax, 4
jne 0x543548
mov esi, dword [esp + 0xc]
push 0
push 0x132
push esi
call fcn.00518d80
push 5
push 0x132
push esi
call fcn.00518d80
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x18
push 1
push 0x132
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 8
push 0x132
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0x132
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x132
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
ret
Function at 0x545580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x68d3e0]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x542fe1
mov ecx, dword [0x68d3e0]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x542ff0
mov edx, dword [0x68d3e0]
push 9
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x68d3e0]
push esi
push 3
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x68d3e0]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [0x68d3e0]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esp + 8]
mov ecx, dword [0x68d3e0]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x65
push ecx
call esi
push eax
call fcn.00563200
mov edx, dword [0x68d3e0]
add esp, 8
push 0x12c
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
ret
mov eax, dword [0x68d3e0]
test eax, eax
je 0x5455bb
mov ecx, dword [0x68d3e4]
test ecx, ecx
jne 0x54559b
push eax
call fcn.0040f310
jmp 0x5455b3
cmp ecx, 1
jne 0x5455a8
push eax
call fcn.00520530
jmp 0x5455b3
cmp ecx, 2
jl 0x5455bb
push eax
call fcn.005301e0
mov eax, dword [0x68d3e0]
add esp, 4
mov ecx, dword [esp + 4]
sub ecx, 0
je 0x54562f
dec ecx
je 0x545609
test eax, eax
je 0x5455f4
push eax
call fcn.00530000
mov eax, dword [0x68d3e4]
add esp, 4
cmp eax, 2
jge 0x5455eb
mov dword [esp + 4], 2
jmp 0x542fc0
mov dword [esp + 4], eax
jmp 0x542fc0
cmp dword [0x68d3e4], 2
jge 0x545653
mov dword [0x68d3e4], 2
jmp 0x545653
test eax, eax
je 0x545623
push eax
call fcn.005203a0
add esp, 4
mov dword [esp + 4], 1
jmp 0x542fc0
mov dword [0x68d3e4], 1
jmp 0x545653
test eax, eax
je 0x545649
push eax
call fcn.0040f200
add esp, 4
mov dword [esp + 4], 0
jmp 0x542fc0
mov dword [0x68d3e4], 0
mov eax, dword [0x61a9a4]
test eax, eax
je 0x545663
mov eax, dword [0x6a0f40]
jmp 0x545669
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
push 0x5443a0
push eax
mov eax, dword [0x6a0f3c]
push 0x2e4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
jne 0x54568f
mov dword [esp + 4], eax
jmp fcn.00421dc0
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x545d00
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x1068
call fcn.005d9990
mov eax, dword [0x68d418]
test eax, eax
je 0x545e5e
push esi
mov esi, dword [esp + 0x1070]
push edi
cmp eax, esi
je 0x545d37
mov eax, dword [eax + 0xd1c]
test eax, eax
jne 0x545d20
pop edi
pop esi
add esp, 0x1068
ret
mov eax, dword [esi]
push eax
call fcn.00508b30
mov edi, eax
add esp, 4
test edi, edi
je 0x545e5c
push ebx
mov bl, byte [esp + 0x1084]
test bl, 1
je 0x545da6
push 0
push 0x1391
call fcn.00424130
push eax
push 1
push 0
push 1
push 1
push esi
call fcn.00571680
mov ecx, dword [esp + 0x109c]
push ecx
lea edx, [esi + 0x7cc]
push edx
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x38]
push str.NOTICE__s_:DCC_Send__s___s__n
push ecx
call fcn.005d9929
push edi
lea edx, [esp + 0x44]
push 0
push edx
call fcn.00598db0
add esp, 0x40
test bl, 2
je 0x545df4
fld qword [esi + 0xc40]
fcomp qword [0x5f56a0]
fnstsw ax
test ah, 1
jne 0x545dcc
mov eax, dword [esi + 0xc40]
mov ecx, dword [esi + 0xc44]
jmp 0x545dd0
xor eax, eax
xor ecx, ecx
push edi
push 0
push ecx
mov ecx, dword [esp + 0x108c]
push eax
xor eax, eax
mov ax, word [esi + 0xc20]
lea edx, [esi + 0x7cc]
push eax
push ecx
push edx
lea eax, [esi + 4]
push eax
jmp 0x545e35
test bl, 4
je 0x545e3d
mov ecx, dword [esi + 0xc08]
push edi
push ecx
push esi
call fcn.00545960
xor edx, edx
mov dx, word [esi + 0xc20]
push ecx
fstp qword [esp]
lea eax, [esi + 0x268]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea ecx, [esi + 0x7cc]
push ecx
lea edx, [esi + 4]
push edx
call fcn.00545b50
add esp, 0x20
push 0
push 0x1392
call fcn.00424130
push eax
push 0
push 0
push 0
push 0
push esi
call fcn.00571680
add esp, 0x20
pop ebx
pop edi
pop esi
add esp, 0x1068
ret
Function at 0x5476e0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0xd18]
push eax
call fcn.00508aa0
add esp, 4
test eax, eax
jne 0x547711
push 0x5f4c90
push eax
push esi
call fcn.00546ec0
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x18
ret
push edi
lea edi, [esi + 0x268]
push edi
mov dword [esi + 0xc04], 1
mov dword [esi + 0xce0], 0
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov ecx, dword [0x649040]
mov dword [esp + 0x24], eax
jne 0x547785
test ecx, ecx
je 0x547750
mov edx, dword [0x64903c]
test edx, edx
jne 0x547785
mov eax, dword [esi + 0xcb4]
test eax, eax
je 0x547779
mov edx, dword [esi]
push 8
push 0
push edi
lea ecx, [esi + 4]
push ecx
push edx
call fcn.0047fc10
add esp, 0x14
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
push 0
push 0x138d
jmp 0x5478bd
test ecx, ecx
je 0x5477ea
push 0
push 0x138e
call fcn.00424130
push eax
push 1
push 0
push 1
push 1
push esi
call fcn.00571680
mov eax, dword [esi + 0xc08]
add esp, 0x20
test eax, eax
jne 0x5477bc
call fcn.004230d0
mov dword [esi + 0xc08], eax
mov eax, dword [esi + 0xd18]
mov ecx, dword [esi + 0xc08]
xor edx, edx
mov dx, word [esi + 0xc20]
push eax
push ecx
push 0
push edx
push edi
call fcn.00497450
add esp, 0x14
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
xor eax, eax
mov ax, word [esi + 0xc20]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov word [esp + 0x10], 2
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esp + 8]
mov word [esp + 0x12], ax
mov edx, dword [ecx]
push 1
xor eax, eax
mov ax, word [0x61a70c]
push 0
xor ecx, ecx
mov cx, word [0x61a708]
push 2
push 0
mov dword [esp + 0x24], edx
push eax
push ecx
call fcn.0052f8a0
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0xd14], eax
jne 0x54786d
push 0
push 0x138f
jmp 0x5478bd
push eax
call fcn.00598890
mov edx, dword [0x6a0f40]
mov eax, dword [esi + 0xd14]
add esp, 4
push 0x10
push 0x8014
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edx, dword [esi + 0xd14]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x5478ce
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x5478ce
push 0
push 0x1390
call fcn.00424130
push eax
push 0
push esi
call fcn.00546ec0
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x5478e0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x68d418]
test eax, eax
push esi
push edi
je 0x547a86
mov esi, dword [esp + 0xc]
cmp eax, esi
je 0x547904
mov eax, dword [eax + 0xd1c]
test eax, eax
jne 0x5478f3
pop edi
pop esi
ret
mov eax, dword [esi + 0xd18]
push eax
call fcn.00508aa0
add esp, 4
test eax, eax
jne 0x54792b
push 0x5f4c90
push eax
push esi
call fcn.00546ec0
add esp, 0xc
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0xd10]
test eax, eax
mov dword [esi + 0xc04], 1
mov dword [esi + 0xce0], 0
je 0x547971
mov word [esi + 0xc20], 0
call fcn.004230d0
mov dword [esi + 0xc08], eax
mov eax, dword [esi + 0xd18]
mov ecx, dword [eax + 0x1720]
push 5
push ecx
jmp 0x547aaf
mov eax, dword [0x649040]
test eax, eax
je 0x547a3a
mov edx, dword [esi + 0xd18]
push edx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
call fcn.00497450
mov al, byte [0x648c98]
add esp, 0x14
test al, al
je 0x547a1b
mov eax, dword [0x649048]
test eax, eax
lea edi, [esi + 0x268]
je 0x5479b4
push 0x648c98
jmp 0x5479c0
mov eax, dword [esi + 0xd18]
add eax, 0x15ee
push eax
push 0x132
push edi
call fcn.00425550
mov eax, dword [esi + 0xc08]
add esp, 0xc
test eax, eax
mov word [esi + 0xc20], 0
jne 0x5479ec
call fcn.004230d0
mov dword [esi + 0xc08], eax
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x547a24
mov ecx, dword [esi + 0xd18]
mov edx, dword [ecx]
push 9
push 0
push edi
push str.firewall
push edx
call fcn.0047fc10
add esp, 0x14
test eax, eax
jne 0x547abe
push 0
push 0x1393
jmp 0x547a75
push 5
push 0
push edi
push esi
call fcn.00545d00
add esp, 0x10
pop edi
mov eax, 1
pop esi
ret
push 1
xor ecx, ecx
mov cx, word [0x61a70c]
push 1
xor edx, edx
mov dx, word [0x61a708]
push 0
lea eax, [esi + 0xc20]
push eax
push ecx
push edx
call fcn.0052f8a0
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0xd14], eax
jne 0x547a8b
push 0
push 0x138f
call fcn.00424130
push eax
push 0
push esi
call fcn.00546ec0
add esp, 0x14
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [0x6a0f40]
push 8
push 0x8015
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0xd18]
mov edx, dword [eax + 0x1720]
push 3
push edx
add eax, 0x15ee
push eax
push esi
call fcn.00545d00
add esp, 0x10
pop edi
mov eax, 1
pop esi
ret