joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431f70
Capabilities:
Create thread
Create udp socket

Disassembly:
push ecx
push ebp
push esi
push edi
push 0x48
push 1
mov esi, eax
call dword [0x515354]
mov edi, eax
xor eax, eax
add esp, 8
cmp edi, eax
mov dword [esp + 0xc], 0xc
mov dword [ebx + 0x3ac], edi
je 0x432049
mov dword [ebx + 0x39c], esi
mov dword [ebx + 0x3a4], eax
mov dword [ebx + 0x3a8], eax
mov dword [ebx + 0x3a0], eax
mov dword [edi], eax
mov eax, dword [esp + 0x14]
push esi
lea ebp, [edi + 0x10]
push eax
mov esi, ebp
mov dword [edi + 4], 0xffffffff
call fcn.00431d80
add esp, 8
test eax, eax
je 0x432049
mov eax, dword [ebx + 0x398]
test eax, eax
je 0x431fe9
push eax
call dword [0x515348]
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call dword [0x515350]
add esp, 4
test eax, eax
mov dword [ebx + 0x398], eax
je 0x432049
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x432049
push 0
push 0
push ebp
push 0x431e70
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x432035
cmp eax, 0xffffffff
jne 0x432037
xor eax, eax
test eax, eax
mov dword [edi], eax
jne 0x432066
call dword [sym.imp.MSVCR80.dll__errno]
mov edx, dword [eax]
mov dword [esp + 0xc], edx
lea edi, [ebx + 0x398]
call fcn.00431f00
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x432640
Capabilities:
Get socket status

Disassembly:
sub esp, 0x318
push ebx
push ebp
push edi
xor edi, edi
cmp esi, edi
je 0x43265f
xor eax, eax
cmp dword [esi + eax*8], 0xffffffff
jne 0x432677
add eax, 1
cmp eax, 1
jb 0x432651
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
add esp, 0x318
ret
mov eax, dword [esi]
or ebp, 0xffffffff
cmp eax, 0xffffffff
mov dword [esp + 0x114], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x21c], edi
mov word [esi + 6], di
je 0x4326de
movzx ecx, word [esi + 4]
test cl, 7
je 0x4326de
cmp eax, 0xffffffff
jbe 0x4326a7
mov ebp, eax
mov edx, 1
test dl, cl
je 0x4326be
mov dword [esp + 0x118], eax
mov dword [esp + 0x114], edx
test cl, 4
je 0x4326cb
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
test cl, 2
je 0x4326de
mov dword [esp + 0x220], eax
mov dword [esp + 0x21c], edx
mov ebx, dword [sym.imp.WS2_32.dll_select]
add ebp, 1
jmp 0x4326f2
xor edi, edi
push edi
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x120]
push edx
push ebp
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x432723
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4326f0
cmp eax, 0x2714
je 0x4326f0
test edi, edi
jl 0x43266a
jne 0x432739
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x318
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, 0xffffffff
mov word [esi + 6], di
je 0x432798
lea ecx, [esp + 0x114]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43275d
or word [esi + 6], 1
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x432773
or word [esi + 6], 4
mov edx, dword [esi]
lea ecx, [esp + 0x21c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43278c
or word [esi + 6], 2
cmp word [esi + 6], 0
je 0x432798
mov edi, 1
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x318
ret
Function at 0x433460
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
push eax
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x433498
push eax
push 0x4f0fac
call fcn.0042dec0
add esp, 8
jmp 0x4334d0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ax, word [esp + 8]
cmp al, 2
jne 0x4334c3
test ah, ah
jne 0x4334c3
xor eax, eax
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00459ea4
add esp, 0x1a0
ret
push 0x4f0fc4
call fcn.0042dec0
add esp, 4
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
mov eax, 2
call fcn.00459ea4
add esp, 0x1a0
ret

Function at 0x4336a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov al, byte [esp + 8]
push ebp
mov ebp, dword [esp + 8]
mov edx, dword [ebp + 0x128]
push esi
mov esi, dword [ebp]
push edi
push 0
push 3
lea ecx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], al
mov byte [esp + 0x22], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x4336e9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x4f1038
call fcn.0042dec0
add esp, 8
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
mov eax, ebx
mov edi, 0x4f1054
call fcn.004335a0
pop edi
pop esi
pop ebp
ret
Function at 0x43e200
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x90
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [ebp]
push edi
mov edi, dword [ebp + 0x3c8]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x80
mov edx, dword [edi + 0x154]
mov eax, dword [edi + 0x15c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [edi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x148], 0
mov dword [edi + 0x14c], eax
jne 0x43e289
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [edi + 0xc8]
push ecx
call fcn.004c7ae8
mov edx, dword [esp + 0x20]
add esp, 0xc
mov dword [edi + 0x148], edx
mov ecx, dword [edi + 0x14c]
cmp ecx, 4
jge 0x43e2c3
push 0x4f25c0
call fcn.0042dec0
add esp, 4
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00459ea4
add esp, 0x90
ret
mov edx, dword [edi + 0x15c]
xor eax, eax
mov ah, byte [edx]
movzx edx, byte [edx + 1]
movzx eax, ax
or eax, edx
mov dword [edi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x43e2e5
jmp dword [eax*4 + 0x43e3f0]
cmp ecx, 4
jle case.0x43e2e5.4
mov eax, dword [edi + 0x15c]
xor edx, edx
mov dh, byte [eax + 2]
mov dl, byte [eax + 3]
movzx eax, word [edi + 0x40]
add eax, 1
and eax, 0xffff
cmp eax, edx
jne case.0x43e2e5.4
mov edx, dword [edi + 0x15c]
add edx, 4
push edx
add ecx, 0xfffffffc
mov edx, 1
mov eax, ebp
call fcn.0042e280
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43e34c
mov ecx, 5
mov eax, edi
call fcn.0043df20
mov eax, ebx
jmp 0x43e2aa
mov eax, dword [edi + 0x14c]
sub eax, 4
cdq
add dword [esi + 0x38], eax
mov eax, dword [esi + 0x38]
adc dword [esi + 0x3c], edx
mov dword [esi + 0x428], eax
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x42c], ecx
jmp case.0x43e2e5.4
mov eax, dword [edi + 0x15c]
xor edx, edx
mov dh, byte [eax + 2]
mov dl, byte [eax + 3]
mov eax, dword [edi + 0x15c]
add eax, 4
push eax
push 0x4eab34
mov dword [edi + 8], edx
call fcn.0042de00
jmp 0x43e3c6
add ecx, 0xfffffffe
push ecx
mov ecx, dword [edi + 0x15c]
add ecx, 2
push ecx
push edi
call fcn.0043d1f0
add esp, 0xc
test eax, eax
je case.0x43e2e5.4
jmp 0x43e2aa
push 0x4f25dc
push 0x4da460
call fcn.0042dec0
add esp, 8
push ebp
call fcn.00436420
add esp, 4
test eax, eax
je 0x43e2a8
mov ecx, 5
mov eax, edi
call fcn.0043df20
mov eax, 0x2a
jmp 0x43e2aa
Function at 0x43e8d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov ebx, dword [edi + 0x3c8]
lea eax, [esp + 0xc]
push eax
mov eax, edi
mov dword [esp + 0x18], esi
call fcn.0043e400
mov ecx, dword [ebp + 0xc]
add esp, 4
test eax, eax
mov dword [ecx], 0
jg 0x43e923
push 0x4f2600
call fcn.0042dec0
add esp, 4
mov eax, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
cmp ecx, 0xffffffff
je 0x43e955
mov eax, ebx
call fcn.0043df20
test eax, eax
jne 0x43ea8d
cmp dword [ebx], 3
mov edx, dword [ebp + 0xc]
sete al
test eax, eax
mov dword [edx], eax
je 0x43ea8b
mov ecx, edi
jmp 0x43ea74
mov esi, dword [ebx + 0x14]
cmp esi, 0xffffffff
je 0x43ea8b
mov eax, 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x124], esi
mov dword [esp + 0x120], eax
mov dword [esp + 0x228], 0
lea edi, [esi + 1]
lea ebx, [ebx]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x43e9d3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x43e990
cmp eax, 0x2714
je 0x43e990
jmp 0x43ea0d
test eax, eax
jl 0x43ea0d
je 0x43ea8b
lea ecx, [esp + 0x18]
push ecx
push esi
xor edi, edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43e9f3
mov edi, 1
lea edx, [esp + 0x120]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43ea08
or edi, 4
cmp edi, 0xffffffff
jne 0x43ea41
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 8]
push ecx
call fcn.004482a0
mov esi, dword [esp + 0x18]
add esp, 4
push eax
push 0x4da460
call fcn.0042dec0
add esp, 8
mov dword [ebx + 0xc], 5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x43ea8b
mov esi, dword [ebp + 8]
push esi
call fcn.0043e200
add esp, 4
test eax, eax
jne 0x43ea8d
mov ecx, dword [ebx + 0xc]
mov eax, ebx
call fcn.0043df20
test eax, eax
jne 0x43ea8d
cmp dword [ebx], 3
mov edx, dword [ebp + 0xc]
sete al
test eax, eax
mov dword [edx], eax
je 0x43ea8b
mov ecx, esi
push 0
push 0
push 0
or eax, 0xffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
or edx, eax
call fcn.0042ca30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ec10
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov dword [esp + 0x24], 0
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov esi, edx
shr esi, 6
mov edx, esi
imul edx, edx, 0x3e8
mov ebx, dword [edi + 0x120]
sub ecx, edx
imul ecx, ecx, 0x3e8
sub ecx, dword [edi + 0x124]
mov eax, 0x10624dd3
imul ecx
sub esi, ebx
imul esi, esi, 0x3e8
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, esi
cmp ecx, ebp
jg 0x43ed33
lea ecx, [ecx]
mov ebx, dword [esp + 0x14]
mov eax, ebp
push 0xffffffffffffffff
sub eax, ecx
push ebx
call fcn.004323b0
add esp, 8
test eax, eax
jle 0x43ed50
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push 0
push esi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x43ecca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x43ece0
mov eax, 0x38
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp esi, eax
je 0x43ed3d
test eax, eax
je 0x43ed50
add dword [esp + 0x18], eax
sub esi, eax
add dword [esp + 0x24], eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov esi, edx
shr esi, 6
mov edx, esi
imul edx, edx, 0x3e8
mov ebx, dword [edi + 0x120]
sub ecx, edx
imul ecx, ecx, 0x3e8
sub ecx, dword [edi + 0x124]
mov eax, 0x10624dd3
imul ecx
sub esi, ebx
imul esi, esi, 0x3e8
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, esi
cmp ecx, ebp
jle 0x43ec80
mov eax, 0x1c
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add eax, ecx
mov dword [edx], eax
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x43f960
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call dword [sym.imp.MSVCR80.dll_getenv]
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x43f9c6
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x43f9c6
lea edx, [esp]
push edx
call dword [0x515350]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00459ea4
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.00459ea4
add esp, 0x108
ret

Function at 0x43f9e0
Capabilities:
Parse pe header

Disassembly:
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x43f9eb
jmp dword [ecx*4 + 0x43fa40]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x441fd0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x28
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [eax + 0x12c]
push esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0x10
mov ecx, dword [ebp + 0x194]
xor eax, eax
test ecx, ecx
mov esi, 0x493e0
jle 0x44201c
mov eax, 1
mov edx, dword [ebp + 0x198]
test edx, edx
jle 0x442029
or eax, 2
sub eax, 1
je 0x442040
sub eax, 1
je 0x44203c
sub eax, 1
jne 0x442042
cmp ecx, edx
jl 0x442040
mov esi, edx
jmp 0x442042
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov ebx, edx
shr ebx, 6
mov edx, ebx
imul edx, edx, 0x3e8
mov edi, dword [ebp + 0x4a0]
sub ecx, edx
imul ecx, ecx, 0x3e8
sub ecx, dword [ebp + 0x4a4]
mov eax, 0x10624dd3
imul ecx
sub edi, ebx
imul edi, edi, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add esi, edi
je 0x4420f2
test esi, esi
jl 0x4420f2
mov eax, 0x3e8
cmp esi, eax
jge 0x4420a0
mov eax, esi
mov esi, dword [esp + 0x20]
push 0xffffffffffffffff
push esi
call fcn.004323b0
add esp, 8
cmp eax, 0xffffffff
je 0x442163
test eax, eax
je 0x442006
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x442105
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x24], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
jmp 0x442109
push 0x4f3050
mov esi, ebp
call fcn.0042dec0
mov eax, 0x1c
jmp 0x442174
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp edi, 0xffffffff
mov esi, ebp
jne 0x44211e
push 0x4f30a4
jmp 0x44216a
push 0x4f30c8
call fcn.0042de00
mov edx, dword [esp + 0x18]
add esp, 4
lea eax, [esp + 0x14]
push eax
push 0x8004667e
push edi
mov dword [edx + 0x12c], edi
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00459ea4
add esp, 0x28
ret
push 0x4f307c
mov esi, ebp
call fcn.0042dec0
mov eax, 0x1e
mov ecx, dword [esp + 0x38]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00459ea4
add esp, 0x28
ret
Function at 0x443e30
Capabilities:
Check http status code

Disassembly:
push ecx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebp
mov ebp, dword [esp + 0xc]
mov eax, edx
push esi
mov esi, dword [ebx]
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
cmp eax, 2
je 0x443e67
push 0x4f3510
call fcn.0042dec0
add esp, 4
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebp
pop ecx
ret
cmp ecx, 0xc8
je 0x443e7d
push ecx
push 0x4f352c
call fcn.0042de00
add esp, 8
cmp ebp, 0x13
jne 0x443e90
mov esi, ebx
call fcn.00442d50
mov edi, eax
pop edi
pop esi
pop ebp
pop ecx
ret
cmp ebp, 0x14
jne 0x443ea5
push ebx
call fcn.00442da0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebp
pop ecx
ret
cmp ebp, 0x15
jne 0x443ebe
push 0xd
push 1
push ebx
call fcn.004431f0
add esp, 0xc
mov edi, eax
pop edi
pop esi
pop ebp
pop ecx
ret
cmp ebp, 0x16
jne 0x443ed2
push 0xe
push 1
push ebx
call fcn.004431f0
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x446c10
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x446ca5
cmp word [ebx + 8], 2
push edi
jne 0x446c75
cmp word [ebx + 0xa], 4
jne 0x446c75
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x446c75
jmp 0x446c50
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ebp
push eax
push ecx
call fcn.00446ba0
test eax, eax
mov dword [esi], eax
je 0x446c99
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x446c50
mov edx, dword [ebx]
mov eax, dword [esp + 0x20]
push 0x400
push edx
push 0x401
push eax
call dword [sym.imp.MSVCR80.dll_strncpy_s]
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x446cb5.11001
jmp dword [eax*4 + 0x446ce0]
pop esi
pop ebp
mov eax, 0x2af9
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afa
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
ret 0x10
Function at 0x447510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x238], eax
cmp dword [0x53c2d0], 0
push ebx
push esi
push edi
mov dword [esp + 0x10], 0x4f3b14
mov dword [esp + 0x14], 0x446f70
mov dword [esp + 0x18], 0x4f3b08
mov dword [esp + 0x1c], 0x447250
mov dword [esp + 0x20], 0x4f3af8
mov dword [esp + 0x24], fcn.00446f20
je 0x447588
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x5377ec]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00459ea4
mov esp, ebp
pop ebp
ret 4
push 0x104
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x447695
mov edi, dword [sym.imp.MSVCR80.dll_strcpy_s]
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call edi
mov ebx, dword [sym.imp.MSVCR80.dll_strcat_s]
push str.6y_u
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call ebx
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4475ff
push 0x4f3b14
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x447653
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call edi
push 0x4f3b3c
lea edx, [esp + 0x38]
push 0x10c
push edx
call ebx
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x447695
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4f3b14
push esi
call ebx
test eax, eax
jne 0x447659
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x447695
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
jmp 0x447660
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x44764a
add edi, 1
cmp edi, 3
jl 0x447660
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x5377ec], edx
mov dword [0x5377f4], eax
mov dword [0x5377fc], ecx
movzx edx, word [ebp + 8]
mov ecx, dword [esp + 0x244]
mov eax, dword [edx*8 + 0x5377ec]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x53c2d0], 1
call fcn.00459ea4
mov esp, ebp
pop ebp
ret 4

Function at 0x448e80
Capabilities:
Set socket configuration

Disassembly:
push ecx
lea ecx, [esp]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret
Function at 0x44aba0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebx, eax
mov eax, dword [ebx + 0x2c]
push esi
push edi
mov edi, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x19c]
test eax, eax
jne 0x44abbf
mov eax, dword [ebx + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
call ebp
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov esi, edx
shr esi, 6
mov edx, esi
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov eax, ecx
sub eax, dword [ebx + 0x24]
mov ecx, dword [ebx + 0x20]
mov edx, eax
mov eax, 0x10624dd3
imul edx
sub ecx, esi
imul ecx, ecx, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, dword [esp + 0x14]
cmp dword [edi + 0x194], 0
mov ebx, ecx
je 0x44ac78
call ebp
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov esi, edx
shr esi, 6
mov edx, esi
imul edx, edx, 0x3e8
sub ecx, edx
mov edx, dword [esp + 0x18]
imul ecx, ecx, 0x3e8
mov eax, ecx
sub eax, dword [edx + 0x11c]
mov ecx, dword [edx + 0x118]
mov edx, eax
mov eax, 0x10624dd3
imul edx
sub ecx, esi
imul ecx, ecx, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, dword [edi + 0x194]
mov eax, ecx
cmp ebx, eax
jge 0x44ac7a
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x44ae70
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x424
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x420], eax
mov eax, dword [esp + 0x428]
push ebx
push ebp
mov ebp, dword [edi + 0x2c]
mov ecx, dword [ebp]
mov dword [esp + 0x20], ecx
push esi
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x1c], ecx
xor ebx, ebx
push 0x435dc0
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x3fd
call fcn.004353a0
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, ebx
je 0x44aedd
cmp eax, dword [esp + 0x1c]
jne 0x44aed7
mov edx, dword [esp + 0x18]
mov byte [edx - 1], bl
jmp 0x44aedd
mov eax, dword [esp + 0x18]
mov byte [eax], bl
lea eax, [esp + 0x28]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x44aee4
mov cx, word [0x4efb8c]
mov dl, byte [0x4efb8e]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x28]
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x44af08
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x2c]
mov dword [edi + 8], ebx
mov ecx, dword [eax]
add ecx, 0x52c
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], ecx
mov ecx, dword [ebp + 0x128]
xor eax, eax
cmp ecx, dword [ebp + 0x12c]
lea edx, [esp + 0x14]
push edx
sete al
push esi
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x20], ebx
mov edx, dword [ebp + eax*4 + 0x138]
push eax
push ebp
call edx
mov ebx, eax
xor edx, edx
add esp, 0x14
cmp ebx, edx
jge 0x44af9e
mov eax, dword [esp + 0x14]
cmp eax, edx
je 0x44afec
cmp eax, 0x51
jne 0x44b050
xor ebx, ebx
mov ecx, dword [ebp]
cmp dword [ecx + 0x2d8], edx
mov dword [esp + 0x10], edx
je 0x44afbe
push ebp
push ebx
lea eax, [esp + 0x30]
push eax
push 2
call fcn.0042e550
add esp, 0x10
cmp ebx, esi
je 0x44b024
sub esi, ebx
push esi
call dword [0x515344]
add esp, 4
test eax, eax
mov dword [edi + 0x14], eax
je 0x44b009
push esi
lea ecx, [esp + ebx + 0x2c]
push ecx
push eax
call fcn.004c7ae8
add esp, 0xc
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
jmp 0x44b04c
mov eax, 0x37
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00459ea4
add esp, 0x424
ret
mov esi, dword [esp + 0x24]
push 0x4f4edc
call fcn.0042dec0
add esp, 4
mov dword [esp + 0x10], 0x1b
jmp 0x44b04c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x42c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00459ea4
add esp, 0x424
ret