joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454f70
Capabilities:
Get hostname
Set socket configuration

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 4]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x454f99
cmp byte [eax], 0x2d
jne 0x455070
push 0x68
push eax
call fcn.005cbf10
add esp, 8
test eax, eax
je 0x455002
mov esi, dword [esp + 0x18]
push 0x5a
push esi
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x45511c
mov edi, dword [esp + 0x20]
lea ebp, [edi + 0x83c]
mov byte [esi + 0x5a], bl
mov edx, ebp
mov dword [edi + 0x904], ebx
mov byte [edi + 0x8a0], bl
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x454fd0
push ebp
call fcn.00552160
mov eax, dword [esp + 0x20]
mov ecx, dword [edi]
push 0x33
push eax
push ebp
push 0x5e6c98
push ecx
call fcn.0047e8b0
add esp, 0x18
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov edx, dword [ebp + 4]
push 0x75
push edx
call fcn.005cbf10
add esp, 8
test eax, eax
je 0x455070
mov esi, dword [esp + 0x20]
push esi
call fcn.00502d00
add esp, 4
test eax, eax
jne 0x45503a
mov eax, dword [ebp]
push 0xc
push ebx
push eax
push ebx
call fcn.0048a440
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0xf28]
mov edx, dword [esi]
imul eax, eax, 0x64
push ecx
push ebx
push 0xa
push ebx
push edx
push ebx
push 5
push ebx
push ebx
lea ecx, [eax + esi + 0xdfc]
push ebx
push ecx
call fcn.005771b0
add esp, 0x2c
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
ret
mov edx, dword [ebp + 4]
cmp edx, ebx
je 0x45511c
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x455080
sub eax, esi
cmp eax, 0x5a
jbe 0x455091
mov byte [edx + 0x5a], bl
mov edi, dword [esp + 0x20]
mov ecx, dword [ebp + 4]
lea esi, [edi + 0x83c]
mov edx, esi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x4550a0
push esi
call fcn.00552160
mov edx, dword [ebp + 8]
add esp, 4
cmp edx, ebx
je 0x45511c
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4550c0
sub eax, esi
cmp eax, 0x5a
jbe 0x4550d1
mov byte [edx + 0x5a], bl
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [edi + 0x904], eax
jne 0x4550fc
mov dword [edi + 0x904], ebx
mov byte [edi + 0x8a0], bl
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [edi + 0x904], eax
mov ecx, dword [ebp + 8]
lea edx, [edi + 0x8a0]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x455112
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x45db40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 4]
test eax, eax
push edi
jne 0x45db73
mov byte [0x63e7b8], al
mov eax, dword [0x645324]
push eax
call fcn.00496030
add esp, 4
test eax, eax
jne 0x45db6a
call fcn.00426060
pop edi
pop ebp
mov eax, 1
pop ebx
ret
cmp byte [eax], 0x40
push esi
jne 0x45dc65
mov ecx, dword [esp + 0x20]
push ecx
push eax
call fcn.00503170
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x45dba6
mov edx, dword [ebp]
push 7
push eax
push edx
push eax
call fcn.0048a440
add esp, 0x10
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [ebx + 0x75c]
test ecx, ecx
lea eax, [ebx + 8]
je 0x45dbb4
inc eax
mov edi, dword [esp + 0x18]
push eax
push 0x5e773c
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
push ebp
push edi
push 2
call fcn.00515990
push 0xf
push edi
call fcn.00551b90
push 0xa
push edi
call fcn.00551e50
push 0xd
push edi
call fcn.00551e50
mov eax, edi
add esp, 0x30
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45dbf0
sub eax, edx
mov esi, eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, esi
jne 0x45dc51
mov esi, dword [esp + 0x1c]
mov ecx, dword [ebx]
push 0x3b5
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45dc44
test cl, cl
je 0x45dc40
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45dc44
add eax, 2
add esi, 2
test cl, cl
jne 0x45dc20
xor eax, eax
jmp 0x45dc49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x45dcdf
mov eax, dword [ebx]
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret
push 0x5e9594
push eax
call fcn.005e31f5
add esp, 8
neg eax
sbb eax, eax
mov ecx, dword [ebp + eax*4 + 8]
add eax, 2
test ecx, ecx
je 0x45dcc0
mov esi, dword [esp + 0x18]
push ebp
push esi
push eax
mov byte [esi], 0
call fcn.00515990
push 0xa
push esi
mov byte [esi + 0xfa], 0
call fcn.00551e50
push 0xd
push esi
call fcn.00551e50
mov edx, 0x63e7b8
add esp, 0x1c
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x45dcb4
jmp 0x45dcc7
mov byte [0x63e7b8], 0
mov ecx, dword [0x645324]
push ecx
call fcn.00496030
add esp, 4
test eax, eax
jne 0x45dcdf
call fcn.00426060
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x461c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00502a60
add esp, 4
test eax, eax
jne 0x461ca7
call fcn.00502b30
mov esi, eax
test esi, esi
jne 0x461ca7
pop esi
mov dword [esp + 4], eax
jmp fcn.00421c80
push esi
call fcn.00502d00
add esp, 4
test eax, eax
jne 0x461ccd
push esi
call fcn.00502dc0
add esp, 4
test eax, eax
jne 0x461ccd
push esi
push eax
call fcn.004618a0
add esp, 8
pop esi
ret
push esi
push 0xf
push 0x5e6c98
call fcn.00460b70
add esp, 0xc
pop esi
ret
Function at 0x463020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0x1000
call fcn.005cd640
mov eax, dword [esp + 0x1004]
push esi
push edi
push 0x5e7744
push eax
or esi, 0xffffffff
call fcn.005ccddc
mov edi, eax
add esp, 8
test edi, edi
je 0x4630be
push edi
push 0x1000
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.005cdb83
add esp, 0x10
test eax, eax
jbe 0x4630af
xor ecx, ecx
test eax, eax
jbe 0x46308f
lea esp, [esp]
xor edx, edx
mov dl, byte [esp + ecx + 8]
xor edx, esi
and edx, 0xff
mov edx, dword [edx*4 + 0x609598]
shr esi, 8
xor esi, edx
inc ecx
cmp ecx, eax
jb 0x463070
cmp eax, 0x1000
jb 0x4630af
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.005cdb83
add esp, 0x10
test eax, eax
ja 0x463063
test byte [edi + 0xc], 0x20
push edi
je 0x4630c9
call fcn.005ccca9
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x1000
ret
call fcn.005ccca9
add esp, 4
mov eax, esi
pop edi
not eax
pop esi
add esp, 0x1000
ret

Function at 0x4630e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jg 0x4630ed
xor eax, eax
pop esi
ret
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jle 0x46311f
push edi
mov edi, dword [esp + 0xc]
jmp 0x463100
xor edx, edx
mov dl, byte [ecx + edi]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x609598]
shr eax, 8
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x463100
pop edi
not eax
pop esi
ret
Function at 0x463130
Capabilities:
Hash data with crc32

Disassembly:
mov eax, 0x222c
call fcn.005cd640
push esi
push edi
mov ecx, 6
mov esi, str.5764d4780200063202380800
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [esp + 0x14], 0x2d
jne 0x463163
pop edi
mov eax, 3
pop esi
add esp, 0x222c
ret
mov ecx, dword [0x645320]
push 0x104
lea eax, [esp + 0x134]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x46320a
lea edx, [esp + 0x130]
push 0x5e7744
push edx
call fcn.005ccddc
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0xc], edi
je 0x46320a
lea eax, [esp + 0x2c]
push 0x104
push eax
call fcn.00423a00
push 8
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.005cc410
lea eax, [esp + 0x40]
push eax
call fcn.005cbdc9
add esp, 0x18
test eax, eax
mov dword [esp + 8], eax
jbe 0x46320a
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.00423a00
push 8
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.005cc410
lea ecx, [esp + 0x40]
push ecx
call fcn.005cbdc9
add esp, 0x18
test eax, eax
jg 0x463215
pop edi
xor eax, eax
pop esi
add esp, 0x222c
ret
push ebx
push ebp
push edi
push 0x2000
lea edx, [esp + 0x244]
push 1
push edx
or ebp, 0xffffffff
xor esi, esi
call fcn.005cdb83
add esp, 0x10
test eax, eax
jbe 0x4632c8
lea esp, [esp]
xor ebx, ebx
test eax, eax
jbe 0x46328d
cmp esi, dword [esp + 0x10]
jb 0x46326a
lea ecx, [esp + 0x18]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x463253
mov edx, dword [esp + 0x10]
sub ecx, edi
mov edi, dword [esp + 0x14]
add ecx, edx
cmp esi, ecx
jb 0x463287
xor ecx, ecx
mov cl, byte [esp + ebx + 0x23c]
xor ecx, ebp
and ecx, 0xff
mov edx, dword [ecx*4 + 0x609598]
shr ebp, 8
xor ebp, edx
inc esi
inc ebx
cmp ebx, eax
jb 0x463246
cmp eax, 0x2000
jb 0x4632c8
push 1
push 0xffffffffffffffce
push edi
call fcn.005cdc5e
add esp, 0xc
test eax, eax
push edi
jne 0x463310
push 0x2000
lea eax, [esp + 0x244]
push 1
push eax
sub esi, 0x32
call fcn.005cdb83
add esp, 0x10
test eax, eax
ja 0x463240
test byte [edi + 0xc], 0x20
push edi
jne 0x463310
call fcn.005ccca9
not ebp
push ebp
lea ecx, [esp + 0x3c]
push str._08lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 8
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005e325e
add esp, 0x1c
xor ecx, ecx
test eax, eax
setne cl
pop ebp
pop ebx
pop edi
pop esi
inc ecx
mov eax, ecx
add esp, 0x222c
ret
call fcn.005ccca9
add esp, 4
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x222c
ret
Function at 0x4809c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x114
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4809fb
mov eax, dword [esp + 0x118]
push 0
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
je 0x480a04
cmp eax, 2
je 0x480a04
xor eax, eax
add esp, 0x114
ret
movzx eax, word [esp]
add esp, 0x114
ret
Function at 0x4884f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x7c
push esi
mov esi, dword [esp + 0x84]
test esi, esi
je 0x48867e
cmp dword [esp + 0x88], 1
jne 0x48855f
lea eax, [esp + 0x1c]
push 0x64
push eax
call fcn.00423a00
add esp, 8
push 0x63
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [0x63b6a8]
test eax, eax
je 0x488554
lea edx, [esp + 0x1c]
push str.RichEdit20A
push edx
call fcn.005e31f5
add esp, 8
test eax, eax
mov dword [esp + 0x88], 2
je 0x48855f
mov dword [esp + 0x88], 0
push ebx
push ebp
push edi
push esi
xor ebx, ebx
call fcn.00582af0
push eax
call fcn.005827d0
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
je 0x488581
mov ebx, dword [eax + 0xa08]
mov ebp, dword [esp + 0x9c]
test ebp, ebp
jle 0x488637
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x94], 2
jne 0x488664
xor eax, eax
cmp ebx, 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
jne 0x4885e2
mov dword [esp + 0x1c], 0x4b0
jmp 0x4885f3
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0049a640
add esp, 4
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
push esi
lea edx, [esp + 0x18]
push edx
push 0x45e
push eax
mov dword [esp + 0x24], ebp
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x488664
cmp ebx, 2
jne 0x48865a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
call fcn.00579110
mov edi, eax
add esp, 8
test edi, edi
jne 0x488649
xor ebx, ebx
jmp 0x488597
mov ecx, dword [esp + 0x98]
pop edi
pop ebp
pop ebx
mov byte [ecx], 0
pop esi
add esp, 0x7c
ret
push ebp
push edi
push esi
call fcn.005cc410
push edi
call fcn.005cc393
add esp, 0x10
mov byte [esi + ebp - 1], 0
cmp byte [esi], 0
jne 0x48867b
mov edx, dword [esp + 0x90]
push esi
push ebp
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [esi + ebp - 1], 0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x7c
ret
Function at 0x48a2c0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, edi
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x48a2d0
mov eax, 0x609aa0
sub esi, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48a2e1
sub eax, edx
mov ebp, eax
mov eax, dword [esp + 0x1c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x48a376
cmp esi, ebx
jle 0x48a376
push edi
call fcn.0048a140
push edi
call fcn.0048a180
movzx ecx, byte [esi + edi - 1]
add esp, 8
dec esi
sub ecx, 0x78
cmp ecx, ebx
jle 0x48a31c
sub esi, ecx
movzx eax, byte [esi + edi - 1]
dec esi
sub eax, 0x6e
dec esi
mov dword [esp + 0x10], eax
movzx eax, byte [esi + edi]
sub eax, 0x64
add eax, ecx
cmp eax, ebp
mov byte [esi + edi], 0
jle 0x48a33d
sub eax, ebp
mov esi, edi
lea edx, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x48a342
sub esi, edx
cmp eax, ebx
jl 0x48a3e4
cmp eax, ebp
jg 0x48a3e4
xor ecx, ecx
cmp esi, ebx
jle 0x48a376
mov dl, byte [eax + 0x609aa0]
sub byte [ecx + edi], dl
inc eax
cmp eax, ebp
jl 0x48a371
xor eax, eax
inc ecx
cmp ecx, esi
jl 0x48a361
push edi
call fcn.0048a140
push edi
call fcn.0048a180
add esp, 8
xor eax, eax
xor ecx, ecx
cmp esi, ebx
jle 0x48a3a5
lea ecx, [ecx]
mov dl, byte [eax + 0x609aa0]
sub byte [ecx + edi], dl
inc eax
cmp eax, ebp
jl 0x48a3a0
xor eax, eax
inc ecx
cmp ecx, esi
jl 0x48a390
cmp dword [esp + 0x1c], ebx
je 0x48a418
xor ecx, ecx
test esi, esi
jle 0x48a3d0
movzx eax, byte [ebx + edi]
add ecx, eax
cmp ecx, 0x1e
jl 0x48a3cb
mov eax, 0x88888889
mul ecx
shr edx, 4
imul edx, edx, 0xffffffe2
add ecx, edx
inc ebx
cmp ebx, esi
jl 0x48a3b1
cmp ecx, dword [esp + 0x10]
je 0x48a418
cmp dword [esp + 0x1c], 1
jne 0x48a407
push 0
call fcn.005cc26b
cmp dword [esp + 0x1c], 1
jne 0x48a3f1
push ebx
call fcn.005cc26b
mov eax, dword [str.None]
mov dword [edi], eax
mov cl, byte [0x5ea7f8]
mov byte [edi + 4], cl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [str.None]
mov dword [edi], ecx
mov dl, byte [0x5ea7f8]
mov byte [edi + 4], dl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x48c7b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
mov esi, dword [esp + 0x3f4]
test esi, esi
je 0x48c892
cmp byte [esi], 0
je 0x48c892
lea eax, [esp + 4]
push 0x3e7
push eax
call fcn.00423a00
lea edx, [esp + 0xc]
add esp, 8
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x48c7f0
push edi
mov edi, dword [esp + 0x3f4]
mov eax, dword [edi + 0x540]
test eax, eax
je 0x48c85b
mov edx, dword [edi + 0x88c]
mov eax, dword [edi]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push 0
push eax
call fcn.0057b020
mov eax, dword [0x642ee0]
add esp, 0x14
test eax, eax
je 0x48c85b
mov ecx, dword [edi]
push ecx
call fcn.005827d0
add esp, 4
test eax, eax
je 0x48c85b
cmp dword [eax + 0x9f8], 0x80
jne 0x48c85b
mov eax, dword [edi]
lea edx, [esp + 8]
push edx
push eax
call fcn.005468d0
add esp, 8
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48c862
sub eax, edx
mov edx, dword [edi + 0x888]
push 0
mov esi, eax
push esi
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
sub eax, esi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x3e8
ret
mov eax, 1
pop esi
add esp, 0x3e8
ret
Function at 0x4913f0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x616188]
sub esp, 0x10
cmp eax, ecx
push 0
je 0x49141a
push 0x9c7
call fcn.00421db0
push eax
call fcn.00491330
add esp, 0xc
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
shr ecx, 0x10
test ecx, ecx
jne 0x491403
xor edx, edx
mov dx, word [0x609e28]
push ecx
xor eax, eax
mov ax, word [0x609e24]
push 2
push ecx
mov dword [0x616188], ecx
push edx
push eax
call fcn.005285b0
add esp, 0x18
cmp eax, 0xffffffff
mov dword [0x609ad0], eax
jne 0x49146d
push 0
push 0x9c8
call fcn.00421db0
push eax
call fcn.00491330
add esp, 0xc
add esp, 0x10
ret
xor ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
push 0x4f
mov dword [esp + 0x10], ecx
mov word [esp + 4], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x4914a2
mov dword [esp + 4], eax
jmp 0x4914b0
mov edx, dword [0x61619c]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov edx, dword [0x645324]
mov eax, dword [0x609ad0]
push 0x10
push 0x8023
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edx, dword [0x609ad0]
push 0x10
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x491504
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x491504
push 0
push 0x9c9
call fcn.00421db0
push eax
call fcn.00491330
add esp, 0xc
add esp, 0x10
ret
Function at 0x491510
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
shr eax, 0x10
sub esp, 0x104
test eax, eax
je 0x49152d
push 0
push 0x9c9
jmp 0x49166c
mov al, byte [0x6160b8]
test al, al
push esi
push 0x616120
je 0x49158c
push 0x6160b8
push 0
push 0x9ca
call fcn.00421db0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push eax
lea ecx, [esp + 0x10]
push ecx
call esi
mov edx, dword [0x6136a0]
mov ecx, dword [0x64533c]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.00526870
push 0x6160b8
lea edx, [esp + 0x24]
push 0x5e7ec4
push edx
call esi
add esp, 0x28
jmp 0x4915d4
push 0
push 0x9cb
call fcn.00421db0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push eax
lea eax, [esp + 0xc]
push eax
call esi
mov ecx, dword [0x6136a0]
mov eax, dword [0x64533c]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call fcn.00526870
push 0x616120
lea ecx, [esp + 0x20]
push str.__s_n
push ecx
call esi
add esp, 0x24
mov edx, dword [0x61369c]
mov eax, dword [0x64533c]
push edx
push eax
call fcn.00526700
push 0x64
push 0x6160b8
call fcn.00423a00
push 0x64
push 0x616120
call fcn.00423a00
push 0x3e7
push 0x616590
call fcn.00423a00
mov ecx, dword [0x645324]
mov edx, dword [0x609ad0]
add esp, 0x20
push 0x21
push 0x8024
push ecx
push edx
mov dword [0x616978], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp + 4]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491640
mov ecx, dword [0x609ad0]
sub eax, edx
push 0
mov esi, eax
push esi
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
pop esi
je 0x49167a
push 0
push 0x9cc
call fcn.00421db0
push eax
call fcn.00491330
add esp, 0xc
add esp, 0x104
ret
Function at 0x491690
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [0x616184]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x4916b7
push 0x5e6c98
call fcn.00491330
add esp, 4
pop ebx
add esp, 0x10c
ret
mov eax, dword [0x609ad0]
push 1
push 1
push eax
push 0x8024
call fcn.0058d320
add esp, 0x10
test eax, eax
jne 0x4918b7
push ebp
push esi
push edi
lea esp, [esp]
mov eax, dword [0x61697c]
inc eax
cmp eax, 0x14
mov dword [0x61697c], eax
jl 0x491715
mov ecx, dword [0x609ad0]
push ebx
push 1
push ecx
push 0x8024
mov dword [0x61697c], ebx
call fcn.0058d320
add esp, 0x10
test eax, eax
jne 0x4918b4
mov eax, dword [0x609ad0]
push ebx
push 0x103
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x49184a
cmp edi, ebx
jle 0x49186d
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x18], bl
mov dword [esp + 0x10], ebp
jle 0x4916e0
mov edx, dword [0x616978]
jmp 0x491760
cmp edx, 0x3b5
jae 0x4917fc
mov al, byte [esp + ebp + 0x18]
cmp al, 0xd
je 0x491838
cmp al, 0xa
jne 0x4917a7
cmp edx, ebx
jne 0x49178c
mov byte [0x616590], 0x20
mov edx, 1
mov ecx, dword [0x6136a4]
push ecx
mov byte [edx + 0x616590], bl
mov edx, dword [0x64533c]
push 0x616590
push edx
jmp 0x491824
cmp al, 9
jne 0x4917ed
xor esi, esi
cmp edx, ebx
jl 0x4917ba
lea esi, [edx + 8]
shr esi, 3
shl esi, 3
sub esi, edx
cmp esi, ebx
jle 0x491838
mov ecx, esi
mov ebp, ecx
shr ecx, 2
lea edi, [edx + 0x616590]
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, ebp
mov ebp, dword [esp + 0x10]
and ecx, 3
add edx, esi
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
mov dword [0x616978], edx
jmp 0x491838
mov byte [edx + 0x616590], al
inc edx
mov dword [0x616978], edx
jmp 0x491838
cmp edx, ebx
jne 0x49180c
mov byte [0x616590], 0x20
mov edx, 1
mov eax, dword [0x6136a4]
mov ecx, dword [0x64533c]
push eax
push 0x616590
mov byte [edx + 0x616590], bl
push ecx
mov dword [0x616978], ebx
call fcn.00526870
mov edx, dword [0x616978]
add esp, 0xc
inc ebp
cmp ebp, edi
mov dword [esp + 0x10], ebp
jl 0x491760
jmp 0x4916e0
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4918b4
push ebx
push 0x9cd
call fcn.00421db0
push eax
call fcn.00491330
add esp, 0xc
jmp 0x49187a
push 0x5e6c98
call fcn.00491330
add esp, 4
mov edx, dword [0x61369c]
mov eax, dword [0x64533c]
push edx
push eax
call fcn.00526700
mov ecx, dword [0x6136a0]
add esp, 8
push ecx
push ebx
push 0x9ce
call fcn.00421db0
mov edx, dword [0x64533c]
add esp, 8
push eax
push edx
call fcn.00526870
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x4918c0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
lea eax, [esp + 0x10c]
push edi
push eax
call fcn.00502c00
mov edi, eax
add esp, 4
test edi, edi
jne 0x4918f0
push eax
call fcn.00421c80
add esp, 4
xor eax, eax
pop edi
add esp, 0x108
ret
push 0x616120
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.00423900
lea edx, [esp + 0x14]
push 0x20
push edx
call fcn.005cbf10
add esp, 0x14
test eax, eax
je 0x49191a
mov byte [eax], 0
push esi
lea eax, [esp + 0xc]
push 0x40
push eax
call fcn.005cbf10
mov esi, eax
add esp, 8
test esi, esi
je 0x49195a
lea ecx, [esp + 0xc]
push ecx
push 0x64
push 0x6160b8
mov byte [esi], 0
call fcn.00423900
mov byte [esi], 0x40
inc esi
push esi
push 0x64
push 0x616120
call fcn.00423900
add esp, 0x18
jmp 0x491969
push 0x64
push 0x6160b8
call fcn.00423a00
add esp, 8
lea edx, [esp + 0xc]
push 0xf
push edx
call fcn.00551b90
mov al, byte [esp + 0x14]
add esp, 8
test al, al
pop esi
push 0
je 0x4918de
push 0x637d00
push 0
push 0x5e6eac
push str.finger
call fcn.004c9b80
push 0
push 1
lea ecx, [esp + 0x24]
push ecx
push eax
mov dword [esp + 0x28], eax
call fcn.004e3ad0
add esp, 0x24
test eax, eax
je 0x4919d5
push 0x637d00
push 0x14
push 0x5e6eac
push str.finger
push eax
mov dword [esp + 0x18], eax
call fcn.004c9d30
add esp, 0x14
lea edx, [esp + 4]
push edx
call fcn.004e33a0
mov eax, dword [0x64533c]
add esp, 4
test eax, eax
je 0x491a7c
mov ecx, dword [0x61369c]
push ecx
push eax
call fcn.00526700
add esp, 8
push 0x616120
push 0
push 0x9c5
mov dword [0x616184], 1
call fcn.00421db0
add esp, 8
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x6136a0]
mov ecx, dword [0x64533c]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.00526870
add esp, 0x18
push 0x616120
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x491ae8
push eax
push 0
push 0
mov dword [0x616188], 0
call fcn.004913f0
add esp, 0xc
mov eax, 1
pop edi
add esp, 0x108
ret
mov eax, dword [0x5eaa0c]
mov edx, dword [str.Finger_Window]
mov ecx, dword [0x5eaa10]
push 0x64533c
push edi
push 0
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edx
mov dx, word [0x5eaa14]
lea eax, [esp + 0x18]
push 5
push eax
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], dx
call fcn.005899d0
add esp, 0x18
test eax, eax
mov dword [0x64533c], eax
jne 0x4919ff
push eax
call fcn.00421c80
push 0x5e6c98
call fcn.00491330
add esp, 8
xor eax, eax
pop edi
add esp, 0x108
ret
push 0x400
push 0x616190
call fcn.00423a00
mov edx, dword [0x645324]
add esp, 8
push 0x400
push 0x616190
push 0x616120
push 0x8022
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [0x616188], eax
jne 0x491a6f
push eax
push 0x9c7
call fcn.00421db0
push eax
call fcn.00491330
add esp, 0xc
xor eax, eax
pop edi
add esp, 0x108
ret