joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ee30
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x46ee38
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x46efdf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov esi, eax
lea edx, [ebp - 8]
mov eax, 0x46eff8
call fcn.0040e348
mov al, byte [0x46f000]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x46f00c
mov edx, 0x46f018
mov eax, dword [ebp - 8]
call fcn.0040d8e8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.004045f4
mov al, byte [0x46f000]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x46f00c
mov edx, 0x46f018
mov eax, dword [ebp - 8]
call fcn.0040d8e8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.004045f4
mov al, byte [0x46f000]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x46f00c
mov edx, 0x46f018
mov eax, dword [ebp - 8]
call fcn.0040d8e8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.004045f4
mov al, byte [0x46f000]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x46f024
mov edx, 0x46f00c
mov eax, dword [ebp - 8]
call fcn.0040d8e8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.004045f4
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov byte [ebp - 0xd], 0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x46ef5c
inc ebx
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00404958
jne 0x46ef56
mov byte [ebp - 0xd], 1
jmp 0x46ef5c
inc dword [ebp - 0xc]
dec ebx
jne 0x46ef36
cmp byte [ebp - 0xd], 0
jne 0x46efb0
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov al, byte [0x46f000]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x46f00c
mov edx, 0x46f024
mov eax, dword [ebp - 8]
call fcn.0040d8e8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.004045f4
lea eax, [ebp - 8]
call fcn.00404a64
push eax
push 0x46f028
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, esi
call fcn.00403750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46efe6
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404580
ret

Function at 0x46f280
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x46f4e0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.0040303c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x47077c
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test bl, bl
je 0x470799
test byte [esi + 0x1c], 0x10
je 0x470799
mov eax, 0x470808
call fcn.0043b9b8
jmp 0x4707fa
cmp bl, byte [esi + 0x34]
je 0x4707fa
test bl, bl
je 0x4707d2
test byte [esi + 0x1c], 0x10
jne 0x4707f7
mov cl, 1
mov dl, 1
mov eax, dword [0x4704f0]
call fcn.0041f1f0
mov edi, eax
mov dword [esi + 0x50], edi
mov dword [edi + 0x30], esi
mov byte [edi + 0xf], 1
mov eax, edi
call fcn.0041f53c
mov eax, esi
call fcn.0047082c
jmp 0x4707f7
test byte [esi + 0x1c], 0x10
jne 0x4707f7
mov eax, dword [esi + 0x30]
push eax
call sub.winmm.dll_timeKillEvent
push 0
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [esi + 0x50]
call fcn.00403750
mov byte [esi + 0x34], bl
pop edi
pop esi
pop ebx
ret
Function at 0x475f90
Capabilities:
Open clipboard

Disassembly:
push ebx
push esi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x475fd2
mov eax, dword [0x533718]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esi + 8], eax
test eax, eax
jne 0x475fbd
push esi
push 0x4766b0
call fcn.00420744
mov dword [esi + 8], eax
mov byte [esi + 0xc], 1
mov eax, dword [esi + 8]
push eax
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb ebx, ebx
inc ebx
mov byte [esi + 0xd], 0
jmp 0x475fd4
mov bl, 1
inc dword [esi + 4]
test bl, bl
jne 0x475ff5
dec dword [esi + 4]
cmp byte [esi + 0xc], 0
je 0x475ff0
mov eax, dword [esi + 8]
call fcn.004207f8
mov byte [esi + 0xc], 0
xor eax, eax
mov dword [esi + 8], eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x47601c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
jne 0x476042
xor eax, eax
jmp 0x476102
xor edx, edx
push ebp
push 0x4760f9
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4760cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x4760ba
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00402974
mov eax, dword [ebp - 4]
call fcn.00475f44
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4760c1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x47610c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00404c78
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x476187
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x476180
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x47615b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404dc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476187
cmp dword [ebp - 8], 0
je 0x476177
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4761b8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x476269
xor edx, edx
push ebp
push 0x476262
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x476235
mov edx, ebx
mov eax, dword [0x421e74]
call fcn.0042645c
test al, al
je 0x476225
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0042636c
call fcn.00403fc8
jmp 0x476269
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4761f0
mov ecx, dword [0x5332c0]
mov dl, 1
mov eax, dword [0x408098]
call fcn.0040c594
call fcn.00403f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476269
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x476270
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x4762d3
xor eax, eax
push ebp
push 0x4762cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4762d3
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4762dc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x47633c
xor edx, edx
push ebp
push 0x476335
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47633c
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4763ac
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x47642c
xor eax, eax
push ebp
push 0x476425
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00475f44
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00426430
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x47640f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47642c
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476434
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x4764b4
xor eax, eax
push ebp
push 0x4764ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00475f44
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x476497
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4764b4
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476508
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x47655c
xor eax, eax
push ebp
push 0x476555
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47655c
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x476564
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00475f90
test al, al
je 0x4765c4
xor eax, eax
push ebp
push 0x4765bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00475f44
push esi
movzx eax, bx
push eax
call sub.user32.dll_SetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4765c4
mov eax, dword [ebp - 4]
call fcn.00475f60
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x479644
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x479672
mov eax, ebx
call fcn.0047a0fc
cmp dword [ebx + 0x3c], 0
je 0x47966b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4796e3
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4796d5
cmp dword [ebx + 8], 0
je 0x479694
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4796a6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4796d5
cmp dword [ebx + 8], 0
je 0x479687
cmp eax, 3
je 0x4796b9
dec eax
jne 0x479687
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x479687
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x479687
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x479701
cmp dword [ebx + 0x10], 0xcc
je 0x479701
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047970c
pop ebx
ret

Function at 0x489aac
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x413ab8]
call fcn.00405200
xor eax, eax
push ebp
push 0x489bf0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f8a40], 0
jne 0x489aff
mov ecx, dword [0x53313c]
mov dl, 1
mov eax, dword [0x408098]
call fcn.0040c594
call fcn.00403f1c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040303c
mov eax, ebx
call fcn.00404e28
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x489c00
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040667c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404e38
test eax, eax
jle 0x489b97
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x489b90
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004047dc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004047c4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408f44
test eax, eax
jne 0x489b90
mov ebx, 0x15
jmp 0x489b9c
mov ebx, 0x10
jmp 0x489b9c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4f8a40]
call fcn.00489a04
mov eax, dword [ebp - 8]
call fcn.00489a04
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489bf7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x10]
mov edx, dword [0x413ab8]
call fcn.004052d0
ret
Function at 0x48ab98
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x48aba7
or edx, 0x200
test eax, 0x20000000
je 0x48abdb
test eax, 0x40000000
je 0x48abc6
test eax, 0x80000000
je 0x48abc1
or edx, 0x40
jmp 0x48ac02
or edx, 0x20
jmp 0x48ac02
test eax, 0x80000000
je 0x48abd5
or edx, 0x80
jmp 0x48ac02
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x48abf3
test eax, 0x80000000
je 0x48abee
or edx, 4
jmp 0x48ac02
or edx, 2
jmp 0x48ac02
test eax, 0x80000000
je 0x48abff
or edx, 8
jmp 0x48ac02
or edx, 1
mov eax, edx
ret
Function at 0x48ce80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x48ced1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x48ceb8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x48cea8
jmp 0x48ced1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x48ceb9
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a390
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.004171f4
mov esi, eax
xor eax, eax
push ebp
push 0x49a40a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x49a3ee
mov edx, ebx
mov eax, esi
call fcn.00416d88
test byte [eax + 0x48], 1
je 0x49a3e8
push 0
mov edx, ebx
mov eax, esi
call fcn.00416d88
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.00416c78
dec ebx
cmp ebx, 0xffffffff
jne 0x49a3bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a411
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00417258
ret

Function at 0x49b74c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x49b7d5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x534d50
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x49b7bf
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040bc78
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x49b7ec
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x53384c]
mov dl, 1
mov eax, dword [0x49a7cc]
call fcn.0040c5d0
call fcn.00403f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b7dc
lea eax, [ebp - 0x1c]
call fcn.0040455c
ret

Function at 0x49beb8
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0049bddc
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.0040394c
cmp byte [ebx + 4], 0
jne 0x49bee0
mov word [ebx + 0x1c], 2
jmp 0x49bee6
mov word [ebx + 0x1c], 0x17
push 0x1c
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_connect
mov edx, 0x49bf30
call fcn.0049b694
mov byte [ebx + 0x39], 0
test byte [ebx + 0x38], 0x10
jne 0x49bf22
cmp dword [ebx + 8], 0xffffffff
setne al
mov byte [ebx + 0xc], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.0040394c
pop esi
pop ebx
ret
Function at 0x49bf54
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0049bc5c
xor eax, eax
push ebp
push 0x49bff6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040455c
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x49bf8d
call fcn.00403fc8
jmp 0x49bffd
mov dword [ebp - 8], 0x1c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x49bfe0
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x49bfc4
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.Ntdll.dll_RtlIpv4AddressToStringA
jmp 0x49bfd1
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.Ntdll.dll_RtlIpv6AddressToStringA
mov eax, ebx
lea edx, [ebp - 0x54]
mov ecx, 0x30
call fcn.004047c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bffd
mov eax, dword [ebp - 4]
call fcn.0049bc68
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49c19c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x49c1cc
mov ecx, dword [0x533a30]
mov dl, 1
mov eax, dword [0x49a7cc]
call fcn.0040c594
call fcn.00403f1c
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x49c1e8
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
jmp 0x49c1f9
push 0
push 1
push 0x17
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x49c219
mov ecx, dword [0x5335d4]
mov dl, 1
mov eax, dword [0x49a7cc]
call fcn.0040c594
call fcn.00403f1c
xor eax, eax
push ebp
push 0x49c29b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.0040394c
cmp byte [ebp + 8], 0
je 0x49c276
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049c0cc
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x20]
lea edi, [eax + 0x1c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0049be38
jmp 0x49c291
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049b98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c2b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49c2c4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x49c2f4
mov ecx, dword [0x53368c]
mov dl, 1
mov eax, dword [0x49a7cc]
call fcn.0040c594
call fcn.00403f1c
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x49c310
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
jmp 0x49c321
push 0
push 1
push 0x17
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x49c341
mov ecx, dword [0x5335d4]
mov dl, 1
mov eax, dword [0x49a7cc]
call fcn.0040c594
call fcn.00403f1c
xor eax, eax
push ebp
push 0x49c3be
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.0040394c
cmp byte [ebp + 8], 0
je 0x49c39b
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049c0cc
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x20]
lea edi, [eax + 0x1c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0049beb8
jmp 0x49c3b4
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049b98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c3db
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc