joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470168
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4701cc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004047c4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040940c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4701d3
lea eax, [ebp - 0xc]
call fcn.0040455c
ret

Function at 0x470b04
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x413a8c]
call fcn.00405200
xor eax, eax
push ebp
push 0x470c48
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f36a0], 0
jne 0x470b57
mov ecx, dword [0x53111c]
mov dl, 1
mov eax, dword [0x408090]
call fcn.0040c568
call fcn.00403f1c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040303c
mov eax, ebx
call fcn.00404e28
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x470c58
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040667c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404e38
test eax, eax
jle 0x470bef
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x470be8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004047dc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004047c4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408f3c
test eax, eax
jne 0x470be8
mov ebx, 0x15
jmp 0x470bf4
mov ebx, 0x10
jmp 0x470bf4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4f36a0]
call fcn.00470a5c
mov eax, dword [ebp - 8]
call fcn.00470a5c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470c4f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x10]
mov edx, dword [0x413a8c]
call fcn.004052d0
ret

Function at 0x4737a0
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x4737af
or edx, 0x200
test eax, 0x20000000
je 0x4737e3
test eax, 0x40000000
je 0x4737ce
test eax, 0x80000000
je 0x4737c9
or edx, 0x40
jmp 0x47380a
or edx, 0x20
jmp 0x47380a
test eax, 0x80000000
je 0x4737dd
or edx, 0x80
jmp 0x47380a
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x4737fb
test eax, 0x80000000
je 0x4737f6
or edx, 4
jmp 0x47380a
or edx, 2
jmp 0x47380a
test eax, 0x80000000
je 0x473807
or edx, 8
jmp 0x47380a
or edx, 1
mov eax, edx
ret
Function at 0x473ed4
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, 0x532f58
xor eax, eax
push ebp
push 0x474007
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
mov eax, esi
mov ecx, 1
mov edx, dword [0x4734f4]
call fcn.00405ea4
add esp, 4
mov eax, dword [esi]
mov edx, 0x474020
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 4], 0x532f30
mov eax, dword [esi]
add eax, 8
mov edx, 0x47403c
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0xc], 0x532f34
mov eax, dword [esi]
add eax, 0x10
mov edx, 0x474058
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x14], 0x532f38
mov eax, dword [esi]
add eax, 0x18
mov edx, 0x474070
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x1c], 0x532f3c
mov eax, dword [esi]
add eax, 0x20
mov edx, 0x474088
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x24], 0x532f40
mov eax, dword [esi]
add eax, 0x28
mov edx, 0x47409c
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x2c], 0x532f44
mov eax, dword [esi]
add eax, 0x30
mov edx, 0x4740b0
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x34], 0x532f48
mov eax, dword [esi]
add eax, 0x38
mov edx, 0x4740c0
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x3c], 0x532f4c
lea ecx, [ebp - 0xc]
mov eax, dword [0x532f54]
mov eax, dword [eax + 4]
mov edx, dword [esi]
call fcn.00473c14
lea edx, [ebp - 0xc]
mov eax, 0x532f5c
mov ecx, dword [0x4734d4]
call fcn.004054ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47400e
lea eax, [ebp - 0xc]
mov edx, dword [0x4734d4]
call fcn.004052d0
ret

Function at 0x477090
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4770be
mov eax, ebx
call fcn.00477b48
cmp dword [ebx + 0x3c], 0
je 0x4770b7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47712f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x477121
cmp dword [ebx + 8], 0
je 0x4770e0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4770f2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x477121
cmp dword [ebx + 8], 0
je 0x4770d3
cmp eax, 3
je 0x477105
dec eax
jne 0x4770d3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4770d3
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4770d3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x47714d
cmp dword [ebx + 0x10], 0xcc
je 0x47714d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00477158
pop ebx
ret

Function at 0x4870e8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.0040303c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x488414
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test bl, bl
je 0x488431
test byte [esi + 0x1c], 0x10
je 0x488431
mov eax, 0x4884a0
call fcn.0043a790
jmp 0x488492
cmp bl, byte [esi + 0x34]
je 0x488492
test bl, bl
je 0x48846a
test byte [esi + 0x1c], 0x10
jne 0x48848f
mov cl, 1
mov dl, 1
mov eax, dword [0x488188]
call fcn.0041f1c4
mov edi, eax
mov dword [esi + 0x50], edi
mov dword [edi + 0x30], esi
mov byte [edi + 0xf], 1
mov eax, edi
call fcn.0041f510
mov eax, esi
call fcn.004884c4
jmp 0x48848f
test byte [esi + 0x1c], 0x10
jne 0x48848f
mov eax, dword [esi + 0x30]
push eax
call sub.winmm.dll_timeKillEvent
push 0
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [esi + 0x50]
call fcn.00403750
mov byte [esi + 0x34], bl
pop edi
pop esi
pop ebx
ret
Function at 0x48d838
Capabilities:
Open clipboard

Disassembly:
push ebx
push esi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x48d87a
mov eax, dword [0x531704]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esi + 8], eax
test eax, eax
jne 0x48d865
push esi
push 0x48df58
call fcn.00420718
mov dword [esi + 8], eax
mov byte [esi + 0xc], 1
mov eax, dword [esi + 8]
push eax
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb ebx, ebx
inc ebx
mov byte [esi + 0xd], 0
jmp 0x48d87c
mov bl, 1
inc dword [esi + 4]
test bl, bl
jne 0x48d89d
dec dword [esi + 4]
cmp byte [esi + 0xc], 0
je 0x48d898
mov eax, dword [esi + 8]
call fcn.004207cc
mov byte [esi + 0xc], 0
xor eax, eax
mov dword [esi + 8], eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x48d8c4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
jne 0x48d8ea
xor eax, eax
jmp 0x48d9aa
xor edx, edx
push ebp
push 0x48d9a1
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x48d973
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x48d962
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00402974
mov eax, dword [ebp - 4]
call fcn.0048d7ec
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d969
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x48d9b4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00404c78
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48da2f
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48da28
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x48da03
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404dc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48da2f
cmp dword [ebp - 8], 0
je 0x48da1f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48da60
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48db11
xor edx, edx
push ebp
push 0x48db0a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x48dadd
mov edx, ebx
mov eax, dword [0x421e48]
call fcn.004263f8
test al, al
je 0x48dacd
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00426308
call fcn.00403fc8
jmp 0x48db11
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x48da98
mov ecx, dword [0x5312a0]
mov dl, 1
mov eax, dword [0x408090]
call fcn.0040c568
call fcn.00403f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48db11
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48db18
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48db7b
xor eax, eax
push ebp
push 0x48db74
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48db7b
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48db84
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48dbe4
xor edx, edx
push ebp
push 0x48dbdd
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dbe4
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48dc54
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48dcd4
xor eax, eax
push ebp
push 0x48dccd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048d7ec
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.004263cc
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x48dcb7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dcd4
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48dcdc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48dd5c
xor eax, eax
push ebp
push 0x48dd55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048d7ec
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x48dd3f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dd5c
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ddb0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48de04
xor eax, eax
push ebp
push 0x48ddfd
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48de04
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x48de0c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0048d838
test al, al
je 0x48de6c
xor eax, eax
push ebp
push 0x48de65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048d7ec
push esi
movzx eax, bx
push eax
call sub.user32.dll_SetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48de6c
mov eax, dword [ebp - 4]
call fcn.0048d808
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48fc34
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x48fc85
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x48fc6c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x48fc5c
jmp 0x48fc85
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x48fc6d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d144
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.004171c8
mov esi, eax
xor eax, eax
push ebp
push 0x49d1be
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x49d1a2
mov edx, ebx
mov eax, esi
call fcn.00416d5c
test byte [eax + 0x48], 1
je 0x49d19c
push 0
mov edx, ebx
mov eax, esi
call fcn.00416d5c
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.00416c4c
dec ebx
cmp ebx, 0xffffffff
jne 0x49d170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d1c5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0041722c
ret

Function at 0x49e500
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x49e589
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x532fd8
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x49e573
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040bc4c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x49e5a0
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x531838]
mov dl, 1
mov eax, dword [0x49d580]
call fcn.0040c5a4
call fcn.00403f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e590
lea eax, [ebp - 0x1c]
call fcn.0040455c
ret

Function at 0x49ec6c
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0049eb90
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.0040394c
cmp byte [ebx + 4], 0
jne 0x49ec94
mov word [ebx + 0x1c], 2
jmp 0x49ec9a
mov word [ebx + 0x1c], 0x17
push 0x1c
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_connect
mov edx, 0x49ece4
call fcn.0049e448
mov byte [ebx + 0x39], 0
test byte [ebx + 0x38], 0x10
jne 0x49ecd6
cmp dword [ebx + 8], 0xffffffff
setne al
mov byte [ebx + 0xc], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.0040394c
pop esi
pop ebx
ret
Function at 0x49ed08
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0049ea10
xor eax, eax
push ebp
push 0x49edaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040455c
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x49ed41
call fcn.00403fc8
jmp 0x49edb1
mov dword [ebp - 8], 0x1c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x49ed94
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x49ed78
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.Ntdll.dll_RtlIpv4AddressToStringA
jmp 0x49ed85
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.Ntdll.dll_RtlIpv6AddressToStringA
mov eax, ebx
lea edx, [ebp - 0x54]
mov ecx, 0x30
call fcn.004047c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49edb1
mov eax, dword [ebp - 4]
call fcn.0049ea1c
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ef50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x49ef80
mov ecx, dword [0x531a1c]
mov dl, 1
mov eax, dword [0x49d580]
call fcn.0040c568
call fcn.00403f1c
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x49ef9c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
jmp 0x49efad
push 0
push 1
push 0x17
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x49efcd
mov ecx, dword [0x5315bc]
mov dl, 1
mov eax, dword [0x49d580]
call fcn.0040c568
call fcn.00403f1c
xor eax, eax
push ebp
push 0x49f04f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.0040394c
cmp byte [ebp + 8], 0
je 0x49f02a
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049ee80
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x20]
lea edi, [eax + 0x1c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0049ebec
jmp 0x49f045
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049e740
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f06c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49f078
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x49f0a8
mov ecx, dword [0x531678]
mov dl, 1
mov eax, dword [0x49d580]
call fcn.0040c568
call fcn.00403f1c
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x49f0c4
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
jmp 0x49f0d5
push 0
push 1
push 0x17
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x49f0f5
mov ecx, dword [0x5315bc]
mov dl, 1
mov eax, dword [0x49d580]
call fcn.0040c568
call fcn.00403f1c
xor eax, eax
push ebp
push 0x49f172
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.0040394c
cmp byte [ebp + 8], 0
je 0x49f14f
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049ee80
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x20]
lea edi, [eax + 0x1c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0049ec6c
jmp 0x49f168
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049e740
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f18f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc