joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4714a8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x65c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4715d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, esi
call fcn.00405530
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4715c0
xor edx, edx
push ebp
push 0x4715ab
push dword fs:[edx]
mov dword fs:[edx], esp
lea ebx, [ebp - 8]
push 0
push 0
push ebx
push 0x400
lea eax, [ebp - 0x658]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 4]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x4715a1
mov eax, dword [ebp - 8]
mov ecx, 0x4c
cdq
idiv ecx
dec eax
test eax, eax
jl 0x4715a1
inc eax
mov dword [ebp - 0xc], eax
lea ebx, [ebp - 0x654]
push esi
mov esi, ebx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov edi, eax
lea eax, [ebp - 0x65c]
mov edx, edi
call fcn.00405728
mov edx, dword [ebp - 0x65c]
mov eax, esi
call fcn.004057fc
push esi
lea esi, [ebx + 0x30]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebx + 0x18]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov eax, esi
mov edx, 0x4715f4
call fcn.004057fc
add ebx, 0x4c
dec dword [ebp - 0xc]
jne 0x47153e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4715b5
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_closesocket
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4715e0
lea eax, [ebp - 0x65c]
call fcn.00405530
ret

Function at 0x472694
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov eax, dword [0x4947f8]
mov dword [0x491200], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x491214]
push eax
mov eax, dword [0x4947f8]
push eax
call fcn.004080c4
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4726ce
mov edx, fcn.00407fc4
cmp edx, dword [ebp - 0x24]
je 0x4726ed
test al, al
je 0x4726e3
mov eax, dword [0x4947f8]
push eax
mov eax, dword [0x491214]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
push 0x4911f0
call sub.KERNEL32.DLL_GlobalAddAtomA
push 0x80000000
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4947f8]
push eax
push 0
mov ecx, 0x472744
mov edx, dword [0x491214]
mov eax, 0x80
call fcn.00408540
mov ebx, eax
cmp word [ebp + 0xa], 0
je 0x472738
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004725e8
push eax
push 0xfffffffffffffffc
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4727e0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x4728f6
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x472901
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x472884
mov eax, ebx
call fcn.00402f00
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47287d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004030fc
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472884
mov eax, dword [ebp - 0xc]
call fcn.00402f1c
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0040852c
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x472901
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x472901
jmp 0x472901
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00472ab4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472908
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x472981
push 0x10004
push 0
mov eax, dword [ebx + 0x98]
push eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x472981
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x472960
mov eax, ebx
call fcn.00472a4c
dec esi
jne 0x472956
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x472981
mov esi, esp
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 4], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret
Function at 0x472a4c
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.00402f00
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.00471fc4
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.00402f00
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x472aac
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x472ae8
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
mov eax, dword [ebp - 8]
call fcn.004059b0
mov eax, dword [ebp - 0xc]
call fcn.004059b0
mov eax, dword [ebp + 8]
call fcn.004059b0
xor eax, eax
push ebp
push 0x472bc2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x472bd4
call sub.wininet.dll_InternetOpenA
mov dword [0x49723c], eax
cmp dword [0x49723c], 0
je 0x472b8b
push 0
push 0
push 1
mov eax, dword [ebp - 0xc]
call fcn.004059c0
push eax
mov eax, dword [ebp - 8]
call fcn.004059c0
push eax
mov eax, dword [ebp + 8]
call fcn.00409e4c
push eax
mov eax, dword [ebp - 4]
call fcn.004059c0
push eax
mov eax, dword [0x49723c]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [0x497238], eax
cmp dword [0x497238], 0
je 0x472b8b
jmp 0x472b96
xor ebx, ebx
mov byte [0x49121c], 0
jmp 0x472b9f
mov bl, 1
mov byte [0x49121c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472bc9
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret

Function at 0x472bfc
Capabilities:
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
mov eax, dword [ebp - 8]
call fcn.004059b0
xor eax, eax
push ebp
push 0x472c74
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x49121c], 0
je 0x472c59
xor ebx, ebx
push 0
push 2
mov eax, dword [ebp - 8]
call fcn.004059c0
push eax
mov eax, dword [ebp - 4]
call fcn.004059c0
push eax
mov eax, dword [0x497238]
push eax
call sub.wininet.dll_FtpPutFileA
test eax, eax
je 0x472c59
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472c7b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x472d84
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x472dba
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004057a0
jmp 0x472dc1
mov eax, ebx
call fcn.00405530
add esp, 0x108
pop ebx
ret
Function at 0x47381c
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x473902
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405530
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jbe 0x4738e2
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x47387e
mov edi, 0x10
jmp 0x473883
mov edi, 0x20
or edi, 4
push edi
mov eax, dword [ebp - 4]
call fcn.004059c0
push eax
push ebx
call sub.advapi32.dll_RegQueryInfoKeyA
mov edi, eax
test edi, edi
jbe 0x4738dc
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4738cc
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4738c0
lea eax, [ebp - 0x10]
push eax
push 0
push edi
call sub.advapi32.dll_RegSetValueExA
jmp 0x4738cc
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call sub.advapi32.dll_RegEnumKeyExA
lea eax, [ebp - 0x2c]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
push edi
call sub.advapi32.dll_RegDeleteValueA
push ebx
call sub.advapi32.dll_RegDeleteValueA
mov edx, esi
mov eax, dword [ebp - 0x28]
call fcn.004736e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473909
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x473914
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x473993
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jbe 0x47397d
push 0x10000
mov eax, dword [ebp - 4]
call fcn.004059c0
push eax
push ebx
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
test esi, esi
jbe 0x473977
push esi
call sub.advapi32.dll_RegFlushKey
test eax, eax
je 0x473971
or edi, 0xffffffff
push esi
call sub.advapi32.dll_RegDeleteValueA
push ebx
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47399a
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x4739a4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4739ad
mov eax, dword [ebp - 4]
add esp, 0xfffff7d8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4828], edx
mov dword [ebp - 0x482c], edx
mov dword [ebp - 0x4820], edx
mov dword [ebp - 0x4824], edx
mov dword [ebp - 0x481c], edx
mov dword [ebp - 0x4818], edx
mov esi, eax
xor eax, eax
push ebp
push 0x473b8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405530
push 5
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x473b6e
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4800
lea eax, [ebp - 0x4814]
push eax
push 3
push 0x13f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegOpenKeyA
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x473b55
inc edi
lea ebx, [ebp - 0x4814]
mov eax, dword [ebx]
test eax, eax
je 0x473a61
cmp byte [eax], 0
jne 0x473a71
mov eax, esi
mov edx, 0x473ba4
call fcn.004057fc
jmp 0x473a97
push dword [esi]
lea eax, [ebp - 0x4818]
mov edx, dword [ebx]
call fcn.00405728
push dword [ebp - 0x4818]
push 0x473ba4
mov eax, esi
mov edx, 3
call fcn.004058c4
mov eax, dword [ebx + 4]
test eax, eax
je 0x473aa1
cmp byte [eax], 0
jne 0x473ab1
mov eax, esi
mov edx, 0x473ba4
call fcn.004057fc
jmp 0x473ad8
push dword [esi]
lea eax, [ebp - 0x481c]
mov edx, dword [ebx + 4]
call fcn.00405728
push dword [ebp - 0x481c]
push 0x473ba4
mov eax, esi
mov edx, 3
call fcn.004058c4
push dword [esi]
lea eax, [ebp - 0x4824]
mov edx, dword [ebx]
call fcn.00405728
mov eax, dword [ebp - 0x4824]
lea edx, [ebp - 0x4820]
call fcn.00473608
push dword [ebp - 0x4820]
push 0x473ba4
mov eax, esi
mov edx, 3
call fcn.004058c4
push dword [esi]
lea eax, [ebp - 0x4828]
push eax
lea eax, [ebp - 0x482c]
mov edx, dword [ebx]
call fcn.00405728
mov eax, dword [ebp - 0x482c]
xor ecx, ecx
xor edx, edx
call fcn.0047381c
push dword [ebp - 0x4828]
push 0x473bb0
mov eax, esi
mov edx, 3
call fcn.004058c4
add ebx, 0x24
dec edi
jne 0x473a58
cmp dword [ebp - 0xc], 0
jne 0x473a1d
cmp dword [ebp - 8], 0
jbe 0x473b6e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473b93
lea eax, [ebp - 0x482c]
mov edx, 6
call fcn.00405554
ret
Function at 0x473bb4
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x473cda
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x473cb7
xor eax, eax
push ebp
push 0x473c9f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004059c0
push eax
push 0
push 2
push 0x110
push 0xf01ff
push esi
push esi
push ebx
call sub.advapi32.dll_RegEnumValueA
mov edi, eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405728
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00405728
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x473cf4
call fcn.00405848
mov eax, dword [ebp - 0x18]
call fcn.004059c0
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00405728
mov edx, dword [ebp - 0x14]
mov ecx, 0x473d20
mov eax, 0x80000002
call fcn.0047354c
push edi
call sub.advapi32.dll_RegDeleteValueA
push ebx
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473cb0
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473ce1
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405554
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x4741b4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x47423a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, dword [0x491698]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00461260
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 4]
test eax, eax
je 0x474204
sub eax, 4
mov eax, dword [eax]
mov esi, eax
push 0
push esi
lea eax, [ebp - 4]
call fcn.00405a20
push eax
mov eax, dword [0x491610]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474241
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x47424c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x4742cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, dword [0x491698]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00461260
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 4]
test eax, eax
je 0x47429e
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
push 0
push ebx
lea eax, [ebp - 4]
call fcn.00405a20
push eax
push esi
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4742d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x47d2f8
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov ebx, dword [0x4917fc]
xor eax, eax
push ebp
push 0x47d51c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x491698]
push dword [eax]
lea eax, [ebp - 0x24]
call fcn.0048922c
push dword [ebp - 0x24]
lea edx, [ebp - 0x28]
mov eax, dword [0x4912a8]
mov eax, dword [eax]
call fcn.00409aec
push dword [ebp - 0x28]
mov eax, dword [0x491698]
mov edx, 3
call fcn.004058c4
mov eax, dword [0x49156c]
mov byte [eax], 0
mov eax, dword [0x4916ec]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4915bc]
mov eax, dword [eax]
mov edx, 0x47d538
call fcn.00405958
jne 0x47d3a2
mov eax, dword [0x49177c]
push eax
push 0
push 0
push 0x47fab4
push 0
push 0
call fcn.0040797c
mov eax, dword [0x4913d0]
mov dword [eax], 1
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x473d2c
push 0
push 0
call fcn.0040797c
mov eax, dword [0x49138c]
mov byte [eax], 1
mov esi, dword [0x491608]
mov eax, dword [0x491608]
mov eax, dword [eax]
call fcn.00406740
mov edx, esi
xor ecx, ecx
xchg edx, eax
call fcn.00403af4
lea edx, [ebp - 0x2c]
mov eax, dword [0x491760]
mov eax, dword [eax]
call fcn.0047d164
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4912d4]
mov ecx, dword [0x465040]
call fcn.00406944
lea edx, [ebp - 0x30]
mov eax, dword [0x4913e8]
mov eax, dword [eax]
call fcn.00489254
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4914cc]
call fcn.00405584
mov eax, dword [0x4914cc]
mov eax, dword [eax]
mov edx, 0x47d544
call fcn.00405958
jne 0x47d485
call fcn.0040bc08
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov edx, dword [0x491448]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.0040c868
call fcn.0040bc34
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov edx, dword [0x4915dc]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.0040c868
push dword [ebp - 4]
push 0x47d554
push dword [ebp - 8]
mov eax, dword [0x4914cc]
mov edx, 3
call fcn.004058c4
mov cl, 1
mov dl, 1
mov eax, dword [0x483c50]
call fcn.0041f8e0
mov edx, dword [0x491858]
mov dword [edx], eax
mov eax, dword [0x491858]
mov eax, dword [eax]
mov byte [eax + 0xf], 1
mov eax, dword [0x491858]
mov eax, dword [eax]
mov dl, 5
call fcn.0041faec
mov eax, dword [0x491858]
mov eax, dword [eax]
call fcn.0041fd9c
jmp 0x47d4ce
push ebx
call sub.KERNEL32.DLL_VerLanguageNameA
push ebx
call fcn.00407ff4
push 0
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x47d4c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d523
lea eax, [ebp - 0x30]
call fcn.00405530
lea eax, [ebp - 0x2c]
mov edx, dword [0x465040]
call fcn.00406908
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405554
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x47d994
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 4], edx
mov ebx, eax
lea esi, [ebp - 0x40c]
xor eax, eax
push ebp
push 0x47dbc7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x44], 0
jne 0x47dba1
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x47dba1
mov word [ebp - 0x41c], 2
mov eax, dword [0x4914bc]
movzx eax, word [eax]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x41a], ax
mov eax, dword [0x491668]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_inet_addr
mov edi, eax
mov dword [ebp - 0x418], edi
inc edi
jne 0x47da47
mov eax, dword [0x491668]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x47dba1
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x418], eax
push 0x10
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_connect
push 0
push 0x400
push esi
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
inc eax
je 0x47db8d
lea edx, [ebp - 0x424]
mov eax, dword [ebx + 0x40]
call fcn.00409ce0
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x420]
mov edx, 0x47dbe0
call fcn.00405848
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp - 8]
call fcn.0047424c
push 0
push 0x400
push esi
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
inc eax
je 0x47db8d
mov dl, 1
mov eax, dword [0x417aa8]
call fcn.00404620
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0041b6a4
xor eax, eax
push ebp
push 0x47db86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x400
call fcn.00403af4
push 0
push 0x400
push esi
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jg 0x47db4b
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0041b6a4
lea edx, [ebp - 0x428]
mov eax, dword [ebp - 0xc]
call fcn.0048a0ec
mov eax, dword [ebp - 0x428]
lea ecx, [ebp - 4]
mov edx, dword [0x491698]
mov edx, dword [edx]
call fcn.0046153c
mov eax, dword [ebp - 4]
call fcn.0047440c
lea eax, [ebp - 0xc]
call fcn.0040f8b4
jmp 0x47db70
mov edx, esi
mov ecx, ebx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
push 0x400
lea eax, [esi + 1]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
jmp 0x47dae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47db8d
mov eax, dword [ebp - 0xc]
call fcn.00404650
ret
push 2
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dbce
lea eax, [ebp - 0x428]
mov edx, 3
call fcn.00405554
lea eax, [ebp - 4]
call fcn.00405530
ret