joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45be6c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45be83
add esp, 0xfffffff0
call fcn.004034bc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d354
mov eax, dword [0x483464]
cmp word [eax + 2], 0
jne 0x45beab
mov eax, dword [0x483464]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d5d4
mov eax, dword [0x483518]
cmp word [eax + 2], 0
jne 0x45bec5
mov eax, dword [0x483518]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d7cc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4154d8]
call fcn.00403168
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4154d8]
call fcn.00403168
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f950]
call fcn.00427748
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45c04c
mov eax, dword [0x483374]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00427b18
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45dd6c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x483374]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c70c
test eax, eax
je 0x45bfba
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040888c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c734
test eax, eax
je 0x45bfce
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404158
mov eax, dword [0x483228]
cmp byte [eax], 0
jne 0x45c002
mov eax, ebx
call fcn.0045c174
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045df48
mov eax, ebx
call fcn.0045e90c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c042
call fcn.00403514
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c3f4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x484be0]
cmp dword [eax + 0x30], 0
je 0x45c49e
cmp dword [ebx + 0x94], 0
jne 0x45c498
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c384
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c498
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c45e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c498
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417840
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c46d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d000
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45d035
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fd8
jmp 0x45d042
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f3c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e124
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e165
mov eax, esi
call fcn.0044453c
test al, al
je 0x45e165
mov eax, dword [ebx + 0x84]
call fcn.00444238
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e165
push 0
mov eax, dword [ebx + 0x84]
call fcn.00444238
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45ee24
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414a60]
call fcn.00404880
xor eax, eax
push ebp
push 0x45ef68
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x482ee8], 0
jne 0x45ee77
mov ecx, dword [0x483238]
mov dl, 1
mov eax, dword [0x4071c0]
call fcn.0040b9b0
call fcn.00403924
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402bac
mov eax, ebx
call fcn.00404750
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45ef78
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405804
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404760
test eax, eax
jle 0x45ef0f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45ef08
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404170
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404158
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408000
test eax, eax
jne 0x45ef08
mov ebx, 0x15
jmp 0x45ef14
mov ebx, 0x10
jmp 0x45ef14
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x482ee8]
call fcn.0045ed7c
mov eax, dword [ebp - 8]
call fcn.0045ed7c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040581c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ef6f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403f0c
lea eax, [ebp - 0x10]
mov edx, dword [0x414a60]
call fcn.00404950
ret
Function at 0x467f98
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4680b9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
mov edx, dword [0x483580]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x483580]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4680d0
call fcn.00408f2c
mov eax, dword [ebp - 4]
call fcn.0047bd20
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x48337c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [0x48354c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4680ec
call fcn.00408f2c
mov eax, dword [ebp - 0x10]
call fcn.0047bd20
call sub.kernel32.dll_GetCurrentThreadId_1
mov esi, eax
push esi
push 0
push 0x467c64
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x46810c
call fcn.00408f2c
mov eax, dword [ebp - 0x24]
call fcn.0047bd20
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x468124
call fcn.00408f2c
mov eax, dword [ebp - 0x28]
call fcn.0047bd20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4680c0
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403f0c
lea eax, [ebp - 0x10]
call fcn.00403ee8
lea eax, [ebp - 4]
call fcn.00403ee8
ret

Function at 0x46e2fc
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x46e34a
mov edx, dword [ebx + 0x48]
cmp dword [edx + 0x138], 0
je 0x46e34a
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + 0x138]
mov eax, dword [eax + 0x14]
jmp 0x46e35a
mov edx, dword [ebx + 0x48]
mov edx, dword [edx + 0x134]
test edx, edx
je 0x46e35a
mov eax, dword [edx + 0x14]
test eax, eax
je 0x46e373
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.0046c1e8
jmp 0x46e3b6
mov edx, dword [edi + 0x10]
mov eax, dword [ebx + 0x34]
call fcn.00421838
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x14]
call fcn.00420f7c
mov esi, eax
mov eax, dword [ebx + 0x48]
mov edx, dword [eax + 0xa4]
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
call fcn.00420ca4
mov edx, esp
mov eax, dword [ebx + 0x34]
call fcn.004214cc
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
mov edx, esi
call fcn.00420ca4
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4730a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, edx
mov ebp, eax
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.004546e4
mov ebx, eax
mov dx, word [edi + 4]
mov eax, ebp
call fcn.00472f4c
mov esi, eax
test esi, esi
je 0x4730ed
mov al, byte [0x473100]
cmp al, bl
jne 0x4730ed
mov edx, esi
mov eax, ebp
call fcn.00472ef4
mov dword [edi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x4730f5
mov edx, edi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x476098
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00408a3c
add esp, 0x3ec
pop ebx
ret

Function at 0x4774bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [ebx + 0xe8]
mov eax, dword [eax + 0x34]
call fcn.0044f770
mov edi, eax
dec edi
test edi, edi
jl 0x47756f
inc edi
xor esi, esi
mov eax, dword [ebx + 0xe8]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0044f780
mov eax, dword [eax + 0xc]
sub eax, 1
jb 0x477506
je 0x477527
dec eax
je 0x477548
jmp 0x477567
mov eax, dword [ebx + 0xe8]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0044f780
cmp byte [ebx + 0x158], 0
setne dl
call fcn.0044f69c
jmp 0x477567
mov eax, dword [ebx + 0xe8]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0044f780
cmp byte [ebx + 0x158], 1
setne dl
call fcn.0044f69c
jmp 0x477567
mov eax, dword [ebx + 0xe8]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0044f780
cmp byte [ebx + 0x158], 2
setne dl
call fcn.0044f69c
inc esi
dec edi
jne 0x4774e7
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x88]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x8c]
cdq
cmp edx, dword [esp + 4]
jne 0x477594
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4775f5
jmp 0x477598
pop edx
pop eax
jge 0x4775f5
mov esi, 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x88], eax
mov eax, dword [ebx + 0x12c]
test byte [eax + 0x50], 2
je 0x4775d1
cmp byte [ebx + 0x155], 2
je 0x4775d1
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov eax, dword [ebx + 0xe8]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x477611
push 0
mov eax, dword [ebx + 0x120]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push esi
mov eax, dword [ebx + 0xf8]
push eax
call sub.user32.dll_TrackPopupMenu
jmp 0x477611
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0042db38
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x120]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x480104
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x480242
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x84], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x480227
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00408a3c
mov dl, 1
mov eax, dword [0x466b64]
call fcn.00466bbc
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
mov dl, 1
mov eax, dword [0x415be4]
call fcn.00403168
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
call fcn.00466c38
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x480224
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
mov edx, 0x480258
call fcn.00466f84
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004041f4
xor eax, eax
push ebp
push 0x48021d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0xc]
call fcn.00419b98
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00480260
mov eax, dword [ebp - 0xc]
call fcn.00408688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480224
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
call fcn.00403198
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00403198
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480249
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403f0c
ret
Function at 0x490e30
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebx
push esi
add esp, 0xfffffe3c
mov esi, eax
mov ecx, 0x32
mov eax, 0x4a1148
lea edx, [esp + 0x190]
mov bl, byte [eax]
mov byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x490e4b
cmp byte [esi + 0x48], 0
jne 0x490f08
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x490f67
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [0x4a2da8], eax
cmp dword [0x4a2da8], 0xffffffff
jne 0x490e9a
mov eax, dword [0x4a2da8]
push eax
call sub.wsock32.dll_closesocket
jmp 0x490f67
mov word [0x4a2dac], 2
xor eax, eax
mov dword [0x4a2db0], eax
push 0x1a6f
call sub.wsock32.dll_htons
mov word [0x4a2dae], ax
push 0x10
push 0x4a2dac
mov eax, dword [0x4a2da8]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x490ed9
mov byte [esi + 0x48], 0
jmp 0x490f67
mov byte [esi + 0x48], 1
push 1
push 0x401
mov eax, dword [esi + 0x44]
push eax
mov eax, dword [0x4a2da8]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 0x490f70
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a2da4], eax
mov eax, dword [esi + 0x30]
call fcn.004049d4
push eax
call sub.wsock32.dll_inet_addr
mov dword [0x4a2dc0], eax
mov word [0x4a2dbc], 2
push 0x89
call sub.wsock32.dll_htons
mov word [0x4a2dbe], ax
push 0x10
push 0x4a2dbc
push 0
push 0x32
lea eax, [esp + 0x1a0]
push eax
mov eax, dword [0x4a2da8]
push eax
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
je 0x490f67
cmp eax, 0x32
jne 0x490f67
mov eax, dword [0x4a2da4]
push eax
call sub.kernel32.dll_ResetEvent
add esp, 0x1c4
pop esi
pop ebx
ret

Function at 0x4958b8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc0
mov edi, eax
push 0x14
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x495794]
call fcn.00405c10
add esp, 4
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x49591b
push 0
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x495794]
call fcn.00405c10
add esp, 4
cmp word [edi + 0x42], 0
je 0x49595b
mov edx, 0x49596c
mov eax, dword [edi + 0x44]
call dword [edi + 0x40]
jmp 0x49595b
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x495938
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [edi + 0x4c]
lea eax, [eax + ebx*4]
call fcn.00404714
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
je 0x495944
cmp ebx, 0x14
jl 0x495922
push ebx
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x495794]
call fcn.00405c10
add esp, 4
add esp, 0x40
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495980
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, eax
lea ebp, [esp + 8]
mov eax, dword [ebx + 0x4c]
call fcn.00405a5c
inc eax
je 0x495a84
mov eax, dword [ebx + 0x4c]
call fcn.00405a5c
inc eax
push eax
lea eax, [ebx + 0x48]
mov ecx, 1
mov edx, dword [0x495774]
call fcn.00405c10
add esp, 4
mov eax, dword [ebx + 0x4c]
call fcn.00405a5c
mov edi, eax
test edi, edi
jl 0x495a84
inc edi
xor esi, esi
push 0
push 3
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebx + 0x48]
mov dword [edx + esi*4], eax
mov word [ebp], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + esi*4]
call fcn.004049d4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp + 4], eax
push 0x10
push ebp
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_bind
mov edx, eax
mov eax, ebx
call fcn.00495f78
mov dword [esp], 1
xor eax, eax
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x2c
lea eax, [esp + 0x28]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x98000001
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call dword [ebx + 0x6c]
mov edx, eax
mov eax, ebx
call fcn.00495f78
push 0x21
lea eax, [esi + 0x4c8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov edx, eax
mov eax, ebx
call fcn.00495f78
inc esi
dec edi
jne 0x4959d1
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49858c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049c4
xor eax, eax
push ebp
push 0x498636
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a2e44]
mov eax, dword [eax + 0x314]
call fcn.00480950
test eax, eax
je 0x49861b
push 5
push 0
push 0
push 0x49864c
mov eax, dword [0x4a2e44]
mov eax, dword [eax + 0x314]
call fcn.00480950
mov eax, dword [eax + 0x24]
lea edx, [ebp - 0xc]
call fcn.00408b30
push dword [ebp - 0xc]
push 0x498658
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040489c
mov eax, dword [ebp - 8]
call fcn.004049d4
push eax
push 0
mov eax, dword [0x4a2e44]
call fcn.00449f94
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49863d
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404548
ret
Function at 0x499cd0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x499d82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x1d4]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x499d69
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x499d2e
call sub.wsock32.dll_WSACleanup
jmp 0x499d69
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x499d58
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d8]
call fcn.00404714
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
je 0x499d64
cmp ebx, 0x14
jl 0x499d35
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499d89
lea eax, [ebp - 0x1d8]
call fcn.00404524
ret

Function at 0x499d90
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe0c
mov ebx, eax
lea eax, [esp + 0x64]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x499dc3
push 0x64
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
call sub.wsock32.dll_WSACleanup
mov edx, ebx
mov eax, esp
call fcn.004095b0
add esp, 0x1f4
pop ebx
ret

Function at 0x49a214
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049c4
xor eax, eax
push ebp
push 0x49a297
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.004049d4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 2
push 4
lea eax, [ebp - 0x10]
push eax
call sub.wsock32.dll_gethostbyaddr
mov ebx, eax
test ebx, ebx
je 0x49a27a
mov edx, esi
mov eax, dword [ebx]
call fcn.004095b0
jmp 0x49a281
mov eax, esi
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a29e
lea eax, [ebp - 4]
call fcn.00404524
ret
Function at 0x49a2a4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049c4
xor eax, eax
push ebp
push 0x49a3f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x49a3ce
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.00409450
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x49a3b7
mov edx, dword [eax + 0xc]
test edx, edx
je 0x49a3b1
mov ebx, dword [edx]
test ebx, ebx
je 0x49a3ab
lea eax, [ebp - 0x29c]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x49a410
call fcn.00409b2c
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00404578
mov byte [ebp - 5], 1
jmp 0x49a3bb
mov byte [ebp - 5], 0
jmp 0x49a3bb
mov byte [ebp - 5], 0
jmp 0x49a3bb
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a3d5
call sub.wsock32.dll_WSACleanup
ret