joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2344
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x4a2397
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00482134
test al, al
je 0x4a2397
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00481c64
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a2397
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00481c64
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret
Function at 0x4b03b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4b041a
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
lea eax, [ebp - 5]
push eax
push 3
mov eax, dword [0x5f66f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 5]
mov ecx, 5
call fcn.00404f30
mov ecx, dword [ebp - 0xc]
mov eax, ebx
mov edx, 0x4b0430
call fcn.00404fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0421
lea eax, [ebp - 0xc]
call fcn.00404cc0
ret

Function at 0x4cbbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x4cbbfa
cmp dword [ebx + 0x64], 0
jne 0x4cbbfa
cmp dword [ebx + 0x6c], 0
jne 0x4cbbfa
mov esi, edi
jmp 0x4cbc92
cmp esi, 0xffffffff
jne 0x4cbc05
dec esi
jmp 0x4cbc92
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x4cbc92
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.004cb0e0
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
mov dword [esp], edx
sub dword [esp], 2
mov edx, dword [esp]
movzx edx, word [edx]
cmp edi, edx
ja 0x4cbc52
sub dx, di
mov ecx, dword [esp]
mov word [ecx], dx
jmp 0x4cbc5a
mov edx, dword [esp]
mov word [edx], 0
dec eax
test eax, eax
jne 0x4cbc39
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
mov dword [esp], edx
sub dword [esp], 2
mov edx, dword [esp]
movzx edx, word [edx]
cmp edi, edx
ja 0x4cbc83
sub dx, di
mov ecx, dword [esp]
mov word [ecx], dx
jmp 0x4cbc8b
mov edx, dword [esp]
mov word [edx], 0
dec eax
test eax, eax
jne 0x4cbc6a
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x4cbcf0
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.004cb8f4
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4cbcdb
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4cbcf0
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4cbbda
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d0790
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5f8de8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4d07b2
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d07b4
shr eax, 1
dec edx
jne 0x4d07a0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d0799
mov byte [0x5f91e8], 1
pop esi
pop ebx
ret
Function at 0x4d07d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5f91e8], 0
jne 0x4d07e7
call fcn.004d0790
mov eax, edi
dec eax
test eax, eax
jl 0x4d0810
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5f8de8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d07f1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4d2e4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4d2e7d
dec al
je 0x4d2eb9
dec al
je 0x4d2efd
dec al
je 0x4d2f68
jmp 0x4d2ff2
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d2ff2
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d2e8d
jmp 0x4d2ff2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d2ff2
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d2ec9
jmp 0x4d2ff2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d2ff2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d2f2b
xor ebp, ebp
jmp 0x4d2f3c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d2f45
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d2f0d
jmp 0x4d2ff2
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d2ff2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d2fc0
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d0818
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d2f7c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d5d00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4d5d38]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4d5d16
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4d5d25
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4d5d34
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4d6694
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x474410]
call fcn.00403fe8
test al, al
je 0x4d66d6
mov eax, dword [0x5f64d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4d66d6
mov edx, dword [0x5f64d4]
xor edx, edx
call fcn.00498ef0
push 0
mov eax, dword [0x5f64d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4e0eec
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00482134
test al, al
je 0x4e108c
mov eax, dword [ebp - 4]
mov byte [eax + 0x238], 1
mov eax, dword [ebp - 4]
call fcn.00481c64
push eax
call sub.user32.dll_HideCaret
xor eax, eax
push ebp
push 0x4e107b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00481c64
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e1058
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e1031
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
inc eax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e1013
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
call fcn.00481c64
push eax
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
call fcn.00481c64
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e101a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e8e78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040518c
xor eax, eax
push ebp
push 0x4e8f95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x368]
test eax, eax
je 0x4e8f7f
cmp dword [eax + 0x410], 0
je 0x4e8f7f
cmp byte [ebx + 0x30c], 0
je 0x4e8f00
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x304]
cmp eax, 0x1f4
jb 0x4e8ed9
lea eax, [ebx + 0x308]
call fcn.00404cc0
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x304], eax
lea eax, [ebx + 0x308]
mov edx, dword [ebp - 4]
call fcn.00404fa4
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x308]
call fcn.00404d58
mov eax, dword [ebp - 4]
call fcn.00404f9c
test eax, eax
jle 0x4e8f6f
mov eax, dword [ebp - 4]
call fcn.00404f9c
dec eax
jne 0x4e8f46
mov eax, dword [ebp - 4]
call fcn.0040519c
push eax
mov eax, ebx
call fcn.004e9ad4
push eax
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.00481c64
push eax
call sub.user32.dll_SendMessageA
jmp 0x4e8f72
mov eax, dword [ebp - 4]
call fcn.0040519c
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.00481c64
push eax
call sub.user32.dll_SendMessageA
jmp 0x4e8f72
or eax, 0xffffffff
test eax, eax
jl 0x4e8f7f
mov edx, eax
mov eax, ebx
call fcn.004e9ae0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8f9c
lea eax, [ebp - 4]
call fcn.00404cc0
ret
Function at 0x4e8fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e90f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x368]
test eax, eax
je 0x4e90c8
cmp dword [eax + 0x410], 0
je 0x4e90c8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x304]
cmp eax, 0xc8
jbe 0x4e90c8
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x304], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004794b0
mov eax, dword [ebp - 0xc]
call fcn.00404f9c
dec eax
jne 0x4e9048
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004794b0
mov eax, dword [ebp - 0x10]
call fcn.0040519c
push eax
mov eax, ebx
call fcn.004e9ad4
push eax
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.00481c64
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4e907b
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004794b0
mov eax, dword [ebp - 0x14]
call fcn.0040519c
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.00481c64
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4e90c8
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004794b0
mov edx, esi
mov eax, ebx
call fcn.004e9ae0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004794b0
mov eax, dword [ebp - 4]
call fcn.00404f9c
mov edx, eax
mov eax, ebx
call fcn.004e9158
mov eax, dword [ebp - 8]
call fcn.00404f9c
push eax
mov eax, dword [ebp - 4]
call fcn.00404f9c
pop edx
sub edx, eax
mov eax, ebx
call fcn.004e9174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e90f7
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404ce4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ce4
ret
Function at 0x4eceb4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.0056c448
test al, al
je 0x4ecfbb
mov eax, dword [esi + 4]
mov edx, dword [0x4d99dc]
call fcn.00403fe8
test al, al
je 0x4ecfbb
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x30d], 0
je 0x4ecf24
cmp byte [esi + 0x558], 0
jne 0x4ecf24
push 0xffffffffffffffec
mov eax, esi
call fcn.00481c64
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00481c64
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x4ecf5a
cmp byte [ebx + 0x30d], 0
jne 0x4ecf5a
cmp byte [esi + 0x558], 0
je 0x4ecf5a
push 0xffffffffffffffec
mov eax, esi
call fcn.00481c64
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00481c64
push eax
call sub.user32.dll_SetWindowLongA
mov al, byte [ebx + 0x30d]
mov byte [esi + 0x558], al
mov al, byte [esi + 0x559]
cmp al, byte [ebx + 0x30f]
je 0x4ecfbb
cmp byte [ebx + 0x30d], 0
je 0x4ecfbb
cmp byte [ebx + 0x30e], 0
je 0x4ecf9d
mov eax, esi
call fcn.00481c64
xor edx, edx
call fcn.0056c484
mov byte [esi + 0x559], 0
jmp 0x4ecfbb
mov eax, esi
call fcn.00481c64
mov dl, byte [ebx + 0x30f]
call fcn.0056c484
mov al, byte [ebx + 0x30f]
mov byte [esi + 0x559], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.00481c64
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.004792fc
call fcn.0056c448
test al, al
je 0x4ed08d
test ebx, ebx
je 0x4ed08d
cmp byte [ebx + 0x30e], 0
je 0x4ed08d
cmp byte [ebx + 0x30d], 0
je 0x4ed08d
mov eax, dword [0x5f64d4]
mov eax, dword [eax]
call fcn.004a11ec
xor edi, edi
xor ebp, ebp
xor eax, eax
mov al, byte [ebx + 0x30f]
mov ecx, 0xf
xor edx, edx
div ecx
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x4ed042
mov dword [esp + 8], 1
call sub.kernel32.dll_GetTickCount_1
sub eax, ebp
cmp eax, 5
jbe 0x4ed075
call sub.kernel32.dll_GetTickCount_1
mov ebp, eax
add edi, dword [esp + 8]
xor eax, eax
mov al, byte [ebx + 0x30f]
cmp edi, eax
jle 0x4ed067
mov edi, eax
mov eax, esi
call fcn.00481c64
mov edx, edi
call fcn.0056c484
mov eax, dword [0x5f64d4]
mov eax, dword [eax]
call fcn.004a11ec
xor eax, eax
mov al, byte [ebx + 0x30f]
cmp edi, eax
jl 0x4ed042
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5219a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x521ac3
cmp dword [esi + 0x108], 0
je 0x521ac3
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + 0x40]
mov dword [esp], edx
mov edx, dword [eax + 0x44]
mov dword [esp + 4], edx
mov edi, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov eax, dword [esi + 0xf8]
add dword [esp], eax
mov eax, dword [esi + 0xfc]
add dword [esp + 4], eax
add edi, dword [esi + 0x100]
add ebp, dword [esi + 0x104]
mov eax, dword [esi + 0x34]
sub dword [esp], eax
mov eax, dword [esi + 0x38]
sub dword [esp + 4], eax
lea eax, [esi + 0x34]
call fcn.0056c6bc
mov edx, dword [esi + 0x108]
add edi, dword [edx + 8]
sub edi, eax
mov esi, dword [ebx + 0x48]
lea eax, [esi + 0x34]
call fcn.0056c6d8
mov edx, dword [esi + 0x108]
add ebp, dword [edx + 0xc]
sub ebp, eax
mov esi, dword [ebx + 0xe4]
xor eax, eax
mov dword [ebx + 0xe4], eax
push edi
push ebp
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, ebx
call fcn.005207b4
mov edi, esi
xor ebp, ebp
xor esi, esi
mov eax, edi
mov ecx, 0xf
cdq
idiv ecx
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x521a72
mov dword [esp + 8], 1
mov eax, dword [0x5f64d4]
mov eax, dword [eax]
call fcn.004a11ec
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebp
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x521a9f
cmp eax, 5
jbe 0x521abf
jmp 0x521aa1
jle 0x521abf
call sub.kernel32.dll_GetTickCount_1
mov ebp, eax
add esi, dword [esp + 8]
cmp edi, esi
jge 0x521ab2
mov esi, edi
mov dword [ebx + 0xe4], esi
mov eax, ebx
call fcn.005217ac
cmp edi, esi
jg 0x521a7e
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x591b98
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x591c27
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5f928c
push 0x101
call sub.wsock32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x591c11
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040dea0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov eax, 0x591c3c
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x1c]
push eax
push 2
mov ecx, dword [0x5f65b0]
mov dl, 1
mov eax, dword [0x590ee8]
call fcn.0040e944
call fcn.00404630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x591c2e
lea eax, [ebp - 0x20]
call fcn.00404cc0
ret
Function at 0x5922ec
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov al, byte [0x592368]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x28]
je 0x59231e
mov dword [ebp - 8], 0x401
mov eax, dword [ebp - 4]
call fcn.00592494
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov al, byte [0x592368]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x28]
jne 0x592361
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
mov esp, ebp
pop ebp
ret

Function at 0x59240c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.005922ec
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00404058
push 0x10
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x59248c
call fcn.00591acc
mov eax, dword [ebp - 4]
mov byte [eax + 0x29], 0
mov eax, dword [ebp - 4]
test byte [eax + 0x28], 0x10
jne 0x59247d
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00404058
pop esi
pop ecx
pop ebp
ret

Function at 0x592618
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040519c
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 4
call fcn.004036f0
cmp dword [ebp - 0x10], 0
je 0x592687
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 1]
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 2]
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 3]
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x592790
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x5927c2
mov ecx, dword [0x5f66d4]
mov dl, 1
mov eax, dword [0x590ee8]
call fcn.0040e8fc
call fcn.00404630
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x5927f3
mov ecx, dword [0x5f63dc]
mov dl, 1
mov eax, dword [0x590ee8]
call fcn.0040e8fc
call fcn.00404630
xor eax, eax
push ebp
push 0x592876
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00404058
cmp byte [ebp + 8], 0
je 0x59284f
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005926e4
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x1c]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0059236c
jmp 0x59286c
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00591e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x592893
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10