joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48748c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4874bd
mov ecx, dword [0x4b93a4]
mov dl, 1
mov eax, dword [0x48627c]
call fcn.0040c7a4
call fcn.00403e80
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4874ea
mov ecx, dword [0x4b9328]
mov dl, 1
mov eax, dword [0x48627c]
call fcn.0040c7a4
call fcn.00403e80
xor eax, eax
push ebp
push 0x487566
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004038a8
cmp byte [ebp + 8], 0
je 0x487542
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004873f4
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004871a8
jmp 0x48755c
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00486cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x487583
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x487764
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00486f68
xor eax, eax
push ebp
push 0x4878d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4878bf
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4877af
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4877b9
call fcn.00403f2c
jmp 0x4878dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c65c
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4878b4
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x487867
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x487854
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004038a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0048771c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4878e8]
cmp dl, byte [eax + 0x28]
je 0x4878bb
call fcn.0040c6bc
jmp 0x4878bb
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c67c
jmp 0x4878bb
cmp ecx, ebx
jge 0x487883
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c67c
jmp 0x4877b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c65c
cmp edx, dword [esp + 4]
jne 0x4878a3
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4877b9
push ebp
call fcn.0048771c
pop ecx
jmp 0x4878bb
push ebp
call fcn.0048771c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4878dc
mov eax, dword [ebp - 4]
call fcn.00486f74
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4878ec
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x487a0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00486f68
xor eax, eax
push ebp
push 0x4879f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x48793c
call fcn.00403f2c
jmp 0x4879f8
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4879db
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4879db
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004038a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4879db
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bea0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x487a28
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4b949c]
mov dl, 1
mov eax, dword [0x48627c]
call fcn.0040c7e0
call fcn.00403e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4879f8
mov eax, dword [ebp - 4]
call fcn.00486f74
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487a15
lea eax, [ebp - 0x28]
call fcn.004044f0
ret
Function at 0x487a74
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x487bbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00486f68
xor eax, eax
push ebp
push 0x487ba1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x487ad9
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x487ad9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x487b8b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x487aec
call fcn.00403f2c
jmp 0x487ba8
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x487b8b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x487b8b
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004038a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x487b8b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bea0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x487bd8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4b949c]
mov dl, 1
mov eax, dword [0x48627c]
call fcn.0040c7e0
call fcn.00403e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487ba8
mov eax, dword [ebp - 4]
call fcn.00486f74
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487bc5
lea eax, [ebp - 0x28]
call fcn.004044f0
ret
Function at 0x488854
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x488901
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dl, 1
mov eax, dword [0x417f10]
call fcn.00403670
mov esi, eax
mov dword [ebx + 0xc], esi
mov eax, dword [ebx + 8]
cdq
push edx
push eax
mov eax, esi
call fcn.0041c6e0
mov esi, dword [ebx + 0xc]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, esi
call fcn.0041c67c
lea eax, [ebp - 4]
mov edx, 0x488918
call fcn.00404588
mov eax, dword [ebp - 4]
call fcn.004049b0
mov edx, eax
mov ecx, 1
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488908
lea eax, [ebp - 4]
call fcn.004044f0
ret

Function at 0x4889a0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fmul qword [ebp + 8]
call fcn.00402e78
push eax
push 0
push 0x400
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
fmul qword [ebp + 8]
call fcn.00402e78
call fcn.0040536c
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jge 0x4889ff
mov eax, 0x10000
mov esp, ebp
pop ebp
ret 8

Function at 0x488a08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004044f0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.kernel32.dll_GetTempPathA
mov ebx, eax
mov eax, ebx
call fcn.0040de74
mov eax, ebx
call fcn.00408664
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x488adb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
call fcn.0040de74
mov eax, pe_nt_image_headers32
call fcn.00408664
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x488abe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x488b08
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetTempFileNameA
call fcn.0040de74
mov eax, dword [ebp - 0xc]
call fcn.00409518
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004045e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488ac5
mov eax, dword [ebp - 8]
call fcn.00402af8
ret
Function at 0x489cac
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489df4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x489e0c
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0048b1e8
mov eax, dword [ebp - 4]
call fcn.0048abe4
xor edx, edx
push ebp
push 0x489dd7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
jne 0x489d76
test si, si
jne 0x489d1c
mov eax, dword [ebp - 8]
call fcn.00409518
mov esi, eax
cmp esi, 0xffff
jbe 0x489d1c
call fcn.004035dc
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10110]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x489d76
cmp eax, 0xffffffff
jle 0x489d4b
sub ebx, eax
jmp 0x489d5a
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0048b11c
test ebx, ebx
je 0x489d76
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
jne 0x489d76
mov eax, dword [ebp - 4]
cmp byte [eax + 0x100bd], 0
je 0x489d1f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
je 0x489dc1
mov eax, dword [ebp - 4]
mov byte [eax + 0x10098], 0
mov ecx, 0x489e24
mov dl, 1
mov eax, dword [0x488d68]
call fcn.0040c6e8
call fcn.00403e80
mov eax, dword [ebp - 4]
cmp word [eax + 0x1010a], 0
je 0x489dc1
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1010c]
call dword [ebx + 0x10108]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489dde
mov eax, dword [ebp - 4]
call fcn.0048ac48
ret
Function at 0x48a428
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48a5d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x48a5e8
mov dl, 8
mov eax, ebx
call fcn.0048b1e8
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0041c67c
cmp byte [ebx + 0x10098], 0
jne 0x48a57f
xor eax, eax
mov dword [ebx + 0x10094], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x48a48c
call fcn.004035dc
mov dword [ebx + 0x100c4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041c65c
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x48a4ba
call fcn.004035dc
cmp eax, 0x10000
jle 0x48a4c6
mov eax, 0x10000
lea edx, [ebx + 0x30]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x48a4ed
call fcn.004035dc
lea eax, [ebx + eax + 0x30]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x48a5bd
test eax, eax
jle 0x48a52d
sub esi, eax
add dword [ebx + 0x10094], eax
cmp word [ebx + 0x100da], 0
je 0x48a53b
mov edx, ebx
mov eax, dword [ebx + 0x100dc]
call dword [ebx + 0x100d8]
jmp 0x48a53b
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.0048b11c
mov eax, dword [0x4b93f0]
mov eax, dword [eax]
call fcn.004849dc
test esi, esi
je 0x48a554
cmp byte [ebx + 0x10098], 0
je 0x48a4d9
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041c65c
cmp edx, dword [esp + 4]
jne 0x48a56e
cmp eax, dword [esp]
pop edx
pop eax
je 0x48a57f
cmp byte [ebx + 0x10098], 0
je 0x48a492
cmp byte [ebx + 0x10098], 0
je 0x48a5bd
mov byte [ebx + 0x10098], 0
mov ecx, 0x48a5fc
mov dl, 1
mov eax, dword [0x488d68]
call fcn.0040c6e8
call fcn.00403e80
cmp word [ebx + 0x1010a], 0
je 0x48a5bd
mov edx, ebx
mov eax, dword [ebx + 0x1010c]
call dword [ebx + 0x10108]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a5da
lea eax, [ebp - 0xc]
call fcn.004044f0
ret
Function at 0x48ac7c
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48ad85
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x48ad9c
mov dl, 8
mov eax, ebx
call fcn.0048b1e8
test byte [ebx + 0x1c], 0x10
setne al
xor al, 1
and al, byte [0x4badb8]
je 0x48ad6f
xor eax, eax
push ebp
push 0x48ad4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x48ace5
call fcn.004035dc
mov word [ebx + 0x10110], si
mov word [ebp - 4], 0
mov word [ebp - 2], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xff7f
movzx eax, si
push eax
call sub.wsock32.dll_setsockopt
cmp word [ebx + 0x10110], 0xffff
jne 0x48ad2a
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.0048b11c
push 0x3f
push 0x465
mov eax, dword [ebx + 0x10114]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48ad6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ad8c
lea eax, [ebp - 8]
call fcn.004044f0
ret

Function at 0x48b068
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov ecx, 0x48b104
mov dl, 4
mov eax, ebx
call fcn.0048b1e8
mov byte [ebx + 0x10118], 0
mov ax, word [ebx + 0x10110]
cmp ax, 0xffff
je 0x48b0f6
movzx eax, ax
push eax
call sub.wsock32.dll_closesocket
test byte [ebx + 0x1c], 8
jne 0x48b0b5
cmp word [ebx + 0x1005a], 0
je 0x48b0b5
mov edx, ebx
mov eax, dword [ebx + 0x1005c]
call dword [ebx + 0x10058]
cmp byte [ebx + 0x10099], 0
jne 0x48b0f6
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x48b0d8
call fcn.004035dc
mov word [ebx + 0x10110], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x10114]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
pop esi
pop ebx
ret
Function at 0x48b290
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100b8]
cmp dword [eax + 4], 0
setg byte [ebp - 5]
cmp byte [ebp - 5], 0
jne 0x48b354
push 2
push 1
lea eax, [ebp - 6]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10110]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x48b2e1
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.0048b014
jmp 0x48b354
test eax, eax
jne 0x48b354
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x48b31d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10118], 0
je 0x48b313
mov eax, dword [ebp - 4]
call fcn.0048b360
mov eax, dword [ebp - 4]
call fcn.0048b068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48b327
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10034]
call fcn.00430844
mov eax, dword [ebp - 4]
cmp word [eax + 0x1005a], 0
je 0x48b354
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1005c]
call dword [ebx + 0x10058]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x48b360
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x48b367
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x48b3b4
mov dl, 8
mov eax, ebx
call fcn.0048b1e8
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret
Function at 0x48c7b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416b30]
call fcn.00404e8c
xor eax, eax
push ebp
push 0x48c8f4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b8da4], 0
jne 0x48c803
mov ecx, dword [0x4b90d8]
mov dl, 1
mov eax, dword [0x407a1c]
call fcn.0040c7a4
call fcn.00403e80
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030b0
mov eax, ebx
call fcn.00404d58
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48c904
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405f48
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d68
test eax, eax
jle 0x48c89b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48c894
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404778
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404760
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408900
test eax, eax
jne 0x48c894
mov ebx, 0x15
jmp 0x48c8a0
mov ebx, 0x10
jmp 0x48c8a0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4b8da4]
call fcn.0048c708
mov eax, dword [ebp - 8]
call fcn.0048c708
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405f60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c8fb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404514
lea eax, [ebp - 0x10]
mov edx, dword [0x416b30]
call fcn.00404f5c
ret
Function at 0x494694
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x494805
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4947e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004046d8
lea eax, [ebp - 0x118]
mov edx, 0x49481c
call fcn.004047b8
mov eax, dword [ebp - 0x118]
call fcn.004049b0
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x494752
lea eax, [ebp - 0x111]
call fcn.00409518
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004045e0
jmp 0x494759
mov eax, esi
call fcn.004044f0
cmp bl, 0x61
jae 0x49477a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040d4e4
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404544
jmp 0x494794
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040d458
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404544
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x494828
call fcn.00409c38
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4947e7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret