joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425bcc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x425bfd
je 0x425c57
sub eax, 7
je 0x425c1e
dec eax
je 0x425c48
sub eax, 0x17
je 0x425cfc
jmp 0x425d3a
add eax, 0xffffff00
sub eax, 9
jb 0x425ce8
add eax, 0xffffff09
sub eax, 0xb
jb 0x425cb0
jmp 0x425d3a
mov eax, ebx
call fcn.004376f4
mov edi, eax
test edi, edi
je 0x425d9a
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x425da3
jmp 0x425d9a
test byte [ebx + 0x44], 0x20
jne 0x425da3
jmp 0x425d9a
mov edx, esi
mov eax, ebx
call fcn.00423298
cmp dword [esi + 0xc], 0xffffffff
jne 0x425da3
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406b7c
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00421de4
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00425aa4
test eax, eax
je 0x425da3
mov dword [esi + 0xc], 1
jmp 0x425da3
mov edx, esi
mov eax, ebx
call fcn.00425b38
test al, al
je 0x425d9a
cmp dword [esi + 0xc], 0
jne 0x425da3
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00428234
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x425da3
mov eax, ebx
call fcn.00422934
test al, al
jne 0x425da3
jmp 0x425d9a
mov eax, ebx
call fcn.00428234
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x425d9a
cmp dword [0x44d724], 0
je 0x425d9a
mov eax, dword [0x44d724]
cmp ebx, dword [eax + 0x24]
jne 0x425d9a
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x44d724]
call fcn.004231cc
jmp 0x425d9a
mov eax, dword [0x44f74c]
cmp byte [eax + 0x20], 0
je 0x425d9a
mov eax, dword [0x44f74c]
cmp dword [eax + 0x1c], 0
je 0x425d9a
mov eax, dword [esi]
mov edx, dword [0x44f74c]
cmp eax, dword [edx + 0x1c]
jne 0x425d9a
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00437638
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00402f80
jmp 0x425da3
mov edx, esi
mov eax, ebx
call fcn.00423298
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426264
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x426280
cmp dword [esi + 4], 0
je 0x4262ad
test byte [ebx + 0x45], 1
jne 0x42629f
mov eax, ebx
call fcn.00425208
test eax, eax
jne 0x42629f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4263bd
mov edx, esi
mov eax, ebx
call fcn.00425edc
jmp 0x4263bd
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4263b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00428234
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004231cc
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00426264
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00428234
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4263bd
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fa14
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403b0c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42fa63
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403d3c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437410
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x44f7e4
cmp dword [edi], 0
jne 0x43748c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x44f7e0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x44d8b8
mov ecx, 2
call fcn.004027e0
mov edx, 0x4373e8
lea eax, [esi + 5]
call fcn.00437408
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00437408
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x437461
mov dword [0x44f7e0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4375a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4375f8]
test si, 4
je 0x4375bc
or bl, 1
test si, 8
je 0x4375c6
or bl, 4
test si, 1
je 0x4375d0
or bl, 8
test si, 2
je 0x4375da
or bl, 0x10
test si, 0x10
je 0x4375e4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4375f3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4375fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x437634]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x437615
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x437624
or bl, 4
test esi, 0x20000000
je 0x43762f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x43d864
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x43d876
add esp, 0xfffffff0
call fcn.0040308c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00414418
mov eax, ebx
call fcn.0043dbb0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40dd58]
call fcn.00402d74
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40dd58]
call fcn.00402d74
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40dd58]
call fcn.00402d74
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40dd58]
call fcn.00402d74
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40dd58]
call fcn.00402d74
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x43a354
push eax
push 0
push 0
mov eax, dword [0x44e4c8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x415d94]
call fcn.00417070
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x415d94]
call fcn.00417070
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x415d94]
call fcn.00417070
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0043df90
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43deac
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43deac
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43deac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43d985
call fcn.004030e4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x43dc90
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43de3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x43de1c
mov dl, 1
mov eax, dword [0x40e058]
call fcn.00402d74
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403b0c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x43de0b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0042c630
test al, al
je 0x43ddfe
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x43de4c
lea eax, [ebp - 0x254]
call fcn.00408954
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43ddfe
xor eax, eax
push ebp
push 0x43ddf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x43de84
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43dde0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403d3c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x43dde0
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403d3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ddfe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x43dd01
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0041104c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43de42
lea eax, [ebp - 0x260]
call fcn.00403b0c
ret

Function at 0x43e688
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x44f7d4]
cmp byte [eax + 0x95], 0
jne 0x43e6f9
cmp dword [0x44f7f0], 0
jne 0x43e6ba
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x43e644
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x44f7f0], eax
cmp dword [0x44f7ec], 0
jne 0x43e6d5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x44f7ec], eax
cmp dword [0x44f7f4], 0
jne 0x43e6f9
push esp
push 0
push 0
push 0x43e5e8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x44f7f4], eax
pop edx
ret
Function at 0x43e7f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x43e807
add esp, 0xfffffff0
call fcn.0040308c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00414418
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40dd58]
call fcn.00402d74
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40dd58]
call fcn.00402d74
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x4164c8]
call fcn.0041bef0
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x43e97c
mov eax, dword [0x44e400]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041c2c0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4401b4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44e400]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040b9c0
test eax, eax
je 0x43e8fa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408308
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b9e8
test eax, eax
je 0x43e90e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403d3c
mov eax, dword [0x44e320]
cmp byte [eax], 0
jne 0x43e93f
mov eax, ebx
call fcn.0043ea68
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43e971
call fcn.004030e4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ecd8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44f7d4]
cmp dword [eax + 0x24], 0
je 0x43ed7b
cmp dword [ebx + 0x84], 0
jne 0x43ed75
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43ec68
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x43ed75
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43ed3e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43ed75
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040f478
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43ed4d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x43f788
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x43f7bd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403bf4
jmp 0x43f7c7
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403b60
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x440528
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x440560
mov eax, esi
call fcn.00428530
test al, al
je 0x440560
mov eax, dword [ebx + 0x74]
call fcn.00428234
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x440560
push 0
mov eax, dword [ebx + 0x74]
call fcn.00428234
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4417ac
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x441835
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44f7fc
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x44181f
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040a5c8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x44184c
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x44e578]
mov dl, 1
mov eax, dword [0x440c50]
call fcn.0040af00
call fcn.004034e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44183c
lea eax, [ebp - 0x1c]
call fcn.00403b0c
ret

Function at 0x441ec8
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00441dec
mov cl, 1
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.00402f80
push 0x10
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x441f2c
call fcn.004416f4
mov byte [esi + 0x29], 0
test byte [esi + 0x28], 0x10
jne 0x441f1e
cmp dword [esi + 4], 0xffffffff
setne al
mov byte [esi + 8], al
mov cl, 2
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.00402f80
pop esi
pop ebx
ret

Function at 0x441ff8
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00403f50
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402aa4
test ebx, ebx
je 0x442043
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x442120
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x442151
mov ecx, dword [0x44e618]
mov dl, 1
mov eax, dword [0x440c50]
call fcn.0040aec4
call fcn.004034e4
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x44217e
mov ecx, dword [0x44e4bc]
mov dl, 1
mov eax, dword [0x440c50]
call fcn.0040aec4
call fcn.004034e4
xor eax, eax
push ebp
push 0x442202
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.00402f80
cmp byte [ebp + 8], 0
je 0x4421dc
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00442088
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00441e48
jmp 0x4421f8
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004419e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44221f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x442400
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00441c6c
xor edx, edx
push ebp
push 0x442560
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x44254a
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x44244a
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x442454
call fcn.00403584
jmp 0x442567
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110d4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x44253f
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x4424fd
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4424ed
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00402f80
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004423b8
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x442570]
cmp dl, byte [eax + 0x28]
je 0x442546
call fcn.0040adac
jmp 0x442546
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004110e4
jmp 0x442546
cmp eax, ebx
jge 0x442516
mov edx, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110e4
jmp 0x442454
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110d4
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110f0
cmp ebx, eax
jne 0x442454
push ebp
call fcn.004423b8
pop ecx
jmp 0x442546
push ebp
call fcn.004423b8
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442567
mov eax, dword [ebp - 4]
call fcn.00441c78
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442574
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x442696
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00441c6c
xor eax, eax
push ebp
push 0x442679
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4425c4
call fcn.00403584
jmp 0x442680
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x442663
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x442663
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00402f80
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x442663
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040a5c8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4426b0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x44e578]
mov dl, 1
mov eax, dword [0x440c50]
call fcn.0040af00
call fcn.004034e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442680
mov eax, dword [ebp - 4]
call fcn.00441c78
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44269d
lea eax, [ebp - 0x28]
call fcn.00403b0c
ret