joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b28f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x2e
push dword [ebp + 8]
call fcn.004b1f70
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], 0x40
je 0x46b2ed
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46b2ed
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push 0
push 0
push str.Content_Type
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 4]
jne 0x46b2e7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.application_octet_stream
push dword [ebp + 0xc]
call fcn.004af6d0
pop ecx
pop ecx
leave
ret

Function at 0x46bf8a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 3
pop ebx
cmp edi, ebx
jb 0x46c019
xor edx, edx
mov esi, ebx
mov eax, edi
div esi
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], eax
shl eax, 2
mov dword [ebp - 4], eax
movzx eax, byte [ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx edx, byte [ecx + 1]
xor eax, eax
mov al, byte [ecx]
shr edx, 4
inc esi
sub edi, ebx
and eax, ebx
shl eax, 4
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx edx, byte [ecx + 2]
xor eax, eax
mov al, byte [ecx + 1]
shr edx, 6
inc esi
and eax, 0xf
shl eax, 2
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
xor eax, eax
mov al, byte [ecx + 2]
inc esi
add ecx, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
dec dword [ebp + 0xc]
jne 0x46bfb6
jmp 0x46c01c
mov esi, dword [ebp + 8]
test edi, edi
jbe 0x46c074
movzx eax, byte [ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov dl, byte [ecx]
and dl, bl
inc esi
shl dl, 4
cmp edi, 1
jbe 0x46c043
mov al, byte [ecx + 1]
shr al, 4
or dl, al
movzx eax, dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
cmp edi, 2
jae 0x46c059
push 0x3d
pop ecx
jmp 0x46c069
xor eax, eax
mov al, byte [ecx + 1]
and eax, 0xf
movsx ecx, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
inc esi
mov byte [esi], 0x3d
inc esi
add dword [ebp - 4], 4
and byte [esi], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46ce65
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 6
push 1
push 2
mov dword [ebp - 4], 0xea60
call sub.WSOCK32.dll_socket
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x46cf12
push esi
push 4
lea eax, [ebp - 4]
push eax
push 0x1005
mov esi, 0xffff
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push 4
lea eax, [ebp - 4]
push eax
push 0x1006
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push dword [ebp + 0xc]
call sub.WSOCK32.dll_htons
push dword [ebp + 8]
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
call sub.WSOCK32.dll_gethostbyname
test eax, eax
pop esi
je 0x46ceed
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.004aebe0
add esp, 0xc
jmp 0x46cefc
push dword [ebp + 8]
call sub.WSOCK32.dll_inet_addr
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x46cf0c
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WSOCK32.dll_connect
cmp eax, ebx
jne 0x46cf16
push edi
call sub.WSOCK32.dll_closesocket
mov eax, ebx
jmp 0x46cf18
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x46cf1c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
xor esi, esi
cmp dword [ebp + 0x10], edi
jle 0x46cf4f
mov eax, dword [ebp + 0x10]
push edi
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x46cf56
cmp eax, edi
je 0x46cf56
add esi, eax
cmp esi, dword [ebp + 0x10]
jl 0x46cf2a
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
cmp dword [ebp + 0x14], edi
je 0x46cf9f
push edi
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], edi
je 0x46cf9f
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push edi
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x46cf52
Function at 0x46cfa3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
xor esi, esi
push edi
jmp 0x46d00d
cmp eax, ebx
je 0x46d01a
add esi, eax
cmp esi, dword [ebp + 0x10]
lea ecx, [esi + edi]
mov byte [ecx], bl
jge 0x46d06a
cmp esi, 2
jl 0x46d005
cmp byte [esi + edi - 2], 0xd
jne 0x46d005
cmp byte [edi + esi - 1], 0xa
jne 0x46d005
lea eax, [esi - 3]
cmp eax, ebx
jl 0x46cff9
cmp byte [edi + eax], 0xa
jne 0x46cff2
cmp byte [edi + eax - 1], 0xd
je 0x46cff5
dec eax
jns 0x46cfe5
cmp eax, ebx
jge 0x46cffd
xor eax, eax
jmp 0x46cffe
inc eax
cmp byte [eax + edi + 3], 0x20
je 0x46d06a
mov eax, dword [ebp + 0x10]
push ebx
sub eax, esi
push eax
push ecx
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x46cfb7
cmp dword [ebp + 0x14], ebx
je 0x46d063
push ebx
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], ebx
je 0x46d063
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push ebx
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp + 0x14], ebx
je 0x46d07b
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push 1
call dword [ebp + 0x14]
lea eax, [esi + edi]
cmp byte [eax - 2], 0xd
jne 0x46d063
cmp byte [eax - 1], 0xa
jne 0x46d063
xor eax, eax
inc eax
jmp 0x46d065
Function at 0x46d465
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xe8
push ebx
push esi
mov esi, dword [ebp + 0x74]
push edi
push esi
call fcn.004af4f0
pop ecx
push 0x40
mov ebx, eax
pop edi
cmp ebx, edi
jle 0x46d4b0
lea eax, [ebp + 4]
push eax
call fcn.004088b3
push ebx
lea eax, [ebp + 4]
push esi
push eax
call fcn.00418004
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00418094
add esp, 0x18
push 0x10
lea esi, [ebp + 0x5c]
pop ebx
push edi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004af490
push ebx
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.004aebe0
push edi
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004af490
push ebx
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004aebe0
add esp, 0x30
xor eax, eax
xor byte [ebp + eax - 0x3c], 0x36
xor byte [ebp + eax - 0x7c], 0x5c
inc eax
cmp eax, edi
jl 0x46d4e3
lea eax, [ebp + 4]
push eax
call fcn.004088b3
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00418004
push dword [ebp + 0x78]
call fcn.004af4f0
push eax
push dword [ebp + 0x78]
lea eax, [ebp + 4]
push eax
call fcn.00418004
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00418094
lea eax, [ebp + 4]
push eax
call fcn.004088b3
push edi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00418004
push 0x10
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00418004
add esp, 0x44
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00418094
mov esi, dword [ebp + 0x7c]
pop ecx
pop ecx
xor ecx, ecx
movsx eax, byte [ebp + ecx + 0x5c]
mov edx, eax
sar edx, 4
mov dl, byte [edx + str.0123456789abcdef]
and eax, 0xf
mov byte [esi + ecx*2], dl
mov al, byte [eax + str.0123456789abcdef]
mov byte [esi + ecx*2 + 1], al
inc ecx
cmp ecx, 0x10
jl 0x46d568
and byte [esi + 0x20], 0
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x46db95
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
xor esi, esi
push edi
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
jmp 0x46dc12
cmp eax, ebx
je 0x46dc17
add esi, eax
mov eax, dword [ebp + 0x10]
cmp esi, eax
jge 0x46dc67
lea ebx, [esi + edi]
and byte [ebx], 0
cmp esi, 5
jl 0x46dbff
push edi
call fcn.0046db7b
test eax, eax
pop ecx
je 0x46dbed
cmp byte [esi + edi - 5], 0xd
jne 0x46dbff
cmp byte [esi + edi - 4], 0xa
jne 0x46dbff
cmp byte [esi + edi - 3], 0x2e
jne 0x46dbff
cmp byte [esi + edi - 2], 0xd
jne 0x46dbff
cmp byte [esi + edi - 1], 0xa
je 0x46dca6
mov eax, dword [ebp + 0x10]
push 0
sub eax, esi
push eax
push ebx
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x46dbb1
cmp dword [ebp + 0x14], ebx
je 0x46dc60
push ebx
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], ebx
je 0x46dc60
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push ebx
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
and byte [edi + eax - 1], 0
push edi
call fcn.0046db7b
cmp eax, ebx
pop ecx
lea eax, [esi + edi]
je 0x46dc9a
cmp byte [eax - 5], 0xd
jne 0x46dc60
cmp byte [eax - 4], 0xa
jne 0x46dc60
cmp byte [eax - 3], 0x2e
jne 0x46dc60
cmp byte [eax - 2], 0xd
jne 0x46dc60
cmp byte [eax - 1], 0xa
je 0x46dca6
jmp 0x46dc60
cmp byte [eax - 2], 0xd
jne 0x46dc60
cmp byte [eax - 1], 0xd
jne 0x46dc60
xor eax, eax
inc eax
jmp 0x46dc62

Function at 0x46dcab
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
xor esi, esi
push edi
jmp 0x46dcea
cmp eax, ebx
je 0x46dcf7
add esi, eax
cmp esi, dword [ebp + 0x10]
lea eax, [esi + edi]
mov byte [eax], bl
jge 0x46dd47
cmp esi, 2
jl 0x46dce2
cmp byte [esi + edi - 2], 0xd
jne 0x46dce2
cmp byte [esi + edi - 1], 0xa
je 0x46dd56
mov ecx, dword [ebp + 0x10]
push ebx
sub ecx, esi
push ecx
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x46dcbf
cmp dword [ebp + 0x14], ebx
je 0x46dd40
push ebx
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], ebx
je 0x46dd40
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push ebx
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [esi + edi]
cmp byte [eax - 2], 0xd
jne 0x46dd40
cmp byte [eax - 1], 0xa
jne 0x46dd40
xor eax, eax
inc eax
jmp 0x46dd42
Function at 0x46e4cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x46e4f9
mov eax, dword [ebp + 0x10]
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x46e4ff
add esi, eax
cmp esi, dword [ebp + 0x10]
jb 0x46e4d7
xor eax, eax
inc eax
pop esi
pop ebp
ret
xor eax, eax
jmp 0x46e4fc

Function at 0x46e503
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x46e534
mov eax, dword [ebp + 0x10]
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x46e53a
test eax, eax
je 0x46e53a
add esi, eax
cmp esi, dword [ebp + 0x10]
jb 0x46e50e
xor eax, eax
inc eax
pop esi
pop ebp
ret
xor eax, eax
jmp 0x46e537

Function at 0x46e53e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x10], 0
push edi
push 6
push 1
push 2
mov dword [ebp - 8], 0x2710
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x46e569
xor eax, eax
jmp 0x46e69e
push esi
push 4
lea eax, [ebp - 8]
push eax
push 0x1005
mov esi, 0xffff
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push 4
lea eax, [ebp - 8]
push eax
push 0x1006
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push 0x35
call sub.WSOCK32.dll_htons
push dword [ebp + 0xc]
mov word [ebp - 0x1e], ax
mov word [ebp - 0x20], 2
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x46e5c8
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.004aebe0
add esp, 0xc
jmp 0x46e5dc
push dword [ebp + 0xc]
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x46e694
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0046e2ba
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x46e693
push 0x10
lea eax, [ebp - 0x20]
push eax
push edi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
je 0x46e68c
push dword [ebp - 0xc]
call sub.WSOCK32.dll_htons
push 2
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.0046e4cc
add esp, 0xc
test eax, eax
je 0x46e68c
movzx eax, word [ebp - 0xc]
push eax
push ebx
push edi
call fcn.0046e4cc
add esp, 0xc
test eax, eax
je 0x46e68c
push 2
lea eax, [ebp - 4]
push eax
push edi
call fcn.0046e503
add esp, 0xc
test eax, eax
je 0x46e68c
push dword [ebp - 4]
call sub.WSOCK32.dll_ntohs
push ebx
mov esi, eax
call fcn.004aead9
movzx esi, si
push esi
call fcn.004aeac7
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x46e693
push esi
push ebx
push edi
call fcn.0046e503
add esp, 0xc
test eax, eax
je 0x46e68c
push dword [ebp + 0x10]
push ebx
call fcn.0046e403
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
push ebx
call fcn.004aead9
pop ecx
pop ebx
push edi
call sub.WSOCK32.dll_closesocket
mov eax, dword [ebp - 0x10]
pop esi
pop edi
leave
ret
Function at 0x46e8a8
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor ecx, ecx
cmp dword [esp + 8], eax
jbe 0x46e8d4
push esi
mov esi, dword [esp + 8]
movzx esi, byte [ecx + esi]
mov edx, eax
shr edx, 9
xor edx, eax
shr edx, 7
xor edx, esi
shl eax, 5
xor eax, edx
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x46e8b3
pop esi
ret
Function at 0x471920
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
push str.ICMP.DLL
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x47194a
xor eax, eax
jmp 0x4719fb
push esi
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004af490
add esp, 0xc
push dword [ebp + 8]
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x4719fe
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.004aebe0
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.IcmpCreateFile
push dword [ebp - 8]
call esi
push str.IcmpCloseHandle
push dword [ebp - 8]
mov edi, eax
call esi
push str.IcmpSendEcho
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
cmp edi, ebx
mov dword [ebp - 0x10], eax
je 0x4719ec
cmp dword [ebp - 4], ebx
je 0x4719ec
cmp eax, ebx
je 0x4719ec
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x4719ec
push 0x20
lea eax, [ebp - 0x40]
push 0xffffffffffffffaa
push eax
call fcn.004af490
add esp, 0xc
push 0x3c
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
jne 0x471a43
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
pop edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
pop ebx
leave
ret
push dword [ebp + 8]
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
jne 0x471980
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push str.Unkown_host__s
push eax
call fcn.004b0cdd
add esp, 0xc
cmp dword [ebp + 0x10], ebx
je 0x471a3e
push dword [ebp + 0x14]
lea eax, [ebp - 0x140]
push eax
push ebx
push 2
call dword [ebp + 0x10]
xor esi, esi
inc esi
jmp 0x4719ef
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jle 0x471af1
mov dword [ebp - 4], eax
push 0x3c
push ebx
push esi
call fcn.004af490
add esp, 0xc
push 0x1388
push 0x3c
push esi
push ebx
lea eax, [ebp - 0x40]
mov dword [esi + 0x10], eax
push 0x20
lea eax, [ebp - 0x40]
push eax
mov word [esi + 0xc], 0x20
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
call dword [ebp - 0x10]
test eax, eax
je 0x471ad5
movzx ecx, byte [esi + 0x14]
movzx eax, word [esi + 2]
mov edi, dword [esi + 8]
push ecx
push edi
movzx ecx, ah
push 0x20
push ecx
movzx ecx, byte [esi + 1]
movzx eax, al
push ecx
push eax
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x140]
push str.Reply_from__d._d._d._d:_bytes_d_time_dms_TTL_d
push eax
call fcn.004b0cdd
add esp, 0x24
cmp dword [ebp + 0x10], ebx
je 0x471ace
push dword [ebp + 0x14]
lea eax, [ebp - 0x140]
push eax
push edi
push 4
call dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
inc dword [eax]
jmp 0x471ae8
cmp dword [ebp + 0x10], ebx
je 0x471ae8
push dword [ebp + 0x14]
push str.Destination_host_unreachable
push ebx
push 1
call dword [ebp + 0x10]
dec dword [ebp - 4]
jne 0x471a51
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
jmp 0x4719ee
Function at 0x471c19
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00471b52
add esp, 0xc
push 0x10
push dword [ebp + 0x18]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_sendto
test eax, eax
jge 0x471c59
cmp dword [ebp + 0x1c], 0
je 0x471c59
push dword [ebp + 0x20]
push str.Destination_host_unreachable
push 0
push 1
call dword [ebp + 0x1c]
pop ebp
ret

Function at 0x471c5b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0x400
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_recvfrom
test eax, eax
jl 0x471ca4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.00471ba2
add esp, 0x18
test eax, eax
je 0x471c66
xor eax, eax
inc eax
leave
ret
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x274c
jne 0x471cc8
cmp dword [ebp + 0x18], 0
je 0x471cc8
push dword [ebp + 0x1c]
push str.Request_timed_out
push 0x3e8
push 0
call dword [ebp + 0x18]
xor eax, eax
leave
ret
Function at 0x471ccc
Capabilities:
Create raw socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
xor ebx, ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00471920
add esp, 0x14
test eax, eax
jne 0x471e3a
push str.icmp
mov dword [ebp - 0xc], 0x3e8
call sub.WSOCK32.dll_getprotobyname
cmp eax, ebx
jne 0x471d28
cmp edi, ebx
je 0x471e7c
push dword [ebp + 0x14]
push str.getprotobyname_error
jmp 0x471e77
movsx eax, word [eax + 8]
push eax
push 3
push 2
call sub.WSOCK32.dll_socket
cmp eax, ebx
mov dword [ebp - 8], eax
jge 0x471d52
cmp edi, ebx
je 0x471e7c
push dword [ebp + 0x14]
push str.socket_error
jmp 0x471e77
push 4
lea ecx, [ebp - 0xc]
push ecx
push 0x1006
mov esi, 0xffff
push esi
push eax
call sub.WSOCK32.dll_setsockopt
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1005
push esi
push dword [ebp - 8]
call sub.WSOCK32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004af490
mov esi, dword [ebp + 8]
add esp, 0xc
push esi
mov word [ebp - 0x20], 2
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x471e42
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.004aebe0
add esp, 0xc
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x20
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
call sub.WSOCK32.dll_inet_ntoa
push eax
push esi
lea eax, [ebp - 0x130]
push str.Pinging__s___s_:_with__d_bytes_of_data:_n_n
push eax
call fcn.004b0cdd
add esp, 0x14
cmp edi, ebx
je 0x471df4
push dword [ebp + 0x14]
lea eax, [ebp - 0x130]
push eax
push ebx
push 3
call edi
cmp dword [ebp + 0xc], ebx
jle 0x471e3a
push dword [ebp + 0x14]
lea eax, [ebp - 0x20]
push edi
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x530]
push ebx
push eax
push dword [ebp - 8]
call fcn.00471c19
push dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push edi
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x930]
push eax
push dword [ebp - 8]
call fcn.00471c5b
add dword [ebp - 4], eax
add esp, 0x34
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x471df9
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
jne 0x471db9
push esi
lea eax, [ebp - 0x130]
push str.Unkown_host__s
push eax
call fcn.004b0cdd
add esp, 0xc
cmp edi, ebx
je 0x471e7c
push dword [ebp + 0x14]
lea eax, [ebp - 0x130]
push eax
push ebx
push 2
call edi
xor eax, eax
jmp 0x471e3d

Function at 0x471ffd
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
mov esi, 0x120
cmp dword [esp + 0x10], esi
jae 0x472021
push eax
call fcn.00472a36
push 2
call fcn.00472a25
pop ecx
pop ecx
mov dword [edi], eax
push esi
push 0
push eax
call fcn.004af490
add esp, 0xc
pop edi
pop esi
ret