joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4474d8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov eax, dword [ebp + 8]
cmp eax, dword [0x4cded4]
je 0x4474f1
xor eax, eax
jmp 0x4475df
mov edx, dword [ebp + 0xc]
shr edx, 0x10
test dx, 0xffff
je 0x447517
push 0
push 0x9c7
call fcn.0040a8fc
push eax
call fcn.0044708c
xor eax, eax
jmp 0x4475df
xor edx, edx
mov dword [0x4cded4], edx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [0x4cded0], ebx
cmp ebx, 0xffffffff
jne 0x447550
push 0
push 0x9c8
call fcn.0040a8fc
push eax
call fcn.0044708c
xor eax, eax
jmp 0x4475df
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004bcd2c
add esp, 0xc
mov word [ebp - 0x10], 2
push 0x4f
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x4dfc34]
cmp eax, 0xffffffff
je 0x447580
mov dword [ebp - 0xc], eax
jmp 0x44758f
mov eax, 0x4df734
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
push 0x10
push 0x423
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [0x4cded0]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x10]
push eax
mov edx, dword [0x4cded0]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4475dd
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4475dd
push 0
push 0x9c9
call fcn.0040a8fc
push eax
call fcn.0044708c
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4475e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x4dfb34
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x447617
push 0
push 0x9c9
call fcn.0040a8fc
push eax
call fcn.0044708c
xor eax, eax
jmp 0x44771b
cmp byte [0x4cde04], 0
je 0x447670
push 0x4cde68
push 0x4cde04
push 0
push 0x9ca
call fcn.0040a8fc
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov edx, dword [0x4cb06c]
push edx
push esi
mov ecx, dword [0x4d42c0]
push ecx
call fcn.0048d7dc
push 0x4cde04
push 0x4cdf06
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov byte [0x4cde04], 0
jmp 0x4476b1
push 0x4cde68
push 0
push 0x9cb
call fcn.0040a8fc
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4cb06c]
push eax
push esi
mov edx, dword [0x4d42c0]
push edx
call fcn.0048d7dc
push 0x4cde68
push str.__s_r_n
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov ecx, dword [0x4cb064]
push ecx
mov eax, dword [0x4d42c0]
push eax
call fcn.0048d678
mov byte [0x4dfc38], 0
xor edx, edx
mov dword [0x4cdedc], edx
push 0x21
push 0x424
mov ecx, dword [0x4d429c]
push ecx
mov eax, dword [0x4cded0]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
push esi
call fcn.004bceac
pop ecx
mov ebx, eax
push 0
push ebx
push esi
mov eax, dword [0x4cded0]
push eax
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x447719
push 0
push 0x9cc
call fcn.0040a8fc
push eax
call fcn.0044708c
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x447998
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
add esp, 0xfffffff0
or eax, 0xffffffff
mov dword [0x4cdf20], eax
mov dword [0x4cdf1c], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x4cdf1c], eax
cmp eax, 0xffffffff
jne 0x4479c6
push 0
call fcn.00447918
jmp 0x447a31
mov word [esp], 2
xor edx, edx
mov dword [esp + 4], edx
push 0x4f
call sub.WSOCK32.dll_htons
mov word [esp + 2], ax
push 0x10
lea ecx, [esp + 4]
push ecx
mov eax, dword [0x4cdf1c]
push eax
call sub.WSOCK32.dll_bind
test eax, eax
je 0x4479fd
push 0
call fcn.00447918
jmp 0x447a31
push 5
mov edx, dword [0x4cdf1c]
push edx
call sub.WSOCK32.dll_listen
test eax, eax
je 0x447a18
push 0
call fcn.00447918
jmp 0x447a31
push 8
push 0x42e
mov ecx, dword [0x4d429c]
push ecx
mov eax, dword [0x4cdf1c]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
add esp, 0x10
ret
Function at 0x447ebc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov ebx, 0x4dfe3c
mov esi, 0x4cdf20
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x447eed
cmp eax, 0x20
je 0x447eed
cmp dword [esi], 0xffffffff
je 0x447eed
cmp dword [0x4cdf1c], 0xffffffff
jne 0x447ef9
push 2
call fcn.00447918
jmp 0x447fa4
cmp byte [ebx], 0
jne 0x447f54
mov eax, dword [0x4cdf2c]
push eax
push 0x3e7
push ebx
call fcn.004bff5c
add esp, 0xc
test eax, eax
je 0x447f9d
cmp byte [ebx], 0x5b
jne 0x447f2e
push 0x5d
push ebx
call fcn.004bce0c
add esp, 8
test eax, eax
jne 0x447f9d
call fcn.00447adc
test eax, eax
je 0x447ef9
push 0xa
push ebx
call fcn.004bce0c
add esp, 8
test eax, eax
jne 0x447f54
push 0x4cdf71
push ebx
call fcn.004bcdd0
add esp, 8
push 0
push ebx
call fcn.004bceac
pop ecx
push eax
push ebx
mov ecx, dword [esi]
push ecx
call sub.WSOCK32.dll_send
test eax, eax
jge 0x447f95
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x447f7e
cmp eax, 0x2734
jne 0x447f9d
push 0x22
push 0x430
mov eax, dword [0x4d429c]
push eax
mov edx, dword [esi]
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x447fa4
mov byte [ebx], 0
jmp 0x447ef9
push 2
call fcn.00447918
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4488b4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x4488e9
mov ebx, dword [0x4cdf74]
jmp 0x4488d4
mov ebx, dword [ebx + 0x80]
test ebx, ebx
je 0x4488de
cmp dword [ebx + 0x6c], 0
jne 0x4488ce
test ebx, ebx
jne 0x4488e9
xor eax, eax
jmp 0x4489ba
cmp byte [esi], 0
je 0x4488f9
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x44890c
push 1
mov edx, dword [ebx + 0x70]
push edx
push ebx
call fcn.0044840c
xor eax, eax
jmp 0x4489ba
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x74], 0xb4
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004bcd2c
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [0x4cdf78]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov dword [ebx + 0x7c], esi
cmp esi, 0xffffffff
jne 0x44896f
push 2
mov eax, dword [ebx + 0x70]
push eax
push ebx
call fcn.0044840c
xor eax, eax
jmp 0x4489ba
push 0x10
push 0x431
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x7c]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebx + 0x7c]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4489b5
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4489b5
push 3
mov ecx, dword [ebx + 0x70]
push ecx
push ebx
call fcn.0044840c
xor eax, eax
jmp 0x4489ba
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449854
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4ce12c], 1
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00449494
push 0x4d1a70
push str.PING_:_s_n
push 0x4e058c
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x4e058c
call fcn.004bceac
pop ecx
push eax
push 0x4e058c
mov ecx, dword [0x4d4900]
push ecx
call sub.WSOCK32.dll_send
pop ebp
ret 8
Function at 0x44a110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub eax, 0x18
je 0x44a12f
sub eax, 0xf9
je 0x44a1d1
jmp 0x44a1f9
cmp dword [0x4ce1a0], 1
jne 0x44a14e
push 0x4ce3b3
push 0
push 0xc
push 0x404
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x44a193
cmp dword [0x4ce1a0], 2
jne 0x44a16d
push str.query_chat_font
push 0
push 0xc
push 0x404
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x44a193
push 0
push 0x403
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x404
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
cmp dword [0x4ce1a0], 0
jl 0x44a1a4
xor edx, edx
mov dword [0x4ce1a0], edx
cmp dword [0x4ce1a0], 0
jge 0x44a1b7
push 0x1e
push ebx
call fcn.0040d27c
jmp 0x44a1bf
push 7
push ebx
call fcn.0040d27c
test ebx, ebx
jne 0x44a1f9
cmp dword [ebp + 0x10], 0
jne 0x44a1f9
cmp dword [ebp + 0x14], 0
jne 0x44a1f9
jmp 0x44a1f9
mov cx, word [ebp + 0x10]
dec cx
jne 0x44a1f5
push 0x403
push ebx
call sub.USER32.dll_IsDlgButtonChecked
test eax, eax
je 0x44a1f9
mov dword [0x4ce1a0], 1
jmp 0x44a1f9
xor eax, eax
jmp 0x44a1fb
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x44ab40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x4e0c16
mov edi, 0x4ce3fc
mov dword [0x4ccd60], ebx
push 0x435dac
push 0x3e
mov eax, dword [0x4d429c]
push eax
call fcn.00434b58
xor edx, edx
mov dword [0x4ccd60], edx
test eax, eax
jg 0x44abc6
cmp dword [ebx + 0x420], 0
je 0x44abb7
mov ecx, dword [0x4d17b0]
shl ecx, 2
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
add ecx, 0x4d16e8
push ecx
push edi
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.004bceac
pop ecx
push eax
push esi
mov eax, dword [ebx + 0x434]
push eax
call sub.WSOCK32.dll_send
push 0
push ebx
call fcn.0044a9ac
xor eax, eax
jmp 0x44ace5
cmp eax, 2
jne 0x44ace5
cmp dword [ebx + 0x420], 0
je 0x44ac2d
mov edx, dword [0x4d17b0]
shl edx, 2
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, 0x4d16e8
push edx
lea ecx, [edi + 9]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.004bceac
pop ecx
push eax
push esi
mov eax, dword [ebx + 0x434]
push eax
call sub.WSOCK32.dll_send
lea edx, [ebx + 0x68]
push edx
lea ecx, [ebx + 4]
push ecx
lea eax, [edi + 0x12]
push eax
push 0x4dd720
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x44ac46
lea edx, [ebx + 0x68]
push edx
lea ecx, [ebx + 4]
push ecx
lea eax, [edi + 0x1e]
push eax
push 0x4dd720
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 2
push 0x4dd720
call fcn.00471754
push esi
push edi
lea eax, [edi + 0x25]
mov edi, esi
mov esi, eax
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
push 1
push 0x1e
push esi
push 0x4dd720
push 1
call fcn.0045cc90
push 0
push ebx
call fcn.0044a9ac
mov ebx, dword [0x4ce3ec]
test ebx, ebx
je 0x44ace3
cmp dword [ebx + 0x420], 0
je 0x44aca5
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x2c]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x44acba
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x38]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
push esi
push 0x4dd720
call fcn.004b59d8
test eax, eax
je 0x44acd9
push 0
push ebx
call fcn.0044a9ac
mov ebx, dword [0x4ce3ec]
jmp 0x44ac81
mov ebx, dword [ebx + 0x438]
test ebx, ebx
jne 0x44ac85
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x44b098
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0044add4
test eax, eax
jne 0x44b0b2
xor eax, eax
jmp 0x44b2ae
mov dword [ebx + 0x3fc], 2
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x430], eax
cmp dword [0x4e5360], 0
jne 0x44b0ef
jmp 0x44b0d8
mov byte [esi], 0x5f
push 0x20
lea edx, [ebx + 0x230]
push edx
call fcn.004bce0c
add esp, 8
mov esi, eax
test eax, eax
jne 0x44b0d5
lea edx, [ebx + 0x230]
push edx
lea esi, [ebx + 4]
push esi
push 0x4ce449
push 0x4e0c16
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
push 2
push 3
push 0x4e0c16
call fcn.004baa48
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x44b133
push 0
push ebx
call fcn.0044a9ac
xor eax, eax
jmp 0x44b2ae
cmp dword [0x4ccd5c], 0
jbe 0x44b202
mov dword [ebx + 0x3fc], 3
mov edx, dword [0x4ccd5c]
mov dword [ebx + 0x418], edx
xor ecx, ecx
mov dword [0x4ccd5c], ecx
mov eax, dword [ebx + 0x418]
push eax
push 0
push 0xb59
call fcn.0040a8fc
push eax
push 0x4e0c16
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x4e0c16
push 1
push 1
push 1
push 1
push ebx
call fcn.004af7e4
cmp dword [ebx + 0x420], 0
jne 0x44b22c
mov ax, word [ebx + 0x404]
test ax, ax
je 0x44b1cb
mov edx, dword [ebx + 0x418]
push edx
movzx ecx, ax
push ecx
push esi
push 0x4ce454
push 0x4e0c16
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x44b1f4
mov eax, dword [ebx + 0x400]
push eax
mov edx, dword [ebx + 0x418]
push edx
movzx ecx, word [ebx + 0x404]
push ecx
push esi
push 0x4ce47f
push 0x4e0c16
call sub.USER32.dll_wsprintfA
add esp, 0x18
push 0
push 0x4e0c16
call fcn.004bc170
jmp 0x44b22c
push 0
push 0xb5a
call fcn.0040a8fc
push eax
push 1
push 1
push 1
push 1
push ebx
call fcn.004af7e4
cmp dword [ebx + 0x420], 0
jne 0x44b22c
push ebx
call fcn.0044b58c
cmp dword [ebx + 0x420], 0
je 0x44b2a9
mov eax, dword [ebx + 0x418]
push eax
mov edx, dword [0x4d17b0]
shl edx, 2
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, 0x4d16e8
push edx
push str.121__s__lu_n
push 0x4e0c16
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
push 0x4e0c16
call fcn.004bceac
pop ecx
push eax
push 0x4e0c16
mov ecx, dword [ebx + 0x434]
push ecx
call sub.WSOCK32.dll_send
push ebx
call fcn.0044b850
cmp dword [0x4d1460], 0
je 0x44b2a9
push 3
push 0
lea eax, [ebx + 0xcc]
push eax
lea edx, [ebx + 4]
push edx
mov ecx, dword [ebx]
push ecx
call fcn.00437f98
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x44b58c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x3fc], 2
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x430], eax
cmp dword [ebx + 0x400], 0
je 0x44b6ae
cmp word [ebx + 0x404], 0
jne 0x44b6ae
cmp dword [0x4cdf84], 0
je 0x44b618
cmp dword [0x4cdf80], 0
je 0x44b618
push 0
push 0xb5c
call fcn.0040a8fc
push eax
push 1
push 1
push 1
push 1
push ebx
call fcn.004af7e4
mov eax, dword [ebx + 0x400]
push eax
push 1
push 0
add ebx, 0xcc
push ebx
call fcn.00448738
mov eax, 1
jmp 0x44b7cd
push 0
lea edx, [ebx + 0x404]
push edx
mov cx, word [0x4cc5ce]
push ecx
mov ax, word [0x4cc5cc]
push eax
call fcn.004900e4
mov esi, eax
mov dword [ebx + 0x434], esi
cmp esi, 0xffffffff
jne 0x44b65e
push 1
push ebx
push 0
push 0xb5d
call fcn.0040a8fc
push eax
call fcn.0044b3a0
xor eax, eax
jmp 0x44b7cd
push 8
push 0x410
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x434]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
mov eax, dword [ebx + 0x400]
push eax
mov edx, dword [ebx + 0x414]
push edx
mov cx, word [ebx + 0x404]
push ecx
mov eax, dword [0x4d1ba4]
push eax
lea edx, [ebx + 0x230]
push edx
add ebx, 4
push ebx
call fcn.0049f5c4
mov eax, 1
jmp 0x44b7cd
lea edx, [ebx + 0xcc]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x44b6de
push 1
push ebx
push 0
push 0xb5e
call fcn.0040a8fc
push eax
call fcn.0044b3a0
xor eax, eax
jmp 0x44b7cd
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004bcd2c
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.004bccbc
add esp, 0xc
mov cx, word [ebx + 0x404]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0x28], ecx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov dword [ebx + 0x434], esi
cmp esi, 0xffffffff
jne 0x44b776
push 1
push ebx
push 0
push 0xb5d
call fcn.0040a8fc
push eax
call fcn.0044b3a0
xor eax, eax
jmp 0x44b7cd
push 0x10
push 0x40f
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x434]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebx + 0x434]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x44b7cb
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x44b7cb
push 1
push ebx
push 0
push 0xb5f
call fcn.0040a8fc
push eax
call fcn.0044b3a0
xor eax, eax
jmp 0x44b7cd
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44bd3c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x44bd50
xor eax, eax
jmp 0x44bead
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x430], eax
push 0
push 0x1000
push 0x4e0c16
mov edx, dword [ebx + 0x434]
push edx
call sub.WSOCK32.dll_recv
mov esi, eax
cmp dword [ebx + 0x3fc], 4
je 0x44bd88
xor eax, eax
jmp 0x44bead
test esi, esi
jle 0x44be45
mov byte [esi + 0x4e0c16], 0
mov edi, esi
add dword [ebx + 0x408], edi
cmp dword [ebx + 0x418], 0
jbe 0x44bdbb
push 2
push 0
mov eax, dword [ebx + 0x3f8]
push eax
call fcn.004c0c38
add esp, 0xc
push edi
push 0x4e0c16
mov edx, dword [ebx + 0x3f8]
push edx
call fcn.004c1d74
add esp, 0xc
cmp esi, eax
je 0x44bdf0
push 1
push ebx
push 0
push 0xb65
call fcn.0040a8fc
push eax
call fcn.0044b3a0
xor eax, eax
jmp 0x44bead
mov edx, dword [ebx + 0x408]
push edx
call sub.WSOCK32.dll_htonl
mov dword [ebx + 0x40c], eax
push ebx
call fcn.0044bf9c
push ebx
call fcn.0044beb4
push ebx
call fcn.0044aa9c
test eax, eax
jne 0x44be1f
xor eax, eax
jmp 0x44bead
mov eax, dword [ebx + 0x414]
test eax, eax
jbe 0x44be41
cmp eax, dword [ebx + 0x408]
jae 0x44be41
mov dword [ebx + 0x408], eax
push ebx
call fcn.0044c124
xor eax, eax
jmp 0x44bead
xor eax, eax
jmp 0x44bead
test esi, esi
jge 0x44bea5
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2734
je 0x44be5c
cmp eax, 0x2733
jne 0x44be7a
push 0x21
push 0x411
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x434]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x44bead
mov eax, dword [ebx + 0x414]
test eax, eax
je 0x44be8c
cmp eax, dword [ebx + 0x408]
jbe 0x44bea5
push 1
push ebx
push 0
push 0xb67
call fcn.0040a8fc
push eax
call fcn.0044b3a0
xor eax, eax
jmp 0x44bead
push ebx
call fcn.0044c124
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x44d058
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov esi, 0x4ce60c
cmp dword [esi], 0xffffffff
jne 0x44d0f9
mov dword [0x4ce610], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [esi], ebx
cmp ebx, 0xffffffff
jne 0x44d092
push 0
call fcn.0044cff0
jmp 0x44d0f9
mov word [esp], 2
xor eax, eax
mov dword [esp + 4], eax
mov dx, word [0x4ce570]
push edx
call sub.WSOCK32.dll_htons
mov word [esp + 2], ax
push 0x10
lea ecx, [esp + 4]
push ecx
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_bind
test eax, eax
je 0x44d0cc
push 0
call fcn.0044cff0
jmp 0x44d0f9
push 5
mov edx, dword [esi]
push edx
call sub.WSOCK32.dll_listen
test eax, eax
je 0x44d0e3
push 0
call fcn.0044cff0
jmp 0x44d0f9
push 8
push 0x42a
mov ecx, dword [0x4d429c]
push ecx
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
add esp, 0x10
pop esi
pop ebx
ret

Function at 0x44d234
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x44d360
cmp eax, 0x20
je 0x44d360
mov eax, dword [0x4ce610]
cmp eax, 0xffffffff
je 0x44d360
push 0
push 0x32
push 0x4e1d00
push eax
call sub.WSOCK32.dll_recv
cmp eax, 1
jle 0x44d360
cmp eax, 0x19
jg 0x44d360
mov byte [eax + 0x4e1d00], 0
push 0x2c
push 0x4e1d00
call fcn.004bce0c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x44d360
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x44d360
push 0x4e1d00
call fcn.004c4ccc
pop ecx
mov esi, eax
push ebx
call fcn.004c4ccc
pop ecx
mov ebx, eax
cmp dword [0x4ce568], 0
je 0x44d31f
push 0x4ce572
push 0x4ce5d6
push ebx
push esi
push 0
push 0xc1f
call fcn.0040a8fc
push eax
push 0x4e3d41
call sub.USER32.dll_wsprintfA
add esp, 0x18
mov eax, dword [0x4cb074]
push eax
push 0x4e3d41
mov edx, dword [0x4d42ac]
push edx
call fcn.0048d7dc
mov ecx, dword [0x4cb064]
push ecx
mov eax, dword [0x4d42ac]
push eax
call fcn.0048d678
push 0x4ce572
push 0x4ce5d6
push ebx
push esi
push str._d___d_:_USERID_:__s_:__s_r_n
push 0x4e1d00
call sub.USER32.dll_wsprintfA
add esp, 0x18
push 0x22
push 0x42c
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [0x4ce610]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0
call fcn.0044d388
jmp 0x44d382
cmp dword [0x4d4908], 0
je 0x44d37b
cmp dword [0x4ce56c], 0
je 0x44d37b
push 0
call fcn.0044cff0
jmp 0x44d382
push 1
call fcn.0044cff0
pop esi
pop ebx
pop ebp
ret 4
Function at 0x44def4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, 0x4e1ea4
cmp dword [ebp + 0x20], 0
jne 0x44df17
mov dword [0x4e1e98], 1
jmp 0x44df8a
cmp dword [esi + 4], 0
jne 0x44df3c
push 1
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00488af4
jmp 0x44e111
cmp dword [esi + 0x2c], 0
jne 0x44df4c
mov eax, 2
jmp 0x44e111
mov edx, dword [esi + 0x2c]
cmp dword [edx + 0x18], 1
je 0x44df5f
mov eax, 1
jmp 0x44e111
mov edx, dword [esi + 0x2c]
cmp dword [edx + 8], 0
jne 0x44e0ed
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
push eax
call fcn.004c4ccc
pop ecx
mov dword [0x4e1e98], eax
cmp dword [0x4e1e98], 0
jl 0x44e0ed
mov edx, dword [ebp + 8]
push edx
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x44e0ed
push 1
call sub.USER32.dll_GetClipboardData
mov dword [0x4e1e94], eax
cmp dword [0x4e1e94], 0
je 0x44e0e8
mov ecx, dword [0x4e1e94]
push ecx
call sub.KERNEL32.dll_GlobalLock
mov dword [0x4e1ea8], eax
cmp dword [0x4e1ea8], 0
je 0x44e0e8
mov byte [edi], 0
mov eax, dword [0x4e1ea8]
push eax
call fcn.004bceac
pop ecx
mov dword [0x4e1ea0], eax
xor edx, edx
mov dword [0x4e1e9c], edx
push 0xa
mov ecx, dword [0x4e1ea8]
push ecx
call fcn.004bce0c
add esp, 8
mov dword [ebx], eax
inc dword [0x4e1e9c]
mov eax, dword [0x4e1e9c]
cmp eax, dword [0x4e1e98]
jne 0x44e045
cmp dword [ebx], 0
je 0x44e01e
mov edx, dword [ebx]
mov byte [edx], 0
push 0x3b5
mov ecx, dword [0x4e1ea8]
push ecx
push edi
call fcn.004bd02c
add esp, 0xc
mov byte [edi + 0x3b5], 0
mov eax, dword [ebx]
test eax, eax
je 0x44e063
mov byte [eax], 0xa
jmp 0x44e063
cmp dword [ebx], 0
je 0x44e063
inc dword [ebx]
mov edx, dword [ebx]
cmp byte [edx], 0xd
jne 0x44e055
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0
je 0x44e063
mov dword [0x4e1ea8], eax
jmp 0x44dfee
cmp dword [0x4e1e98], 0
jne 0x44e081
mov edx, dword [0x4e1e9c]
push edx
push 0x4ce6b6
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [esi + 0xc], 0
je 0x44e0dd
push 0x2e
mov ecx, dword [esi]
push ecx
call fcn.004bd108
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x44e0dd
push str..len
mov edx, dword [ebx]
push edx
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x44e0da
cmp dword [0x4e1e98], 0
je 0x44e0c3
push edi
call fcn.004bceac
pop ecx
mov dword [0x4e1ea0], eax
mov ecx, dword [0x4e1ea0]
push ecx
push 0x4ce6c0
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x44e0dd
mov byte [edi], 0
mov eax, dword [0x4e1e94]
push eax
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [ebp + 0x20], 1
jne 0x44e10c
mov edx, dword [esi + 0x2c]
push edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push eax
call fcn.0046f72c
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
xor ecx, ecx
mov dword [esi + 4], ecx
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c