joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462fe8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4630a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00462f7c
test al, al
je 0x463082
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403c8c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x463082
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fe8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00403fe8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403d5c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x46303b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4630a7
lea eax, [ebp - 0x2c]
call fcn.00403ba8
lea eax, [ebp - 0xc]
call fcn.00403ba8
ret

Function at 0x4630b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 8
call fcn.00402bd8
lea eax, [ebx + 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.00403fe8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.00462c40
mov byte [ebx], al
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x463254
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4632e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00462c10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403fe8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4632cf
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x54c4fc]
call fcn.00405c00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x462ac0]
call fcn.0040bb18
call fcn.0040361c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4632ec
lea eax, [ebp - 0x10]
call fcn.00403ba8
ret
Function at 0x4632f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463393
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403fe8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x46336d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x54c8d0]
call fcn.00405c00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x462ac0]
call fcn.0040bb18
call fcn.0040361c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00462c40
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46339a
lea eax, [ebp - 0x10]
call fcn.00403ba8
ret

Function at 0x464248
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
test byte [ebx + 0x20], 0x10
jne 0x4642db
cmp byte [ebx + 0xbb], 0
jne 0x4642db
mov byte [ebx + 0xbb], 1
cmp byte [ebx + 0xbd], 0
je 0x464299
cmp word [ebx + 0x102], 0
je 0x464299
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x464299
lea edx, [ebx + 0xc0]
mov eax, dword [ebx + 0x104]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [0x54c5c8]
mov eax, dword [eax]
call fcn.0043aee0
push 6
mov eax, dword [0x54c5c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x54c5c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebx + 0xb8], 0
jne 0x4642db
mov dl, 1
mov eax, ebx
call fcn.00464354
pop ebx
pop ebp
ret
Function at 0x464830
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x464a12
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbb], 0
je 0x464a12
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8c], 0
jne 0x464a12
xor eax, eax
push ebp
push 0x464a0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x8c], 1
mov byte [ebp - 5], 0
mov byte [ebp - 7], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x122], 0
je 0x4648ad
lea ecx, [ebp - 7]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x124]
call dword [ebx + 0x120]
cmp byte [ebp - 7], 0
jne 0x4648bd
call fcn.004036bc
jmp 0x464a12
mov al, byte [ebp - 7]
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbd], 0
je 0x46491d
mov eax, dword [ebp - 4]
cmp word [eax + 0x10a], 0
je 0x46491d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
call fcn.00403e24
test eax, eax
jle 0x46491d
mov byte [ebp - 6], 0
lea ecx, [ebp - 6]
mov eax, dword [ebp - 4]
lea edx, [eax + 0xc0]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x10c]
call dword [ebx + 0x108]
cmp byte [ebp - 6], 0
jne 0x46491d
call fcn.004036bc
jmp 0x464a12
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb8], 0
jne 0x464942
push 0
push 0
push 0x6d81
mov eax, dword [0x54c5c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_PostMessageA
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_LockWindowUpdate
xor eax, eax
push ebp
push 0x4649ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x54c5c8]
mov eax, dword [eax]
call fcn.0043af28
push 9
mov eax, dword [0x54c5c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x4315d0]
call fcn.004030d4
mov dl, 1
call fcn.00435230
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x4315d0]
call fcn.004030d4
call fcn.004471a4
mov dl, 1
call fcn.00457140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4649f3
mov eax, dword [ebp - 4]
mov byte [eax + 0xbb], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0xfa], 0
je 0x4649e4
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
push 0
call sub.user32.dll_LockWindowUpdate
ret
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x465b10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x465bc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403fe8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x465b52
call fcn.004036bc
jmp 0x465bce
mov eax, ebx
call fcn.00402714
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00403fe8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x465b7b
call fcn.004036bc
jmp 0x465bce
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x465bd8
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x465b9c
call fcn.004036bc
jmp 0x465bce
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465bce
mov eax, dword [ebp - 8]
call fcn.0040272c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465e8c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ecx, ecx
push ebp
push 0x465ed1
push dword fs:[ecx]
mov dword fs:[ecx], esp
or edx, 0x4008
push edx
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465edd
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465ee8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x465f38
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465f44
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466090
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
xor eax, eax
push ebp
push 0x46623d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46624c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x466224
xor eax, eax
push ebp
push 0x46621d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.00466044
mov eax, dword [ebp - 0x168]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.00466044
mov eax, dword [ebp - 0x168]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00422d5c
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00422d5c
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00422d5c
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00422d5c
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x548f38], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466224
cmp dword [ebp - 4], 0
je 0x46621c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466244
lea eax, [ebp - 0x168]
call fcn.00403ba8
ret

Function at 0x466258
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
xor edx, edx
mov dword [ebp - 0x164], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4662f3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00465b04
test al, al
je 0x46629d
cmp dword [0x54e918], 0x40047
jl 0x46629d
cmp byte [0x548f38], 0
jne 0x46629d
call fcn.00466090
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x548f3c]
or eax, 0x4000
push eax
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
lea eax, [ebp - 0x164]
call fcn.00466044
mov eax, dword [ebp - 0x164]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4662fa
lea eax, [ebp - 0x164]
call fcn.00403ba8
ret
Function at 0x467528
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46757b
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4000
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0x90
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467587
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x467590
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4675e0
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4675ec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f7a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46f878
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x54e9e0], 0
jne 0x46f85c
lea eax, [ebp - 4]
mov edx, 0x46f890
call fcn.00403c40
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fe8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x46f85c
mov eax, ebx
call fcn.00402714
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46f855
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46f83f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46f8a0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46f83f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x54e9e0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f85c
mov eax, dword [ebp - 0xc]
call fcn.0040272c
ret
mov ebx, dword [0x54e9e0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f87f
lea eax, [ebp - 4]
call fcn.00403ba8
ret

Function at 0x481acc
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x54ea08], 0
jne 0x481af2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x481a50
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x54ea08], eax
pop ebp
ret
Function at 0x4829b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.004475cc
test al, al
je 0x482a11
cmp bl, 7
jne 0x4829ed
push 2
lea eax, [ebp - 2]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [ebp - 2]
sub edi, 0x30
jmp 0x4829f2
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
test eax, eax
je 0x482a11
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
mov edx, edi
call fcn.004235b4
mov byte [esi + 0x204], bl
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48c630
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x48c73b
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x33c], esi
inc esi
jne 0x48c674
lea ecx, [ebp - 0x18]
mov dx, 0x2733
mov eax, edi
call fcn.0048db70
mov dl, 1
mov eax, edi
call fcn.00489f54
mov byte [edi + 0x340], 1
mov byte [edi + 0x1361], 1
lea eax, [ebp - 0x12]
mov edx, 0x48c754
call fcn.004098ec
push eax
call sub.wsock32.dll_inet_addr
mov dword [edi + 0x2b8], eax
mov word [edi + 0x2b4], 2
mov ax, word [edi + 0xf0]
push eax
call sub.wsock32.dll_htons
mov word [edi + 0x2b6], ax
mov byte [edi + 0x120], 0
push 0x10
lea eax, [edi + 0x2b4]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_bind
test bl, bl
je 0x48c6fd
push 8
push 0x466
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x48c717
push 8
push 0x465
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 1
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_listen
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c742
lea eax, [ebp - 0x18]
call fcn.00403ba8
ret

Function at 0x48cd20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x33c]
cmp eax, 0xffffffff
jne 0x48cd43
or esi, 0xffffffff
jmp 0x48cdfe
or esi, 0xffffffff
cmp byte [ebx + 0x2eb], 0
je 0x48cdef
cmp byte [ebx + 0x301], 0
jne 0x48cd65
cmp byte [ebx + 0x310], 0
jne 0x48cd81
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54c614]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
jmp 0x48cdfe
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x48cde6
mov edx, dword [ebp - 4]
push edx
push edi
push eax
mov eax, dword [0x54c614]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x48cde1
cmp dword [ebp - 8], 0xfa0
jg 0x48cde6
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x48cde6
push esi
push eax
mov eax, dword [0x54c7f4]
mov eax, dword [eax]
call eax
add esp, 8
test eax, eax
je 0x48cde6
cmp eax, 5
je 0x48cde6
inc dword [ebp - 8]
mov dx, 2
mov eax, ebx
call fcn.0048e164
cmp esi, 0xffffffff
je 0x48cd86
test esi, esi
jne 0x48cdfe
or esi, 0xffffffff
jmp 0x48cdfe
push 0
mov edx, dword [ebp - 4]
push edx
push edi
push eax
call sub.wsock32.dll_recv
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48ce08
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [eax + 0x33c]
cmp esi, 0xffffffff
jne 0x48ce1d
or eax, 0xffffffff
pop esi
pop ebp
ret
cmp byte [eax + 0x2eb], 0
je 0x48ce3d
push ecx
push edx
mov eax, dword [eax + 0x2ec]
push eax
mov eax, dword [0x54c360]
mov eax, dword [eax]
call eax
add esp, 0xc
jmp 0x48ce47
push 0
push ecx
push edx
push esi
call sub.wsock32.dll_send
pop esi
pop ebp
ret

Function at 0x48e1b8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x54c6b8]
mov edx, dword [edx]
call fcn.00403c40
cmp dword [ebx + 0x33c], 0xffffffff
je 0x48e22c
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_getsockname
push esi
mov bx, word [ebp - 0x12]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
shr bx, 8
movzx eax, bx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x48e23c
call fcn.00409f80
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f01c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48f0c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2c8]
mov edx, dword [0x54c6b8]
mov edx, dword [edx]
call fcn.00403f34
jne 0x48f080
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_getsockname
push dword [ebp - 0x10]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.00409a38
jmp 0x48f08d
mov eax, esi
mov edx, dword [ebx + 0x2c8]
call fcn.00403c40
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esi]
mov ecx, 0x48f0dc
mov edx, 0x48f0e8
call fcn.00453350
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.00403c40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f0cb
lea eax, [ebp - 0x18]
call fcn.00403ba8
ret

Function at 0x48f1ac
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, edx
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.00402bd8
lea eax, [ebp - 0x22]
mov edx, 0x48f238
call fcn.004098ec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.wsock32.dll_bind
test eax, eax
sete bl
xor bl, 1
test bl, bl
jne 0x48f220
push 1
push esi
call sub.wsock32.dll_listen
test eax, eax
sete bl
xor bl, 1
push esi
call sub.wsock32.dll_closesocket
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f86c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402bd8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
pop ebp
ret

Function at 0x4905a4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00402bd8
pop ebp
ret