joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473a4c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473b6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00472e0c
xor eax, eax
push ebp
push 0x473b51
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x473a9c
call fcn.00404590
jmp 0x473b58
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x473b3b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x473b3b
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403f54
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x473b3b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c520
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x473b88
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4a06b0]
mov dl, 1
mov eax, dword [0x47193c]
call fcn.0040ce44
call fcn.004044e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473b58
mov eax, dword [ebp - 4]
call fcn.00472e18
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473b75
lea eax, [ebp - 0x28]
call fcn.00404b2c
ret
Function at 0x473bd4
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473d1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00472e0c
xor eax, eax
push ebp
push 0x473d01
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x473c39
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x473c39
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x473ceb
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x473c4c
call fcn.00404590
jmp 0x473d08
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x473ceb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x473ceb
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403f54
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x473ceb
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c520
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x473d38
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4a06b0]
mov dl, 1
mov eax, dword [0x47193c]
call fcn.0040ce44
call fcn.004044e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473d08
mov eax, dword [ebp - 4]
call fcn.00472e18
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473d25
lea eax, [ebp - 0x28]
call fcn.00404b2c
ret
Function at 0x475c60
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x475c7c
add esp, 0xfffffff0
call fcn.0040407c
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x475dbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.0041c128
mov byte [ebx + 0x10210], 0
mov eax, 0x400
call fcn.0040272c
mov dword [ebx + 0x10068], eax
push ebx
push 0x476508
call fcn.0044b7ac
mov dword [ebx + 0x10060], eax
mov dword [ebx + 0x10208], 1
mov byte [ebx + 0x1006c], 0
push 0x475de4
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebx + 0x10248], eax
lea eax, [ebp - 8]
call fcn.004758d8
mov ecx, dword [ebp - 8]
mov dl, 8
mov eax, ebx
call fcn.00476488
lea eax, [ebx + 0x10070]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup_1
test eax, eax
jne 0x475d8b
xor eax, eax
push ebp
push 0x475d75
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x1024c], esi
inc esi
jne 0x475d42
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.00476314
push 4
lea eax, [ebp - 0x10]
call fcn.004758b0
mov eax, dword [ebp - 0x10]
call fcn.00404fec
push eax
push 0xff7f
push 0xffff
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_setsockopt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475d99
lea ecx, [ebp - 0x14]
mov dx, 0x2733
mov eax, ebx
call fcn.00476314
mov byte [ebx + 0x10210], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475dc2
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404b50
ret

Function at 0x475e34
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475f08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1024c]
test eax, eax
je 0x475e63
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup_1
lea eax, [ebx + 0x10070]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup_1
test eax, eax
jne 0x475ecf
xor eax, eax
push ebp
push 0x475eb9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x1024c], esi
inc esi
jne 0x475eaf
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.00476314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475edd
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.00476314
mov eax, dword [ebp - 4]
mov dword [ebx + 0x1003c], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475f0f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404b50
ret
Function at 0x476164
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x476189
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x476182
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4762fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp dword [ebp + 8], 0
jne 0x476244
test esi, esi
jle 0x4761cf
lea eax, [ebp - 0x10]
call fcn.00475bdc
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x408088]
call fcn.0040cd4c
call fcn.004044e4
jmp 0x47623a
cmp word [ebx + 0x10242], 0
jne 0x4761f7
lea eax, [ebp - 0x14]
call fcn.00475bdc
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x408088]
call fcn.0040cd4c
call fcn.004044e4
jmp 0x47623a
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 9]
mov eax, dword [ebx + 0x10244]
call dword [ebx + 0x10240]
cmp byte [ebp - 9], 0
jne 0x476239
lea eax, [ebp - 0x18]
call fcn.00475bdc
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x408088]
call fcn.0040cd4c
call fcn.004044e4
jmp 0x47623a
inc esi
cmp dword [ebp + 8], 0
je 0x4761ad
mov byte [ebx + 0x1006c], 0
mov eax, ebx
call fcn.00475fa4
cmp dword [ebx + 0x10044], 0
jne 0x476277
lea eax, [ebp - 0x1c]
call fcn.00475b74
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x4754b0]
call fcn.0040cd4c
call fcn.004044e4
lea eax, [ebp - 0x20]
call fcn.004759b0
mov ecx, dword [ebp - 0x20]
mov dl, 2
mov eax, ebx
call fcn.00476488
mov word [ebx + 0x10040], 2
mov ax, word [ebx + 0x10038]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x10042], ax
mov eax, 0x10
push eax
lea eax, [ebx + 0x10040]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0x1022a], 0
je 0x4762e3
mov edx, ebx
mov eax, dword [ebx + 0x1022c]
call dword [ebx + 0x10228]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476305
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404b50
ret
Function at 0x47657c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x476650
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xffff
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x10030], eax
cmp word [ebx + 0x10222], 0
je 0x47663a
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x476664
call fcn.0040a36c
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x10030]
mov edx, ebx
mov eax, dword [ebx + 0x10224]
call dword [ebx + 0x10220]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476657
lea eax, [ebp - 8]
call fcn.00404b2c
ret

Function at 0x47684c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x476979
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10034]
mov edx, dword [ebp - 4]
call fcn.00404b80
mov dword [ebx + 0x10224], esi
mov dword [ebx + 0x10220], 0x4767bc
mov edx, 0xfa0
mov eax, ebx
call fcn.00475e34
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.00476164
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x4768e1
mov eax, dword [0x4a05d4]
mov eax, dword [eax]
call fcn.00454424
cmp dword [ebx + 0xc], 0
jne 0x47695d
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x32
jb 0x4768d5
jmp 0x47695d
mov edx, dword [edi]
mov eax, ebx
call fcn.00475e34
inc dword [edi]
cmp dword [edi], 0xffff
jne 0x47690e
mov dword [edi], 0xfa0
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.00476164
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x47694b
mov eax, dword [0x4a05d4]
mov eax, dword [eax]
call fcn.00454424
cmp dword [ebx + 0xc], 0
jne 0x47695d
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x32
jb 0x47693f
cmp dword [ebx + 0xc], 0
je 0x4768f5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476980
lea eax, [ebp - 4]
call fcn.00404b2c
ret
Function at 0x48753c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4a6960
cmp dword [edi], 0
jne 0x4875b8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4a695c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x49fc98
mov ecx, 2
call fcn.004029d8
mov edx, 0x487514
lea eax, [esi + 5]
call fcn.00487534
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00487534
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x48758d
mov dword [0x4a695c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x487734
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x48784a
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x487855
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x4877d8
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4877d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004029d8
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4877d8
mov eax, dword [ebp - 0xc]
call fcn.0040274c
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00407a58
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x487855
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x487855
jmp 0x487855
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00487a18
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48785c
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x4878d5
push 0x10004
push 0
mov eax, dword [ebx + 0x98]
push eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x4878d5
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x4878b4
mov eax, ebx
call fcn.004879a0
dec esi
jne 0x4878aa
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x4878d5
mov esi, esp
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 4], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret

Function at 0x4879a0
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.0040272c
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.004158cc
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.0040272c
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x487a00
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x487db8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc0
mov edi, eax
push 0x14
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x487bac]
call fcn.00405e8c
add esp, 4
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname_1
push esp
call sub.wsock32.dll_gethostbyname_1
test eax, eax
jne 0x487e18
push 0
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x487bac]
call fcn.00405e8c
add esp, 4
cmp word [edi + 0x42], 0
je 0x487e58
xor edx, edx
mov eax, dword [edi + 0x44]
call dword [edi + 0x40]
jmp 0x487e58
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x487e35
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [edi + 0x4c]
lea eax, [eax + ebx*4]
call fcn.00404d24
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
je 0x487e41
cmp ebx, 0x14
jl 0x487e1f
push ebx
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x487bac]
call fcn.00405e8c
add esp, 4
add esp, 0x40
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x487e60
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, eax
lea ebp, [esp + 8]
mov eax, dword [ebx + 0x4c]
call fcn.00405cd8
inc eax
je 0x487f64
mov eax, dword [ebx + 0x4c]
call fcn.00405cd8
inc eax
push eax
lea eax, [ebx + 0x48]
mov ecx, 1
mov edx, dword [0x487b88]
call fcn.00405e8c
add esp, 4
mov eax, dword [ebx + 0x4c]
call fcn.00405cd8
mov edi, eax
test edi, edi
jl 0x487f64
inc edi
xor esi, esi
push 0
push 3
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebx + 0x48]
mov dword [edx + esi*4], eax
mov word [ebp], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + esi*4]
call fcn.00404fec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp + 4], eax
push 0x10
push ebp
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_bind
mov edx, eax
mov eax, ebx
call fcn.00488448
mov dword [esp], 1
xor eax, eax
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x2c
lea eax, [esp + 0x28]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x98000001
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call dword [ebx + 0x6c]
mov edx, eax
mov eax, ebx
call fcn.00488448
push 0x21
lea eax, [esi + 0x4c8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov edx, eax
mov eax, ebx
call fcn.00488448
inc esi
dec edi
jne 0x487eb1
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4885f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe70
mov edi, eax
mov bl, 1
cmp byte [edi + 0x7d], 0
jne 0x48873b
push 0x488748
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 0x30], esi
test esi, esi
jne 0x488625
xor ebx, ebx
jmp 0x48873b
push 0x488754
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x50], eax
push 0x488760
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x54], eax
push 0x488768
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x58], eax
push 0x488774
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x5c], eax
push 0x48877c
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x60], eax
push 0x488784
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x64], eax
push 0x488790
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x68], eax
push 0x488798
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x6c], eax
push 0x4887a4
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x70], eax
push 0x4887ac
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x74], eax
push 0x4887b8
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x78], eax
cmp dword [edi + 0x50], 0
je 0x488722
cmp dword [edi + 0x5c], 0
je 0x488722
cmp dword [edi + 0x60], 0
je 0x488722
cmp dword [edi + 0x68], 0
je 0x488722
cmp dword [edi + 0x74], 0
je 0x488722
cmp dword [edi + 0x54], 0
je 0x488722
cmp dword [edi + 0x58], 0
je 0x488722
cmp dword [edi + 0x64], 0
je 0x488722
mov eax, sub.wsock32.dll_recv
test eax, eax
je 0x488722
cmp dword [edi + 0x6c], 0
je 0x488722
cmp dword [edi + 0x78], 0
jne 0x488726
xor ebx, ebx
jmp 0x48873b
push esp
push 0x201
call dword [edi + 0x50]
test eax, eax
je 0x488737
xor ebx, ebx
jmp 0x48873b
mov byte [edi + 0x7d], 1
mov eax, ebx
add esp, 0x190
pop edi
pop esi
pop ebx
ret
Function at 0x488cc8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
mov eax, ebx
shr eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
shr ecx, 0x10
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 1]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 2]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 3]
imul eax, ecx
add edi, eax
inc edi
mov dword [esp + 4], edi
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
and ecx, 0xffff
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4 + 4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 5]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 6]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 7]
imul eax, ecx
add edi, eax
inc edi
mov eax, edi
mov ecx, dword [esp + 4]
shl ecx, 0x10
mov esi, eax
and esi, 0xffff
or ecx, esi
mov esi, dword [esp]
mov edi, dword [esp + 0xc]
mov dword [esi + edi*4], ecx
mov ecx, dword [esp + 4]
and ecx, 0xffff0000
shr eax, 0x10
or ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x10], ecx
add ebx, 2
cmp ebx, 8
jne 0x488cd4
mov eax, dword [esp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov ebx, dword [esp + 0x1c]
mov esi, ebx
shl esi, 0x10
or ecx, esi
mov dword [edx + 0x20], ecx
shl eax, 0x10
mov ecx, dword [esp + 0x14]
mov esi, ecx
shr esi, 0x10
or eax, esi
mov dword [edx + 0x24], eax
shl ecx, 0x10
mov eax, dword [esp + 0x18]
shr eax, 0x10
or ecx, eax
mov dword [edx + 0x28], ecx
mov eax, dword [esp + 0x18]
shl eax, 0x10
shr ebx, 0x10
or eax, ebx
mov dword [edx + 0x2c], eax
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret