joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457164
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4ead04]
cmp byte [eax + 0xc], 0
je 0x4572d1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4572ca
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4efc64], 0
jne 0x4571b8
push 0x4572d8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4572e0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc64], eax
cmp dword [0x4e3714], 0
jne 0x4572b3
push 0x4572f0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e3714], eax
cmp dword [0x4e3714], 0
je 0x4572b3
push 0x4572fc
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc68], eax
push 0x45730c
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc6c], eax
push 0x457320
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc70], eax
push 0x457338
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc74], eax
push 0x457350
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc78], eax
push 0x457364
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc7c], eax
push 0x45737c
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc80], eax
push 0x457394
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc84], eax
push 0x4573b0
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc88], eax
push 0x4573bc
mov eax, dword [0x4e3714]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4efc8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4572d1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45d52c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x45d54d
test edi, 0x40000
je 0x45d567
test bl, bl
jne 0x45d5e8
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x45d5e8
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x45d59a
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x45d5af
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x45d5be
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x45d5cf
cmp byte [esp + 2], 0
je 0x45d5e8
cmp byte [esp + 2], 0
je 0x45d5e0
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x45d5e8
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x45d88c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x45d8b2
mov eax, esp
push eax
push 0x45d854
call sub.user32.dll_EnumWindows
jmp 0x45d8c5
mov eax, esp
push eax
push 0x45d834
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x45d950
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x45d9a4]
test si, 4
je 0x45d965
or bl, 1
test si, 8
je 0x45d96f
or bl, 4
test si, 1
je 0x45d979
or bl, 8
test si, 2
je 0x45d983
or bl, 0x10
test si, 0x10
je 0x45d98d
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45d99c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45d9a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x45d9e4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45d9c2
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45d9d1
or bl, 4
test esi, 0x20000000
je 0x45d9dc
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x465a8c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x465a9e
add esp, 0xfffffff0
call fcn.0040454c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420358
mov eax, dword [0x4ea80c]
mov dword [eax + 4], ebx
mov dword [eax], 0x465e30
mov eax, dword [0x4ea818]
mov dword [eax + 4], ebx
mov dword [eax], 0x465e3c
mov eax, ebx
call fcn.00465e48
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4612d4
push eax
push 0
push 0
mov eax, dword [0x4eaa1c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x426854]
call fcn.00428148
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x426854]
call fcn.00428148
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x426854]
call fcn.00428148
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004662c0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x466190
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x466190
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x466190
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x465bdb
call fcn.004045a4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x465f74
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46611f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x466100
mov dl, 1
mov eax, dword [0x41786c]
call fcn.004041f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00405128
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4660ef
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004574c0
test al, al
je 0x4660e2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x466130
lea eax, [ebp - 0x254]
call fcn.0040b054
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4660e2
xor eax, eax
push ebp
push 0x4660db
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x466168
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4660c4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405398
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4660c4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4660e2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x465fe5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041ba38
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466126
lea eax, [ebp - 0x260]
call fcn.00405128
ret

Function at 0x466a98
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4efca8]
cmp byte [eax + 0xad], 0
jne 0x466b09
cmp dword [0x4efcc4], 0
jne 0x466aca
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x466a54
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4efcc4], eax
cmp dword [0x4efcc0], 0
jne 0x466ae5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4efcc0], eax
cmp dword [0x4efcc8], 0
jne 0x466b09
push esp
push 0
push 0
push 0x4669f8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4efcc8], eax
pop edx
ret
Function at 0x466d0c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x466d23
add esp, 0xfffffff0
call fcn.0040454c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420358
mov eax, dword [0x4eaa00]
cmp word [eax + 2], 0
jne 0x466d4b
mov eax, dword [0x4eaa00]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00468a6c
mov eax, dword [0x4eaafc]
cmp word [eax + 2], 0
jne 0x466d65
mov eax, dword [0x4eaafc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00468c78
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x417448]
call fcn.004041f8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x427404]
call fcn.0042f9ec
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x466f1c
mov eax, dword [0x4ea8a4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042fdc0
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46934c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4ea8a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ec5c
test eax, eax
je 0x466e6c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a9b8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ec90
test eax, eax
je 0x466e80
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405398
mov byte [ebx + 0xd4], 0
push ebx
push 0x4684e0
call fcn.004214d4
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4ea6f4]
cmp byte [eax], 0
jne 0x466ed1
mov eax, ebx
call fcn.00467060
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00469560
mov eax, ebx
call fcn.0046a0c4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x466f11
call fcn.004045a4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4672e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46737f
cmp dword [ebx + 0x94], 0
jne 0x467379
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x467268
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x467379
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46733f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x467379
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004198fc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46734e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x467598
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4efca8]
cmp dword [eax + 0x30], 0
je 0x4676f5
test bl, bl
jne 0x467646
cmp dword [esi + 0x9c], 0
jne 0x46763b
mov eax, esi
call fcn.00469f40
push eax
push 0x4674c4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x46760c
mov eax, dword [0x4efca8]
call fcn.0046a620
test al, al
je 0x46760c
mov eax, dword [0x4efccc]
call fcn.00406514
mov edi, eax
cmp edi, 0
jl 0x46760c
push 0
mov eax, dword [0x4efccc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4675f6
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46763b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004198fc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46761b
inc dword [esi + 0x9c]
jmp 0x4676f5
cmp dword [esi + 0x9c], 0
jle 0x4676f5
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4676f5
cmp dword [esi + 0x44], 0
je 0x4676a1
mov eax, dword [0x4efca8]
call fcn.0046a620
test al, al
je 0x4676a1
mov eax, dword [0x4efccc]
call fcn.00406514
mov edi, eax
cmp edi, 0
jl 0x4676a1
push 5
mov eax, dword [0x4efccc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46768b
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4676d0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004198fc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4676b0
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4efccc
mov ecx, 1
mov edx, dword [0x4674a4]
call fcn.004066c8
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4681dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x468246
mov eax, ebx
call fcn.0046a620
test al, al
jne 0x468246
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405218
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x468233
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x468253
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040517c
jmp 0x468253
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040517c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x469744
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4697b2
mov eax, esi
call fcn.004520ac
test al, al
je 0x4697b2
mov eax, dword [ebx + 0x84]
call fcn.00451d0c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4697b2
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4697a6
push 0
mov eax, dword [ebx + 0x84]
call fcn.00451d0c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00449b44
jmp 0x4697b2
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00469580
pop esi
pop ebx
ret
Function at 0x472a90
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408514]
call fcn.00405ca4
xor eax, eax
push ebp
push 0x472c31
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e39b4], 0
jne 0x472aeb
mov ecx, dword [0x4ea708]
mov dl, 1
mov eax, dword [0x408b60]
call fcn.0040de0c
call fcn.00404a9c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a24
mov eax, ebx
call fcn.00405a9c
mov dword [ebp - 0x24], eax
mov esi, 0x472c40
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406ea0
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405aac
test eax, eax
jle 0x472bd4
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x472bc0
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405398
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x472b66
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004053b0
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x472b7c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004053b0
mov eax, dword [ebp - 0x54]
call fcn.004055b8
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405398
mov eax, dword [ebp - 0x58]
call fcn.004055b8
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x472bc2
xor eax, eax
test al, al
je 0x472bcd
mov ebx, 0x15
jmp 0x472bd9
mov ebx, 0x10
jmp 0x472bd9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4e39b4]
call fcn.00472910
mov eax, dword [ebp - 4]
call fcn.00472910
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406eb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472c38
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040514c
lea eax, [ebp - 0xc]
mov edx, dword [0x408514]
call fcn.00405d74
ret
Function at 0x47b748
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x47b7d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4efd78
push 0x202
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x47b7bb
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040d50c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x47b7e8
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4eab9c]
mov dl, 1
mov eax, dword [0x47a734]
call fcn.0040de48
call fcn.00404a9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b7d8
lea eax, [ebp - 0x1c]
call fcn.00405128
ret

Function at 0x47bdc8
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x47be24]
cmp al, byte [ebx + 0x28]
je 0x47bdec
mov esi, 0x401
mov eax, ebx
call fcn.0047bf20
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x47be24]
cmp al, byte [ebx + 0x28]
jne 0x47be1c
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x47beb0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0047bdc8
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00404424
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, eax
mov ecx, 0x47bf18
mov eax, ebx
call fcn.0047b68c
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x47bf0a
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00404424
pop esi
pop ebx
ret

Function at 0x47bf3c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004055b8
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00403a24
test ebx, ebx
je 0x47bf8b
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret