joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f2a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46f343
cmp dword [ebx + 0x94], 0
jne 0x46f33d
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46f22c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46f33d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46f303
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46f33d
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b844
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46f312
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46f55c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x52ecd4]
cmp dword [eax + 0x30], 0
je 0x46f6b9
test bl, bl
jne 0x46f60a
cmp dword [esi + 0x9c], 0
jne 0x46f5ff
mov eax, esi
call fcn.00471ef4
push eax
push 0x46f488
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x46f5d0
mov eax, dword [0x52ecd4]
call fcn.004725d4
test al, al
je 0x46f5d0
mov eax, dword [0x52ecf8]
call fcn.004063a4
mov edi, eax
cmp edi, 0
jl 0x46f5d0
push 0
mov eax, dword [0x52ecf8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46f5ba
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46f5ff
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b844
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46f5df
inc dword [esi + 0x9c]
jmp 0x46f6b9
cmp dword [esi + 0x9c], 0
jle 0x46f6b9
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x46f6b9
cmp dword [esi + 0x44], 0
je 0x46f665
mov eax, dword [0x52ecd4]
call fcn.004725d4
test al, al
je 0x46f665
mov eax, dword [0x52ecf8]
call fcn.004063a4
mov edi, eax
cmp edi, 0
jl 0x46f665
push 5
mov eax, dword [0x52ecf8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46f64f
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46f694
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b844
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46f674
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x52ecf8
mov ecx, 1
mov edx, dword [0x46f468]
call fcn.00406558
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4701a0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x47020a
mov eax, ebx
call fcn.004725d4
test al, al
jne 0x47020a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404eb8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4701f7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x470217
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e1c
jmp 0x470217
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e1c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4716f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x471766
mov eax, esi
call fcn.00459c50
test al, al
je 0x471766
mov eax, dword [ebx + 0x84]
call fcn.004598b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x471766
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x47175a
push 0
mov eax, dword [ebx + 0x84]
call fcn.004598b0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004516e8
jmp 0x471766
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00471534
pop esi
pop ebx
ret
Function at 0x472dfc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4081c8]
call fcn.00405a58
xor eax, eax
push ebp
push 0x472f9d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x50ab2c], 0
jne 0x472e57
mov ecx, dword [0x529158]
mov dl, 1
mov eax, dword [0x40883c]
call fcn.0040e20c
call fcn.004046fc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004036e4
mov eax, ebx
call fcn.00405710
mov dword [ebp - 0x24], eax
mov esi, 0x472fac
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406c48
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405720
test eax, eax
jle 0x472f40
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x472f2c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405038
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x472ed2
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405050
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x472ee8
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405050
mov eax, dword [ebp - 0x54]
call fcn.00405258
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405038
mov eax, dword [ebp - 0x58]
call fcn.00405258
push eax
push 1
push 0x400
call sub.KERNEL32.DLL_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x472f2e
xor eax, eax
test al, al
je 0x472f39
mov ebx, 0x15
jmp 0x472f45
mov ebx, 0x10
jmp 0x472f45
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x50ab2c]
call fcn.00472c7c
mov eax, dword [ebp - 4]
call fcn.00472c7c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406c60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472fa4
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404dec
lea eax, [ebp - 0xc]
mov edx, dword [0x4081c8]
call fcn.00405b28
ret
Function at 0x4794d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405248
mov eax, dword [ebp - 8]
call fcn.00405248
xor eax, eax
push ebp
push 0x479669
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x479614
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0x5294f4]
call fcn.00472ce4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, 0x479678
call fcn.00406c8c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, 0x479688
call fcn.00406c8c
mov eax, dword [ebp - 4]
call fcn.00405258
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 4]
call fcn.0040a648
mov eax, dword [ebp - 0x12c]
call fcn.00405258
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x20]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0x4796a0
push dword [ebp - 8]
push 0x4796ac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040515c
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00405038
lea eax, [ebp - 0x130]
mov edx, dword [ebp - 0xc]
call fcn.00405094
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x1c]
call fcn.00405700
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00405710
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47961e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479670
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.00404dec
lea eax, [ebp - 0x1c]
call fcn.004055a8
lea eax, [ebp - 0x18]
call fcn.00406c48
lea eax, [ebp - 0x14]
call fcn.00406c48
lea eax, [ebp - 0x10]
call fcn.00406c48
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404dec
ret

Function at 0x47de64
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004036e4
ret

Function at 0x49376c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x50b70c
test edx, edx
jne 0x49377f
xor eax, eax
jmp 0x493894
mov dword [esp], 1
cmp byte [esp], 0
je 0x49379c
push ecx
push edx
push eax
call fcn.00493898
add esp, 0xc
jmp 0x493894
push ecx
push edx
push eax
call fcn.00493b58
add esp, 0xc
jmp 0x493894
pop edx
pop esi
pop ebx
ret
Function at 0x495404
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x49543f
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x4954c0
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.0049295c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x49548d
mov cx, word [ebp - 4]
sub cx, si
jmp 0x49548f
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x495476
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x4954b5
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4954b7
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x49549e
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x495522
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.004950d0
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x49550d
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x495522
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x495413
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x49b1bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405248
xor eax, eax
push ebp
push 0x49b36a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
je 0x49b349
mov eax, ebx
xor ecx, ecx
mov edx, 0x21
call fcn.004036e4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405258
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49b349
mov eax, dword [ebp - 0x14]
call fcn.00402f48
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49b342
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49b32c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x49b37c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x49b32c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebx + 0x19], ax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
mov word [ebx + 0x1b], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebx + 0x1d], ax
mov eax, dword [ebp - 0x10]
movzx esi, word [eax + 0xc]
mov word [ebx + 0x1f], si
lea eax, [ebp - 0x118]
push eax
movzx eax, word [ebx + 0x19]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
movzx eax, word [ebx + 0x1b]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
movzx eax, word [ebx + 0x1d]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
movzx eax, si
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x138]
mov ecx, 3
mov eax, 0x49b388
call fcn.0040b2b8
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00405064
lea edx, [ebp - 0x114]
mov eax, ebx
mov cl, 0x18
call fcn.004035d4
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b349
mov eax, dword [ebp - 0xc]
call fcn.00402f7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b371
lea eax, [ebp - 0x118]
call fcn.00404dc8
lea eax, [ebp - 4]
call fcn.00404dc8
ret
Function at 0x4acc18
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4acca1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x52feb8
push 0x202
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4acc8b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040d90c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x4accb8
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x529784]
mov dl, 1
mov eax, dword [0x4ac418]
call fcn.0040e248
call fcn.004046fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acca8
lea eax, [ebp - 0x1c]
call fcn.00404dc8
ret

Function at 0x4ad280
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x4ad2dc]
cmp al, byte [ebx + 0x28]
je 0x4ad2a4
mov esi, 0x401
mov eax, ebx
call fcn.004ad3d8
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x4ad2dc]
cmp al, byte [ebx + 0x28]
jne 0x4ad2d4
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ad368
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004ad280
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403fc0
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, eax
mov ecx, 0x4ad3d0
mov eax, ebx
call fcn.004acb5c
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x4ad3c2
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403fc0
pop esi
pop ebx
ret

Function at 0x4ad548
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00405258
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.004036e4
test ebx, ebx
je 0x4ad597
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x4ad674
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4ad6a5
mov ecx, dword [0x5295f4]
mov dl, 1
mov eax, dword [0x4ac418]
call fcn.0040e20c
call fcn.004046fc
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4ad6d2
mov ecx, dword [0x529530]
mov dl, 1
mov eax, dword [0x4ac418]
call fcn.0040e20c
call fcn.004046fc
xor eax, eax
push ebp
push 0x4ad74e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403fc0
cmp byte [ebp + 8], 0
je 0x4ad72a
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004ad5dc
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004ad368
jmp 0x4ad744
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004ace50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad76b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ad94c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004ad118
xor eax, eax
push ebp
push 0x4adabf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4adaa9
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4ad998
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4ad9a2
call fcn.004047a8
jmp 0x4adac6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ebf4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4ada9e
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x4ada51
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4ada3e
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403fc0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004ad904
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x4adad4]
cmp dl, byte [eax + 0x28]
je 0x4adaa5
call fcn.0040e124
jmp 0x4adaa5
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ec14
jmp 0x4adaa5
cmp edi, ebx
jge 0x4ada6d
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ec14
jmp 0x4ad9a2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ebf4
cmp edx, dword [esp + 4]
jne 0x4ada8d
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4ad9a2
push ebp
call fcn.004ad904
pop ecx
jmp 0x4adaa5
push ebp
call fcn.004ad904
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adac6
mov eax, dword [ebp - 4]
call fcn.004ad124
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4adad8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4adbfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ad118
xor eax, eax
push ebp
push 0x4adbdd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4adb28
call fcn.004047a8
jmp 0x4adbe4
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4adbc7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4adbc7
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403fc0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4adbc7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d90c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4adc14
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x529784]
mov dl, 1
mov eax, dword [0x4ac418]
call fcn.0040e248
call fcn.004046fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adbe4
mov eax, dword [ebp - 4]
call fcn.004ad124
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adc01
lea eax, [ebp - 0x28]
call fcn.00404dc8
ret