joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7043cf
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x704472
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 8]
push eax
call fcn.007043b2
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
pop ecx
call esi
lea ebx, [eax + 5]
jmp 0x704411
call esi
cmp eax, ebx
jb 0x70440f
lea eax, [ebp - 0x18]
push eax
call edi
lea eax, [ebp - 4]
push eax
call fcn.007043b2
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
pop ecx
test eax, eax
mov dword [ebp - 8], eax
fild dword [ebp - 8]
jge 0x70443b
fadd qword [0x7ab890]
mov eax, dword [ebp - 0x10]
fild dword [ebp - 0x10]
test eax, eax
jge 0x70444b
fadd qword [0x7ab890]
mov eax, dword [ebp - 0x18]
fmulp st(1)
sub eax, dword [ebp - 0x20]
test eax, eax
mov dword [ebp - 8], eax
fild dword [ebp - 8]
jge 0x704463
fadd qword [0x7ab890]
fdivp st(1)
fmul qword [0x7862e0]
call fcn.0075bc00
mov esi, eax
xor edx, edx
mov ecx, 0xc8
lea eax, [esi + esi*2 + 0x64]
div ecx
xor edx, edx
push 3
pop ecx
push 0x32
imul eax, eax, 0xc8
div ecx
xor edx, edx
pop ecx
mov edi, eax
lea eax, [esi + 0x19]
div ecx
mov ecx, eax
imul ecx, ecx, 0x32
mov eax, ecx
sub eax, esi
cdq
mov ebx, eax
xor ebx, edx
mov eax, edi
sub eax, esi
sub ebx, edx
cdq
xor eax, edx
sub eax, edx
cmp ebx, eax
jae 0x7044b9
mov eax, ecx
jmp 0x7044c4
cmp edi, 0x29a
mov eax, edi
jne 0x7044c4
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x721035
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [0x8b4654], 0x721017
call fcn.00721ce9
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [0x8b4470], ebx
lea eax, [edi + 0x50]
push eax
mov ecx, 0x8b4470
sete byte [ebp - 1]
call fcn.0071fbda
mov ecx, dword [ebp + 0xc]
xor esi, esi
cmp dword [ecx], ebx
jle 0x721094
lea edx, [ecx + 4]
mov eax, dword [edx]
add eax, edi
mov ebx, dword [eax]
mov ebx, dword [ebx*4 + 0x817fe0]
sub ebx, eax
sub ebx, 4
inc esi
mov dword [eax], ebx
add edx, 4
cmp esi, dword [ecx]
jl 0x721076
xor ebx, ebx
sub ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x34]
add eax, ecx
xor esi, esi
cmp dword [eax], ebx
mov dword [ebp + 0xc], ecx
jle 0x7210b6
lea edx, [eax + 4]
mov ecx, dword [edx]
add ecx, edi
add dword [ecx], edi
inc esi
add edx, 4
cmp esi, dword [eax]
jl 0x7210a8
mov esi, dword [edi + 0x38]
add esi, dword [ebp + 0xc]
mov dword [ebp + 8], ebx
cmp dword [esi], ebx
jle 0x72111a
lea ebx, [esi + 4]
mov eax, dword [ebx + 4]
add eax, dword [ebp + 0xc]
mov cx, word [eax]
mov word [ebp - 8], cx
mov cx, word [eax + 2]
add eax, 4
mov word [ebp - 6], cx
mov ecx, dword [ebx]
mov dword [ebp - 0xc], eax
mov al, byte [ebx + 8]
add ecx, edi
test al, al
jne 0x7210f7
lea eax, [ebp - 0xc]
push eax
call fcn.00735160
jmp 0x72110b
cmp al, 1
lea eax, [ebp - 0xc]
push eax
jne 0x721106
call fcn.00735140
jmp 0x72110b
call fcn.00735120
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add ebx, 0xc
cmp eax, dword [esi]
jl 0x7210c6
xor ebx, ebx
mov esi, dword [edi + 0x1c]
add esi, edi
cmp word [edi + 0xa], bx
mov dword [ebp + 8], ebx
jbe 0x721191
add dword [esi + 0x28], edi
mov ecx, dword [esi + 0x28]
add dword [esi + 0x2c], edi
mov eax, dword [esi + 0x2c]
lea edx, [ebp + 0xc]
push edx
push 0x40
sub eax, ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 4]
push eax
mov dword [esi + 0x14], 0x720de6
mov dword [esi + 0x18], esi
call fcn.007351e0
xor eax, eax
cmp byte [esi + 0x24], al
pop ecx
pop ecx
jbe 0x721177
mov ecx, dword [esi + eax*4 + 0x3c]
mov edx, dword [esi + 0x2c]
mov dword [ecx + edx], edi
movzx ecx, byte [esi + 0x24]
inc eax
cmp eax, ecx
jl 0x721164
movzx eax, byte [esi + 0x27]
movzx ecx, byte [esi + 0x24]
add eax, ecx
inc dword [ebp + 8]
lea esi, [esi + eax*4 + 0x3c]
movzx eax, word [edi + 0xa]
cmp dword [ebp + 8], eax
jl 0x721128
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x7211ca
cmp byte [esi], 0
je 0x7211ca
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7211a2
sub eax, ecx
inc eax
push eax
call fcn.007244e2
pop ecx
mov dword [edi + 0x48], eax
mov edx, esi
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x7211b8
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x4c], eax
jmp 0x7211cd
mov dword [edi + 0x48], ebx
cmp byte [ebp - 1], 0
je 0x7211ff
mov eax, dword [0x8b405c]
cmp eax, ebx
mov dword [0x8b4480], 0x725270
mov dword [0x8b4478], eax
mov dword [0x8b447c], ebx
mov ecx, 0x8b4478
je 0x7211f9
mov dword [eax + 4], ecx
mov dword [0x8b405c], ecx
call fcn.00721cf7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7261a4
Capabilities:
Create thread

Disassembly:
push 0x8b47bc
xor eax, eax
push eax
push eax
push 0x726117
push eax
push eax
mov byte [0x8b4720], 1
mov byte [0x8b4721], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
mov dword [0x8b47b8], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
ret
Function at 0x7417a0
Capabilities:
Parse credit card information

Disassembly:
mov eax, 0x1204
call fcn.0075c1f0
mov eax, dword [0x81a1d0]
push ebp
push edi
mov edi, dword [esp + 0x121c]
test edi, edi
mov dword [esp + 0x1208], eax
mov ebp, edi
jne 0x7417f4
mov eax, dword [esp + 0x1218]
mov ecx, dword [esp + 0x1210]
push eax
push ecx
call fcn.00741320
add esp, 8
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1200]
call fcn.00760e8e
add esp, 0x1204
ret
mov edx, dword [esp + 0x1218]
test edx, edx
push esi
lea eax, [esp + 0xc]
jne 0x741810
mov edx, dword [esp + 0x1214]
mov byte [edx], 0
jmp 0x74182f
mov cl, byte [edx]
test cl, cl
je 0x74182b
lea esi, [esp + 0xc]
sub edx, esi
lea esp, [esp]
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x741820
mov byte [eax], 0x3d
inc eax
push ebx
mov bl, byte [edi]
lea esi, [esp + 0x1210]
sub esi, eax
test bl, bl
mov ecx, eax
je 0x741850
mov dl, bl
cmp dl, 0x20
je 0x741855
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x741843
cmp byte [edi], 0x20
jne 0x74185c
mov byte [eax], 0x22
lea ecx, [eax + 1]
dec esi
test bl, bl
pop ebx
je 0x7418b3
test esi, esi
jle 0x7418b7
mov al, byte [ebp]
cmp al, 0x20
jb 0x74188a
cmp al, 0x7f
je 0x74188a
cmp al, 0x3d
je 0x74188a
cmp al, 0x22
je 0x74188a
cmp al, 0x3a
je 0x74188a
cmp al, 0x25
je 0x74188a
cmp al, 0x5e
je 0x74188a
mov byte [ecx], al
inc ecx
dec esi
jmp 0x7418ab
cmp esi, 3
jl 0x7418a8
mov byte [ecx], 0x25
movzx eax, al
mov dl, byte [eax + str.0000000000000000111111111111111122222222222222223333333333333333444444444444444455555555555555556666666666666666777777777777777788888888888888889999999999999999aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbccccccccccccccccddddddddddddddddeeeeeeeeeeeeeeeeffffffffffffffff0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef]
mov al, byte [eax + 0x7d2198]
inc ecx
mov byte [ecx], dl
inc ecx
mov byte [ecx], al
inc ecx
sub esi, 3
mov al, byte [ebp + 1]
inc ebp
test al, al
jne 0x741861
test esi, esi
jg 0x7418d2
pop esi
pop edi
mov eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x1200]
call fcn.00760e8e
add esp, 0x1204
ret
cmp byte [edi], 0x20
jne 0x7418db
mov byte [ecx], 0x22
inc ecx
mov edx, dword [esp + 0x1218]
mov eax, dword [esp + 0x1214]
mov byte [ecx], 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
call fcn.00740fc0
mov ecx, dword [esp + 0x1218]
add esp, 0xc
pop esi
pop edi
pop ebp
call fcn.00760e8e
add esp, 0x1204
ret
Function at 0x749840
Capabilities:
Get geographical location

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
lea eax, [edi + 0x2f8]
push eax
push str.FIRSTNAME
add esi, 0x110
push 0x400
push esi
call fcn.007417a0
lea ecx, [edi + 0x32b]
push ecx
push str.LASTNAME
push 0x400
push esi
call fcn.007417a0
lea edx, [edi + 0x35e]
push edx
push str.NAMEONCARD
push 0x400
push esi
call fcn.007417a0
lea eax, [edi + 0x3c4]
push eax
push str.ADDRESS1
push 0x400
push esi
call fcn.007417a0
add esp, 0x40
lea ecx, [edi + 0x3f7]
push ecx
push str.ADDRESS2
push 0x400
push esi
call fcn.007417a0
lea edx, [edi + 0x42a]
push edx
push str.CITY
push 0x400
push esi
call fcn.007417a0
lea eax, [edi + 0x45d]
push eax
push str.STATE
push 0x400
push esi
call fcn.007417a0
lea ecx, [edi + 0x47c]
push ecx
push str.POSTCODE
push 0x400
push esi
call fcn.007417a0
add esp, 0x40
lea edx, [edi + 0x487]
push edx
push str.COUNTRY
push 0x400
push esi
call fcn.007417a0
lea eax, [edi + 0x4ba]
push eax
push str.EMAIL
push 0x400
push esi
call fcn.007417a0
lea ecx, [edi + 0x4ed]
push ecx
push str.CARDTYPE
push 0x400
push esi
call fcn.007417a0
lea edx, [edi + 0x501]
push edx
push str.CARDNUMBER
push 0x400
push esi
call fcn.007417a0
mov eax, dword [edi + 0x518]
add esp, 0x40
push eax
push str.EXPIRYMONTH
push 0x400
push esi
call fcn.007413e0
mov ecx, dword [edi + 0x51c]
push ecx
push str.EXPIRYYEAR
push 0x400
push esi
call fcn.007413e0
add esp, 0x20
pop edi
pop esi
ret

Function at 0x749e60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
call fcn.0074b470
push 0
mov edi, eax
call fcn.0074b520
mov eax, dword [esp + 0x10]
mov esi, dword [eax]
add esp, 4
test esi, esi
je 0x749ec2
push ebp
mov edi, edi
mov edx, dword [esi + 0x44]
test edx, edx
je 0x749ebb
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x749ebb
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x749ebb
mov ebp, edi
sub ebp, eax
cmp ebp, edx
jbe 0x749ebb
mov edx, dword [esi + 0x48]
push edx
push 0
push esi
mov dword [esi + 0x40], 0xffffffff
call ecx
add esp, 0xc
call fcn.0074b470
mov edi, eax
mov dword [esi + 0x40], edi
mov esi, dword [esi]
test esi, esi
jne 0x749e80
pop ebp
mov eax, dword [0x8b7ca0]
test eax, eax
pop edi
pop esi
je 0x749eeb
lea ecx, [ecx]
mov ecx, dword [eax + 4]
push eax
mov dword [0x8b7ca0], ecx
call fcn.00582f90
mov eax, dword [0x8b7ca0]
add esp, 4
test eax, eax
jne 0x749ed0
mov dword [esp + 4], 0
jmp fcn.0074b5b0

Function at 0x749f00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x81a1d0]
mov dword [esp + 0x198], eax
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.0074b7d0
push 0x8b7c9c
push fcn.00749e60
call fcn.0074b5e0
xor eax, eax
mov ecx, 0x64
lea edi, [esp + 0x14]
add esp, 0xc
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 2
mov dword [0x8b7ca4], 0
call sub.WS2_32.dll_WSAStartup
mov ax, word [esp + 8]
mov ecx, dword [esp + 0x19c]
movzx edx, ah
mov dh, al
mov dword [0x8b7c98], edx
call fcn.00760e8e
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x749f80
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push eax
push ebp
push ecx
mov dword [esp + 0x14], 1
call sub.WS2_32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x749fac
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
push edi
push 0x50
call fcn.00582f80
add esp, 4
mov esi, eax
lea edx, [esp + 0x10]
push edx
xor eax, eax
push 0x8004667e
mov ecx, 0x14
mov edi, esi
rep stosd dword es:[edi], eax
push ebx
mov dword [esi + 0x18], ebx
call sub.WS2_32.dll_ioctlsocket
cmp ebp, 2
jne 0x749ff1
push 4
lea eax, [esp + 0x14]
push eax
push 0x20
push 0xffff
push ebx
call sub.WS2_32.dll_setsockopt
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], edx
call fcn.0074b520
mov eax, dword [0x8b7c9c]
mov dword [esi], eax
push 0
mov dword [0x8b7c9c], esi
call fcn.0074b5b0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x74a150
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x81a1d0]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
lea esi, [esp + 0xc]
mov byte [edi + 0x14], 0
call fcn.00749d90
mov ecx, dword [edi + 0x18]
push eax
push ecx
call sub.WS2_32.dll_connect
test eax, eax
pop edi
pop esi
jge 0x74a1f2
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x74a1f0
cmp eax, 0x2746
je 0x74a1f0
cmp eax, 0x2743
je 0x74a1de
cmp eax, 0x2751
je 0x74a1de
cmp eax, 0x2749
jne 0x74a1c2
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
xor edx, edx
cmp eax, 0x274d
sete dl
add edx, 0xfffffff9
mov eax, edx
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
mov eax, 0xfffffffb
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
xor eax, eax
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
Function at 0x74a260
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x18]
push esi
xor esi, esi
cmp eax, 0xffffffff
mov dword [esp + 8], 1
jne 0x74a27f
pop esi
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov edx, dword [esp + 0x18]
push edi
je 0x74a298
cmp dword [edx], 0x10
jae 0x74a298
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
cmp dword [ebx + 8], 2
jne 0x74a30b
push ebp
push edx
push ecx
push eax
call sub.WS2_32.dll_accept
mov ebp, eax
cmp ebp, 0xffffffff
je 0x74a30a
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push ebp
call sub.WS2_32.dll_ioctlsocket
push 0x50
call fcn.00582f80
mov esi, eax
xor eax, eax
mov ecx, 0x14
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi + 0x18], ebp
mov ecx, dword [ebx + 8]
mov dword [esi + 8], ecx
mov edx, dword [ebx + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0x10]
push 0
mov dword [esi + 0x10], eax
mov byte [esi + 0x14], 1
call fcn.0074b520
mov ecx, dword [0x8b7c9c]
mov dword [esi], ecx
push 0
mov dword [0x8b7c9c], esi
call fcn.0074b5b0
add esp, 0xc
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret

Function at 0x74a320
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [0x81a1d0]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x18], eax
cmp dword [ebp + 0xc], 3
push edi
mov edi, dword [esp + 0x28]
jne 0x74a373
movzx eax, byte [edi + 8]
mov edx, dword [ebp + 0x18]
push 4
lea ecx, [esp + 0x28]
push ecx
push 4
push 0
push edx
mov dword [esp + 0x38], eax
call sub.WS2_32.dll_setsockopt
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov al, byte [edi]
and eax, 0xf
shl eax, 2
sub ebx, eax
add edi, eax
test ebx, ebx
jge 0x74a377
xor ebx, ebx
jmp 0x74a377
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x74a38d
push eax
mov eax, dword [ebp + 0x18]
push ebx
push edi
push eax
call sub.WS2_32.dll_send
jmp 0x74a3ab
mov ecx, dword [esp + 0x38]
push esi
push ecx
lea esi, [esp + 0x14]
call fcn.00749d90
mov edx, dword [ebp + 0x18]
push eax
push 0
push ebx
push edi
push edx
call sub.WS2_32.dll_sendto
pop esi
test eax, eax
pop edi
pop ebp
pop ebx
jge 0x74a41c
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x74a41a
cmp eax, 0x2746
je 0x74a41a
cmp eax, 0x2743
je 0x74a408
cmp eax, 0x2751
je 0x74a408
cmp eax, 0x2749
jne 0x74a3ec
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
xor ecx, ecx
cmp eax, 0x274d
sete cl
add ecx, 0xfffffff9
mov eax, ecx
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
mov eax, 0xfffffffb
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
xor eax, eax
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
Function at 0x74a430
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
jne 0x74a456
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push eax
mov eax, dword [edx + 0x18]
push ecx
push eax
call sub.WS2_32.dll_recv
mov edi, eax
jmp 0x74a495
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 0
push edx
mov edx, dword [ecx + 0x18]
push eax
push edx
call sub.WS2_32.dll_recvfrom
mov edi, eax
test edi, edi
jle 0x74a497
call fcn.0074b470
mov byte [esi + 0xb], al
shr eax, 8
mov byte [esi + 0xa], al
shr eax, 8
mov byte [esi + 9], al
shr eax, 8
mov byte [esi + 8], al
test edi, edi
jne 0x74a49e
or eax, 0xffffffff
jmp 0x74a4a5
mov eax, edi
call fcn.00749e10
test byte [esp + 0x18], 0x20
pop edi
pop esi
je 0x74a4bd
cmp eax, 0xffffffff
jne 0x74a4b6
xor eax, eax
ret
test eax, eax
jne 0x74a4bd
or eax, 0xffffffff
ret
Function at 0x74a4c0
Capabilities:
Get local ipv4 addresses
Get socket information
Get socket status

Disassembly:
sub esp, 0x224
mov edx, dword [esp + 0x230]
test edx, edx
mov eax, dword [0x81a1d0]
mov dword [esp + 0x220], eax
push esi
je 0x74a4f9
mov ecx, dword [esp + 0x238]
mov esi, ecx
push edi
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov esi, dword [esp + 0x22c]
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
jne 0x74a521
mov eax, 0xfffffff9
pop esi
mov ecx, dword [esp + 0x220]
call fcn.00760e8e
add esp, 0x224
ret
mov ecx, dword [esp + 0x230]
cmp ecx, 0x636f6e6e
je 0x74a565
cmp ecx, 0x62696e64
jne 0x74a55d
lea ecx, [esp + 0x238]
push ecx
push edx
push eax
call sub.WS2_32.dll_getsockname
xor eax, eax
pop esi
mov ecx, dword [esp + 0x220]
call fcn.00760e8e
add esp, 0x224
ret
cmp ecx, 0x70656572
jne 0x74a58a
lea ecx, [esp + 0x238]
push ecx
push edx
push eax
call sub.WS2_32.dll_getpeername
xor eax, eax
pop esi
mov ecx, dword [esp + 0x220]
call fcn.00760e8e
add esp, 0x224
ret
cmp ecx, 0x73746174
jne 0x74a6a1
mov cl, byte [esi + 0x14]
test cl, cl
jne 0x74a605
lea edx, [esp + 4]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x118], eax
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 1
mov dword [esp + 0x20], 1
mov dword [esp + 0x124], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
call sub.WS2_32.dll_select
test eax, eax
je 0x74a605
mov eax, dword [esp + 0x110]
test eax, eax
jbe 0x74a5f9
mov byte [esi + 0x14], 0xff
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x74a605
mov byte [esi + 0x14], 1
mov al, byte [esi + 0x14]
test al, al
jle 0x74a683
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0x238]
push edx
lea eax, [esp + 0x218]
push eax
push ecx
mov dword [esp + 0x244], 0x10
call sub.WS2_32.dll_getpeername
test eax, eax
jge 0x74a67a
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x74a683
cmp eax, 0x2746
je 0x74a683
cmp eax, 0x2743
je 0x74a683
cmp eax, 0x2751
je 0x74a683
cmp eax, 0x2749
je 0x74a67f
mov cl, byte [esi + 0x14]
xor eax, eax
test cl, cl
setg al
pop esi
mov ecx, dword [esp + 0x220]
call fcn.00760e8e
add esp, 0x224
ret
cmp eax, 0xfffffffe
jne 0x74a683
mov byte [esi + 0x14], 0xff
mov cl, byte [esi + 0x14]
xor eax, eax
test cl, cl
setg al
pop esi
mov ecx, dword [esp + 0x220]
call fcn.00760e8e
add esp, 0x224
ret
mov ecx, dword [esp + 0x224]
or eax, 0xffffffff
pop esi
call fcn.00760e8e
add esp, 0x224
ret
Function at 0x74a880
Capabilities:
Connect socket
Connect udp socket
Create raw socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov eax, dword [0x81a1d0]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
cmp ecx, dword [esp + 0x24]
je 0x74a8a6
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
push ebx
mov ebx, dword [esp + 0x24]
cmp word [ebx], 2
push edi
jne 0x74a9b8
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov eax, ecx
shr ecx, 2
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 2
push 2
mov byte [ebp + 7], 0
mov byte [ebp + 6], 0
mov byte [ebp + 5], 0
mov byte [ebp + 4], 0
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x74a9a5
cmp dword [0x8b7c98], 0x200
jl 0x74a958
mov eax, dword [esp + 0x34]
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
push 0x10
lea edx, [esp + 0x20]
push edx
push eax
push ebx
push 0xc8000014
push esi
call sub.WS2_32.dll_WSAIoctl
test eax, eax
jge 0x74a92a
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dh, cl
mov dword [ebp + 4], ecx
movzx eax, byte [ebp + 6]
movzx ecx, byte [ebp + 7]
mov dl, byte [ebp + 5]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
cmp edx, 0x7f000001
jne 0x74a958
mov edx, dword [ebx + 4]
mov dword [ebp + 4], edx
movzx ecx, byte [ebp + 6]
movzx edx, byte [ebp + 7]
xor eax, eax
mov ah, byte [ebp + 4]
mov al, byte [ebp + 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
jne 0x74a99f
mov eax, dword [esp + 0x34]
push eax
push ebx
push esi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x74a99f
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x74a99f
mov eax, dword [esp + 0x14]
mov dword [ebp + 4], eax
push esi
call sub.WS2_32.dll_closesocket
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
call fcn.00760e8e
add esp, 0x14
ret
mov edi, dword [esp + 0x20]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x18]
pop edi
mov eax, 0xfffffffd
pop ebx
call fcn.00760e8e
add esp, 0x14
ret

Function at 0x74b7d0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push 0x8b7cc4
mov dword [0x8b7e04], esi
mov dword [0x819bd0], 0xffffffff
mov dword [0x8b7cb8], esi
mov dword [0x8b7cbc], esi
mov dword [0x8b7cc0], esi
call edi
push 0x8b7dec
mov dword [0x8b7de0], esi
mov dword [0x8b7de4], esi
mov dword [0x8b7de8], esi
call edi
lea eax, [esp + 8]
push eax
push esi
push esi
push 0x74b790
push esi
push esi
mov dword [0x8b7e08], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
cmp eax, esi
mov dword [0x8b7e08], eax
pop esi
je 0x74b85f
mov ecx, dword [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [0x8b7e08]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x750bb0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0x198
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
test esi, esi
je 0x750cee
push edi
mov ecx, 0x66
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi], fcn.00750bb0
mov dword [esi + 4], 0x7506f0
mov dword [esi + 8], fcn.00750760
mov dword [esi + 0xc], fcn.00744740
mov dword [esi + 0x10], 0x750970
mov dword [esi + 0x14], 0x750a30
mov dword [esi + 0x18], 0x750a40
mov dword [esi + 0x1c], 0x750ad0
mov dword [esi + 0x20], fcn.00744740
mov dword [esi + 0x24], 0x750b20
mov dword [esi + 0x28], fcn.00757b80
mov dword [esi + 0x2c], 0x750b80
mov dword [esi + 0x30], 0x750b90
mov dword [esi + 0x34], 0x750ba0
mov ecx, dword [str.TAPI]
lea eax, [esi + 0x48]
mov dword [eax], ecx
mov dl, byte [0x7d2fd4]
mov byte [eax + 4], dl
lea eax, [esi + 0x194]
push eax
push 0
push esi
push 0x750640
push 0
push 0
mov dword [esi + 0x8c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x750c9e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0
call edi
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x750c90
cmp dword [esi + 0x8c], 1
pop edi
jne 0x750cb9
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.00757da0
mov dword [esi + 0x74], eax
add esp, 0xc
or eax, 0xffffffff
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 2
mov eax, esi
pop esi
pop ebx
ret