joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46359b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403fe8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x463575
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x54e8ec]
call fcn.00405c00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x462cc8]
call fcn.0040ba98
call fcn.0040361c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00462e48
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4635a2
lea eax, [ebp - 0x10]
call fcn.00403ba8
ret

Function at 0x464450
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
test byte [ebx + 0x20], 0x10
jne 0x4644e3
cmp byte [ebx + 0xbb], 0
jne 0x4644e3
mov byte [ebx + 0xbb], 1
cmp byte [ebx + 0xbd], 0
je 0x4644a1
cmp word [ebx + 0x102], 0
je 0x4644a1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4644a1
lea edx, [ebx + 0xc0]
mov eax, dword [ebx + 0x104]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [0x54e5f4]
mov eax, dword [eax]
call fcn.0043ae60
push 6
mov eax, dword [0x54e5f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x54e5f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebx + 0xb8], 0
jne 0x4644e3
mov dl, 1
mov eax, ebx
call fcn.0046455c
pop ebx
pop ebp
ret
Function at 0x464a38
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x464c08
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbb], 0
je 0x464c08
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8c], 0
jne 0x464c08
xor eax, eax
push ebp
push 0x464c01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x8c], 1
mov byte [ebp - 5], 0
mov byte [ebp - 7], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x122], 0
je 0x464ab5
lea ecx, [ebp - 7]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x124]
call dword [ebx + 0x120]
cmp byte [ebp - 7], 0
jne 0x464ac5
call fcn.004036bc
jmp 0x464c08
mov al, byte [ebp - 7]
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbd], 0
je 0x464b25
mov eax, dword [ebp - 4]
cmp word [eax + 0x10a], 0
je 0x464b25
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
call fcn.00403e24
test eax, eax
jle 0x464b25
mov byte [ebp - 6], 0
lea ecx, [ebp - 6]
mov eax, dword [ebp - 4]
lea edx, [eax + 0xc0]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x10c]
call dword [ebx + 0x108]
cmp byte [ebp - 6], 0
jne 0x464b25
call fcn.004036bc
jmp 0x464c08
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb8], 0
jne 0x464b4a
push 0
push 0
push 0x6d81
mov eax, dword [0x54e5f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
push ebp
push 0x464be2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x54e5f4]
mov eax, dword [eax]
call fcn.0043aea8
push 9
mov eax, dword [0x54e5f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x431550]
call fcn.004030d4
mov dl, 1
call fcn.004351b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x431550]
call fcn.004030d4
call fcn.00447124
mov dl, 1
call fcn.00457000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464be9
mov eax, dword [ebp - 4]
mov byte [eax + 0xbb], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0xfa], 0
je 0x464be1
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
ret
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x465d04
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x465dbb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403fe8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x465d46
call fcn.004036bc
jmp 0x465dc2
mov eax, ebx
call fcn.00402714
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00403fe8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x465d6f
call fcn.004036bc
jmp 0x465dc2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x465dcc
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x465d90
call fcn.004036bc
jmp 0x465dc2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465dc2
mov eax, dword [ebp - 8]
call fcn.0040272c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x466088
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ecx, ecx
push ebp
push 0x4660cd
push dword fs:[ecx]
mov dword fs:[ecx], esp
or edx, 0x4008
push edx
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4660d9
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4660e4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x466134
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x466140
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46628c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
xor eax, eax
push ebp
push 0x466439
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x466448
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x466420
xor eax, eax
push ebp
push 0x466419
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.00466240
mov eax, dword [ebp - 0x168]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.00466240
mov eax, dword [ebp - 0x168]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00422cdc
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00422cdc
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00422cdc
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00422cdc
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x54af38], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466420
cmp dword [ebp - 4], 0
je 0x466418
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466440
lea eax, [ebp - 0x168]
call fcn.00403ba8
ret

Function at 0x466454
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
xor edx, edx
mov dword [ebp - 0x164], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4664ef
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00465cf8
test al, al
je 0x466499
cmp dword [0x550918], 0x40047
jl 0x466499
cmp byte [0x54af38], 0
jne 0x466499
call fcn.0046628c
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x54af3c]
or eax, 0x4000
push eax
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
lea eax, [ebp - 0x164]
call fcn.00466240
mov eax, dword [ebp - 0x164]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4664f6
lea eax, [ebp - 0x164]
call fcn.00403ba8
ret
Function at 0x467724
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x467777
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4000
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0x90
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467783
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46778c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4677dc
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4677e8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f99c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46fa74
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5509e0], 0
jne 0x46fa58
lea eax, [ebp - 4]
mov edx, 0x46fa8c
call fcn.00403c40
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fe8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x46fa58
mov eax, ebx
call fcn.00402714
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46fa51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46fa3b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46fa9c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46fa3b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x5509e0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fa58
mov eax, dword [ebp - 0xc]
call fcn.0040272c
ret
mov ebx, dword [0x5509e0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fa7b
lea eax, [ebp - 4]
call fcn.00403ba8
ret

Function at 0x481cc8
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x550a08], 0
jne 0x481cee
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x481c4c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x550a08], eax
pop ebp
ret
Function at 0x482bb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0044754c
test al, al
je 0x482c0d
cmp bl, 7
jne 0x482be9
push 2
lea eax, [ebp - 2]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [ebp - 2]
sub edi, 0x30
jmp 0x482bee
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
test eax, eax
je 0x482c0d
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
mov edx, edi
call fcn.00423534
mov byte [esi + 0x204], bl
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48ca10
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x48cb30
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi + 0x364], 0
jne 0x48ca45
mov edx, 0x1000
mov eax, edi
call fcn.0048a250
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x33c], esi
inc esi
jne 0x48ca69
lea ecx, [ebp - 0x18]
mov dx, 0x2733
mov eax, edi
call fcn.0048e034
mov dl, 1
mov eax, edi
call fcn.0048a218
mov byte [edi + 0x340], 1
mov byte [edi + 0x369], 1
lea eax, [ebp - 0x12]
mov edx, 0x48cb48
call fcn.0040986c
push eax
call sub.wsock32.dll_inet_addr
mov dword [edi + 0x2b8], eax
mov word [edi + 0x2b4], 2
mov ax, word [edi + 0xf0]
push eax
call sub.wsock32.dll_htons
mov word [edi + 0x2b6], ax
mov byte [edi + 0x120], 0
push 0x10
lea eax, [edi + 0x2b4]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_bind
test bl, bl
je 0x48caf2
push 8
push 0x466
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x48cb0c
push 8
push 0x465
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 1
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_listen
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cb37
lea eax, [ebp - 0x18]
call fcn.00403ba8
ret

Function at 0x48d114
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x33c]
cmp eax, 0xffffffff
jne 0x48d137
or esi, 0xffffffff
jmp 0x48d1f2
or esi, 0xffffffff
cmp byte [ebx + 0x2eb], 0
je 0x48d1e3
cmp byte [ebx + 0x305], 0
jne 0x48d159
cmp byte [ebx + 0x310], 0
jne 0x48d175
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54e640]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
jmp 0x48d1f2
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x48d1da
mov edx, dword [ebp - 4]
push edx
push edi
push eax
mov eax, dword [0x54e640]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x48d1d5
cmp dword [ebp - 8], 0xfa0
jg 0x48d1da
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x48d1da
push esi
push eax
mov eax, dword [0x54e81c]
mov eax, dword [eax]
call eax
add esp, 8
test eax, eax
je 0x48d1da
cmp eax, 5
je 0x48d1da
inc dword [ebp - 8]
mov dx, 2
mov eax, ebx
call fcn.0048e628
cmp esi, 0xffffffff
je 0x48d17a
test esi, esi
jne 0x48d1f2
or esi, 0xffffffff
jmp 0x48d1f2
push 0
mov edx, dword [ebp - 4]
push edx
push edi
push eax
call sub.wsock32.dll_recv
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48d1fc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x33c]
cmp eax, 0xffffffff
jne 0x48d21d
or esi, 0xffffffff
jmp 0x48d287
cmp byte [ebx + 0x2eb], 0
je 0x48d275
xor edi, edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54e380]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jg 0x48d287
cmp edi, 0x14
jg 0x48d287
push esi
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54e81c]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x48d287
je 0x48d287
sub eax, 4
je 0x48d287
dec eax
je 0x48d287
inc edi
jmp 0x48d228
push 0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
call sub.wsock32.dll_send
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48de54
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], cl
mov ebx, eax
xor eax, eax
push ebp
push 0x48e00d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
jne 0x48de98
cmp byte [ebx + 0x368], 0
je 0x48de8b
mov byte [ebx + 0xe5], 1
jmp 0x48de92
mov byte [ebx + 0xe5], 2
mov byte [ebx + 0xe6], dl
test dl, dl
je 0x48deac
cmp byte [ebx + 0x368], 0
je 0x48deac
mov byte [ebx + 0x2f4], 1
mov byte [ebx + 0x369], 0
mov byte [ebx + 0x368], 0
mov byte [ebx + 0x2eb], 0
xor eax, eax
mov dword [ebx + 0x2f0], eax
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x48df77
push eax
mov eax, dword [0x54e1d8]
mov eax, dword [eax]
call eax
pop ecx
test eax, eax
jne 0x48df0c
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54e1d8]
mov eax, dword [eax]
call eax
pop ecx
test eax, eax
jne 0x48df0c
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54e1d8]
mov eax, dword [eax]
call eax
pop ecx
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54e83c]
mov eax, dword [eax]
call eax
pop ecx
xor eax, eax
mov dword [ebx + 0x2ec], eax
mov eax, dword [ebx + 0x2f0]
push eax
mov eax, dword [0x54e14c]
mov eax, dword [eax]
call eax
pop ecx
xor eax, eax
mov dword [ebx + 0x2f0], eax
push 0x3f
push 0x465
mov eax, dword [ebx + 0x344]
push eax
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, ebx
call fcn.0048f5ec
test eax, eax
jle 0x48df77
push ebx
push 0
push 0x468
mov eax, dword [ebx + 0x344]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebx + 0x310], 1
jne 0x48dfa8
mov word [ebp - 6], 0
mov word [ebp - 4], 0x64
push 4
lea eax, [ebp - 6]
push eax
push 0x80
push 0xffff
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_setsockopt
cmp dword [ebx + 0x33c], 0xffffffff
je 0x48dff7
cmp byte [ebx + 0x340], 0
je 0x48dff7
mov eax, ebx
call fcn.0048cd80
mov eax, ebx
call fcn.0048f62c
test al, al
je 0x48dfe9
cmp byte [ebp - 1], 0
jne 0x48dff7
test byte [ebx + 0x20], 8
jne 0x48dff7
cmp word [ebx + 0x56], 0
je 0x48dff7
mov edx, ebx
mov eax, dword [ebx + 0x58]
call dword [ebx + 0x54]
jmp 0x48dff7
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.0048e034
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e014
lea eax, [ebp - 0xc]
call fcn.00403ba8
ret

Function at 0x48e67c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x54e6e4]
mov edx, dword [edx]
call fcn.00403c40
cmp dword [ebx + 0x33c], 0xffffffff
je 0x48e6f0
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_getsockname
push esi
mov bx, word [ebp - 0x12]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
shr bx, 8
movzx eax, bx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x48e700
call fcn.00409f00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f4e4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48f58c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2c8]
mov edx, dword [0x54e6e4]
mov edx, dword [edx]
call fcn.00403f34
jne 0x48f548
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x33c]
push eax
call sub.wsock32.dll_getsockname
push dword [ebp - 0x10]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.004099b8
jmp 0x48f555
mov eax, esi
mov edx, dword [ebx + 0x2c8]
call fcn.00403c40
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esi]
mov ecx, 0x48f5a4
mov edx, 0x48f5b0
call fcn.004532d0
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.00403c40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f593
lea eax, [ebp - 0x18]
call fcn.00403ba8
ret

Function at 0x48f668
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, edx
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.00402bd8
lea eax, [ebp - 0x22]
mov edx, 0x48f6f4
call fcn.0040986c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.wsock32.dll_bind
test eax, eax
sete bl
xor bl, 1
test bl, bl
jne 0x48f6dc
push 1
push esi
call sub.wsock32.dll_listen
test eax, eax
sete bl
xor bl, 1
push esi
call sub.wsock32.dll_closesocket
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48fd28
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402bd8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
pop ebp
ret

Function at 0x4908b4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00402bd8
pop ebp
ret