joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fc40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
push 2
push dword [ebp + 0x10]
mov ebx, dword [0x56f014]
push ebx
call sub.KERNEL32.dll_FindResourceA
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x46fd9e
push eax
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x46fd9e
push dword [0x56f018]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
je 0x46fd9e
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x46fca7
mov esi, eax
jmp 0x46fcce
mov ax, word [ebx + 0xe]
dec eax
sub ax, 2
jb 0x46fcbf
dec ax
je 0x46fcbf
sub ax, 4
je 0x46fcbf
jmp 0x46fccc
mov cx, word [ebx + 0xe]
mov esi, 1
shl esi, cl
jmp 0x46fcce
xor esi, esi
test esi, esi
jle 0x46fd71
cmp esi, 0x100
jg 0x46fd71
lea eax, [esi - 1]
shl eax, 2
add eax, 8
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46fd71
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x46fd69
mov ecx, dword [ebp - 8]
mov word [ecx + 2], si
mov eax, dword [ebp - 8]
mov word [eax], 0x300
lea edx, [ebx + 0x28]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
add eax, 4
add edx, 2
mov dword [ebp - 0x10], edx
cmp esi, dword [ebp - 0xc]
jle 0x46fd5c
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [eax], dl
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx - 1]
mov byte [eax + 1], dl
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx - 2]
mov byte [eax + 2], dl
mov byte [eax + 3], 0
inc dword [ebp - 0xc]
add eax, 4
add dword [ebp - 0x10], 4
cmp esi, dword [ebp - 0xc]
jg 0x46fd30
push dword [ebp - 8]
call sub.GDI32.dll_CreatePalette
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalFree
movzx eax, word [ebx]
add eax, ebx
shl esi, 2
movzx edx, si
add eax, edx
mov esi, eax
push 0
push ebx
push esi
push 4
push ebx
push edi
call sub.GDI32.dll_CreateDIBitmap
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push edi
push dword [0x56f018]
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x471ce8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.dll_GetKeyboardState
mov bl, byte [ebp + esi - 0x100]
mov al, byte [ebp + 0xc]
mov byte [ebp + esi - 0x100], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.dll_SetKeyboardState
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x471d29
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
lea eax, [ebp - 0x100]
push eax
call sub.USER32.dll_GetKeyboardState
test eax, eax
jne 0x471d46
xor eax, eax
jmp 0x471d75
push 0
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x100]
push ecx
push 0
push dword [ebp + 8]
call sub.USER32.dll_ToAscii
cmp eax, 1
je 0x471d6a
cmp eax, 2
jne 0x471d73
movzx eax, word [ebp - 0x114]
jmp 0x471d75
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4723c0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4725ac
cmp dword [ebx + 0x810], 0
je 0x4725ac
cmp dword [ebx + 0x6f8], 0
je 0x4725ac
cmp dword [ebx + 0x8f4], 0
je 0x4725ac
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [ebx + 0x8f4]
call sub.GDI32.dll_GetObjectA
push 0
lea edx, [ebp - 0x3c]
push edx
push dword [ebx]
call fcn.00521fcc
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x34]
jne 0x47242d
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x30]
je 0x4725ac
inc dword [ebx + 0x904]
inc dword [ebx + 0x908]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebx + 0x904]
jge 0x47244a
mov dword [ebx + 0x904], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebx + 0x908]
jge 0x47245b
mov dword [ebx + 0x908], eax
mov eax, dword [ebx + 0x904]
cmp eax, dword [ebp - 0x34]
jle 0x472469
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x908]
cmp eax, dword [ebp - 0x30]
jle 0x472477
mov dword [ebp - 0x30], eax
push dword [ebx + 0x810]
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x4725ac
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov edi, eax
test edi, edi
jne 0x4724a9
push esi
push dword [ebx + 0x810]
call sub.USER32.dll_ReleaseDC
jmp 0x4725ac
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4724c0
push edi
call sub.GDI32.dll_DeleteDC
jmp 0x472498
mov eax, dword [ebx + 0x8f4]
mov dword [ebp - 4], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebx + 0x8f4], eax
cmp dword [ebx + 0x8f4], 0
jne 0x4724f7
mov edx, dword [ebp - 4]
mov dword [ebx + 0x8f4], edx
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
jmp 0x4724b8
push dword [ebx + 0x8f4]
push edi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
mov ecx, dword [0x5618dc]
push dword [ecx*4 + 0x57f828]
call sub.GDI32.dll_CreateSolidBrush
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x3c]
push eax
push edi
call sub.USER32.dll_FillRect
push dword [ebp - 0x14]
call sub.GDI32.dll_DeleteObject
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0xcc0020
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push edi
call sub.GDI32.dll_BitBlt
push 0xcc0020
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push esi
call sub.GDI32.dll_BitBlt
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push dword [ebp - 8]
push edi
call sub.GDI32.dll_SelectObject
push edi
call sub.GDI32.dll_DeleteDC
push esi
push dword [ebx + 0x810]
call sub.USER32.dll_ReleaseDC
push dword [ebp - 4]
call sub.GDI32.dll_DeleteObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x482391
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc18
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x4823ac
cmp byte [ebx], 0
jne 0x4823b6
mov eax, 1
jmp 0x48243d
push 0x3e7
lea edx, [ebp - 0x3e8]
push edx
call fcn.0042e6b1
push esi
lea esi, [ebp - 0x3e8]
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp dword [0x55f2b8], 0
je 0x48240c
cmp dword [esi + 0x540], 0
je 0x48240c
lea eax, [ebp - 0x3e8]
push eax
call fcn.00415108
lea edx, [ebp - 0x3e8]
push edx
call fcn.0054e28c
pop ecx
mov ebx, eax
push 0
push ebx
lea eax, [ebp - 0x3e8]
push eax
push dword [esi + 0x884]
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x482438
xor eax, eax
jmp 0x48243d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x486e4c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [0x565cf8]
je 0x486e79
push 0
push 0x9c7
call fcn.0042c771
push eax
call fcn.004869d0
jmp 0x486f68
mov edx, dword [ebp + 0xc]
shr edx, 0x10
test dx, 0xffff
je 0x486e9d
push 0
push 0x9c7
call fcn.0042c771
push eax
call fcn.004869d0
jmp 0x486f68
xor ecx, ecx
mov dword [0x565cf8], ecx
push 0
push 2
push 0
mov ax, word [0x563c12]
push eax
mov dx, word [0x563c10]
push edx
call fcn.004f316d
mov ebx, eax
mov dword [0x565cf4], ebx
cmp ebx, 0xffffffff
jne 0x486ee3
push 0
push 0x9c8
call fcn.0042c771
push eax
call fcn.004869d0
jmp 0x486f68
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0054e10c
add esp, 0xc
mov word [ebp - 0x10], 2
push 0x4f
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
cmp esi, 0xffffffff
je 0x486f0e
mov dword [ebp - 0xc], esi
jmp 0x486f1d
mov eax, 0x5809a0
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
push 0x10
push 0x8023
push dword [0x56f018]
push dword [0x565cf4]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [0x565cf4]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x486f68
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x486f68
push 0
push 0x9c9
call fcn.0042c771
push eax
call fcn.004869d0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x486f70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x486f9d
push 0
push 0x9c9
call fcn.0042c771
push eax
call fcn.004869d0
jmp 0x4870e3
cmp byte [0x5808d8], 0
je 0x486fff
push 0x58093c
push 0x5808d8
push 0
push 0x9ca
call fcn.0042c771
push eax
lea edx, [ebp - 0x104]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [0x5618ec]
lea ecx, [ebp - 0x104]
push ecx
push dword [0x56f030]
call fcn.004ef55b
push 0x5808d8
push 0x565d39
lea eax, [ebp - 0x104]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x487051
push 0x58093c
push 0
push 0x9cb
call fcn.0042c771
push eax
lea edx, [ebp - 0x104]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x5618ec]
lea ecx, [ebp - 0x104]
push ecx
push dword [0x56f030]
call fcn.004ef55b
push 0x58093c
push str.__s_n
lea eax, [ebp - 0x104]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x5618e8]
push dword [0x56f030]
call fcn.004ef455
push 0x64
push 0x5808d8
call fcn.0042e6b1
push 0x64
push 0x58093c
call fcn.0042e6b1
push 0x3e7
push 0x580da0
call fcn.0042e6b1
xor edx, edx
mov dword [0x581188], edx
push 0x21
push 0x8024
push dword [0x56f018]
push dword [0x565cf4]
call sub.WSOCK32.dll_WSAAsyncSelect
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054e28c
pop ecx
mov ebx, eax
push 0
push ebx
lea eax, [ebp - 0x104]
push eax
push dword [0x565cf4]
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x4870e3
push 0
push 0x9cc
call fcn.0042c771
push eax
call fcn.004869d0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4870ea
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, 0x581188
cmp dword [0x565cf0], 0
jne 0x487111
push 0x565d44
call fcn.004869d0
jmp 0x4872bb
push 1
push 1
push dword [0x565cf4]
push 0x8024
call fcn.00528a48
test eax, eax
jne 0x4872bb
inc dword [0x565cfc]
cmp dword [0x565cfc], 0x14
jl 0x48715f
xor eax, eax
mov dword [0x565cfc], eax
push 0
push 1
push dword [0x565cf4]
push 0x8024
call fcn.00528a48
test eax, eax
jne 0x4872bb
push 0
push 0x103
lea edx, [esp + 8]
push edx
push dword [0x565cf4]
call sub.WSOCK32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
jne 0x4871a4
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4872bb
push 0
push 0x9cd
call fcn.0042c771
push eax
call fcn.004869d0
jmp 0x48728c
test edi, edi
jle 0x487282
mov byte [esp + edi], 0
xor ebp, ebp
mov ebx, esp
cmp edi, ebp
jle 0x48712d
mov edx, dword [esi]
cmp edx, 0x3b5
jge 0x487240
mov al, byte [ebx]
cmp al, 0xd
je 0x487273
cmp al, 0xa
jne 0x487208
test edx, edx
jne 0x4871e3
mov ecx, dword [esi]
mov byte [ecx + 0x580da0], 0x20
inc dword [esi]
mov eax, dword [esi]
mov byte [eax + 0x580da0], 0
xor edx, edx
mov dword [esi], edx
push dword [0x5618f0]
push 0x580da0
push dword [0x56f030]
call fcn.004ef55b
jmp 0x487273
cmp byte [ebx], 9
jne 0x487232
xor eax, eax
jmp 0x487214
add eax, 8
cmp eax, dword [esi]
jle 0x487211
sub eax, dword [esi]
xor edx, edx
cmp eax, edx
jle 0x487273
mov ecx, dword [esi]
mov byte [ecx + 0x580da0], 0x20
inc dword [esi]
inc edx
cmp eax, edx
jg 0x487220
jmp 0x487273
mov eax, dword [esi]
mov dl, byte [ebx]
mov byte [eax + 0x580da0], dl
inc dword [esi]
jmp 0x487273
cmp dword [esi], 0
jne 0x487250
mov ecx, dword [esi]
mov byte [ecx + 0x580da0], 0x20
inc dword [esi]
mov eax, dword [esi]
mov byte [eax + 0x580da0], 0
xor edx, edx
mov dword [esi], edx
push dword [0x5618f0]
push 0x580da0
push dword [0x56f030]
call fcn.004ef55b
inc ebp
inc ebx
cmp edi, ebp
jg 0x4871bc
jmp 0x48712d
push 0x565d48
call fcn.004869d0
push dword [0x5618e8]
push dword [0x56f030]
call fcn.004ef455
push dword [0x5618ec]
push 0
push 0x9ce
call fcn.0042c771
push eax
push dword [0x56f030]
call fcn.004ef55b
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x487700
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
or eax, 0xffffffff
mov dword [0x565d60], eax
mov dword [0x565d5c], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x565d5c], eax
cmp eax, 0xffffffff
jne 0x48772a
push 0
call fcn.00487664
ret
push 0x4f
push dword [0x565d5c]
call fcn.004f30ad
test eax, eax
jne 0x487743
push 0
call fcn.00487664
ret
push 5
push dword [0x565d5c]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x48775c
push 0
call fcn.00487664
ret
push 8
push 0x802e
push dword [0x56f018]
push dword [0x565d5c]
call sub.WSOCK32.dll_WSAAsyncSelect
ret
Function at 0x487c42
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, 0x5812f4
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x487e0e
cmp ax, 0x20
je 0x487e0e
mov eax, dword [0x565d60]
cmp eax, 0xffffffff
je 0x487e0e
cmp dword [0x565d5c], 0xffffffff
je 0x487e0e
push 1
push 2
push eax
push 0x8030
call fcn.00528a48
test eax, eax
jne 0x487e15
inc dword [0x565d64]
cmp dword [0x565d64], 0x14
jl 0x487ccf
xor ecx, ecx
mov dword [0x565d64], ecx
push 0
push 2
push dword [0x565d60]
push 0x8030
call fcn.00528a48
test eax, eax
jne 0x487e15
cmp byte [ebx], 0
jne 0x487da8
push dword [0x565d58]
push 0x3e7
push ebx
call fcn.0055181c
add esp, 0xc
test eax, eax
je 0x487e0e
push ebx
call fcn.004acab3
test eax, eax
jne 0x487e0e
push ebx
call fcn.0048781a
test eax, eax
je 0x487dfe
push 0xa
push ebx
call fcn.0054e1ec
add esp, 8
test eax, eax
jne 0x487d2d
push 0x565da9
push ebx
call fcn.0054e1b0
add esp, 8
push 0x565dac
push ebx
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x487da8
push dword [0x565d58]
call fcn.00551f58
pop ecx
mov edi, eax
mov esi, 1
jmp 0x487d74
push ebx
call fcn.004acab3
test eax, eax
jne 0x487d8c
push 0x565daf
push ebx
call fcn.0054e450
add esp, 8
test eax, eax
je 0x487d74
xor esi, esi
jmp 0x487d8c
push dword [0x565d58]
push 0x3e7
push ebx
call fcn.0055181c
add esp, 0xc
test eax, eax
jne 0x487d54
push 0
push edi
push dword [0x565d58]
call fcn.00551ee4
add esp, 0xc
test esi, esi
jne 0x487dfe
mov byte [ebx], 0xa
mov byte [ebx + 1], 0
push ebx
call fcn.0054e28c
pop ecx
mov edi, eax
push 0
push ebx
call fcn.0054e28c
pop ecx
push eax
push ebx
push dword [0x565d60]
call sub.WSOCK32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x487ddc
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x487e15
jmp 0x487e0e
cmp edi, esi
jle 0x487dfe
mov eax, ebx
add eax, esi
push eax
call fcn.0054e28c
pop ecx
inc eax
push eax
add esi, ebx
push esi
push ebx
call fcn.0054e0c0
add esp, 0xc
jmp 0x487c9c
push 0x3e7
push ebx
call fcn.0042e6b1
jmp 0x487c9c
push 2
call fcn.00487664
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x48898b
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x4889c0
mov ebx, dword [0x565db4]
jmp 0x4889ab
mov ebx, dword [ebx + 0x80]
test ebx, ebx
je 0x4889b5
cmp dword [ebx + 0x6c], 0
jne 0x4889a5
test ebx, ebx
jne 0x4889c0
xor eax, eax
jmp 0x488aa2
cmp byte [esi], 0
je 0x4889d0
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x4889e2
push 1
push dword [ebx + 0x70]
push ebx
call fcn.004884c4
xor eax, eax
jmp 0x488aa2
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x74], 0xb4
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0054e10c
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [0x565db8]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0
push 2
push 0
mov ax, word [0x563c12]
push eax
mov dx, word [0x563c10]
push edx
call fcn.004f316d
mov esi, eax
mov dword [ebx + 0x7c], esi
cmp esi, 0xffffffff
jne 0x488a53
push 2
push dword [ebx + 0x70]
push ebx
call fcn.004884c4
xor eax, eax
jmp 0x488aa2
push dword [ebx + 0x7c]
call fcn.005279f5
push 0x10
push 0x8031
push dword [0x56f018]
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x488a9d
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x488a9d
push 3
push dword [ebx + 0x70]
push ebx
call fcn.004884c4
xor eax, eax
jmp 0x488aa2
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48bb27
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc18
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x56635c
push ebx
call fcn.0048b997
test eax, eax
jne 0x48bb4c
xor eax, eax
jmp 0x48bd9e
push dword [ebx + 0x3b0]
call fcn.0041261f
test eax, eax
jne 0x48bb62
xor eax, eax
jmp 0x48bd9e
mov dword [0x564178], ebx
push 0
push 0x46c3f8
push 0xfa
push dword [0x56f018]
call fcn.0046a7c4
mov esi, eax
xor eax, eax
mov dword [0x564178], eax
push ebx
call fcn.0048b997
test eax, eax
jne 0x48bb99
xor eax, eax
jmp 0x48bd9e
push dword [ebx + 0x3b0]
call fcn.0041261f
test eax, eax
jne 0x48bbb7
push 0
push ebx
call fcn.0048b8ab
xor eax, eax
jmp 0x48bd9e
test esi, esi
jg 0x48bc05
cmp dword [ebx + 0x374], 0
je 0x48bbf6
push edi
lea edx, [ebp - 0x3e8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 8
push 0
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.0054e28c
pop ecx
push eax
lea eax, [ebp - 0x3e8]
push eax
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_send
push 0
push ebx
call fcn.0048b8ab
xor eax, eax
jmp 0x48bd9e
cmp esi, 2
jne 0x48bd9c
cmp dword [ebx + 0x374], 0
je 0x48bcb2
lea edx, [edi + 0xf]
push edx
lea ecx, [ebp - 0x3e8]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 8
push 0
lea eax, [ebp - 0x3e8]
push eax
call fcn.0054e28c
pop ecx
push eax
lea edx, [ebp - 0x3e8]
push edx
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_send
lea ecx, [ebx + 0x68]
push ecx
lea eax, [ebx + 4]
push eax
lea edx, [edi + 0x1e]
push edx
push 0x57fd34
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [ebx + 0x3b0]
push 2
push 0x57fd34
call fcn.004ca888
push 0x57fd34
lea ecx, [edi + 0x28]
push ecx
lea eax, [ebp - 0x3e8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [ebx + 0x3b0]
push eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3e8]
push edx
push dword [eax]
call fcn.004b07e0
jmp 0x48bd12
lea ecx, [ebx + 0x68]
push ecx
lea eax, [ebx + 4]
push eax
lea edx, [edi + 0x3a]
push edx
push 0x57fd34
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [ebx + 0x3b0]
push 2
push 0x57fd34
call fcn.004ca888
push 0x57fd34
lea ecx, [edi + 0x41]
push ecx
lea eax, [ebp - 0x3e8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [ebx + 0x3b0]
push eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3e8]
push edx
push dword [eax]
call fcn.004b07e0
push 0
push ebx
call fcn.0048b8ab
mov ebx, dword [0x566350]
test ebx, ebx
je 0x48bd98
cmp dword [ebx + 0x374], 0
je 0x48bd4a
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x52]
push ecx
lea eax, [ebp - 0x3e8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x48bd65
lea edx, [ebx + 0x68]
push edx
lea ecx, [ebx + 4]
push ecx
lea eax, [edi + 0x5c]
push eax
lea edx, [ebp - 0x3e8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push 0
lea ecx, [ebp - 0x3e8]
push ecx
push 0x57fd34
call fcn.0051f0b8
test eax, eax
je 0x48bd8e
push 0
push ebx
call fcn.0048b8ab
mov ebx, dword [0x566350]
jmp 0x48bd20
mov ebx, dword [ebx + 0x3b4]
test ebx, ebx
jne 0x48bd24
xor eax, eax
jmp 0x48bd9e
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48c873
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0048b997
test eax, eax
jne 0x48c88f
xor eax, eax
jmp 0x48caf9
push dword [ebx + 0x3b0]
call fcn.0041261f
test eax, eax
jne 0x48c8b2
push 0x566459
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48caf9
mov dword [ebx + 0x33c], 2
xor edx, edx
mov dword [ebx + 0x3a4], edx
cmp dword [ebx + 0x340], 0
je 0x48c9c4
cmp word [ebx + 0x34c], 0
jne 0x48c9c4
cmp dword [0x565dc0], 0
je 0x48c929
push 0
push 0xb5c
call fcn.0042c771
push eax
push 1
push 1
push 1
push 1
push ebx
call fcn.005191c5
push dword [ebx + 0x3b0]
push dword [ebx + 0x340]
push 1
push 0
add ebx, 0xcc
push ebx
call fcn.004887dc
mov eax, 1
jmp 0x48caf9
push 1
push 0
lea edx, [ebx + 0x34c]
push edx
mov cx, word [0x563c12]
push ecx
mov ax, word [0x563c10]
push eax
call fcn.004f316d
mov esi, eax
mov dword [ebx + 0x3a8], esi
cmp esi, 0xffffffff
jne 0x48c971
push 0
push 0xb5d
call fcn.0042c771
push eax
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48caf9
push 8
push 0x8011
push dword [0x56f018]
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_WSAAsyncSelect
mov eax, dword [ebx + 0x3b0]
push eax
push dword [ebx + 0x340]
push dword [ebx + 0x35c]
mov dx, word [ebx + 0x34c]
push edx
push dword [eax + 0x514]
lea ecx, [ebx + 0x234]
push ecx
add ebx, 4
push ebx
call fcn.0050483e
mov eax, 1
jmp 0x48caf9
lea edx, [ebx + 0xcc]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x48c9f4
push 0
push 0xb5e
call fcn.0042c771
push eax
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48caf9
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x22], 4
mov word [ebp - 0x24], 2
lea esi, [ebp - 0x2c]
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0054e10c
add esp, 0xc
mov word [ebp - 0x1c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x18]
push eax
call fcn.0054e09c
add esp, 0xc
mov dx, word [ebx + 0x34c]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x1a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
push 0
push 2
push 0
mov cx, word [0x563c12]
push ecx
mov ax, word [0x563c10]
push eax
call fcn.004f316d
mov esi, eax
mov dword [ebx + 0x3a8], esi
cmp esi, 0xffffffff
jne 0x48ca9a
push 0
push 0xb5d
call fcn.0042c771
push eax
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48caf9
push dword [ebx + 0x3a8]
call fcn.005279f5
push 0x10
push 0x800f
push dword [0x56f018]
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x1c]
push edx
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x48caf7
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x48caf7
push 0
push 0xb5f
call fcn.0042c771
push eax
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48caf9
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4