joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468910
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.ws2_32.dll_WSAStartup
push edx
push edx
or edx, 0xffffffff
test eax, eax
jne 0x468945
mov eax, dword [esp + 0x10]
cmp al, 1
jne 0x468950
shr ax, 8
xor edx, edx
dec al
jne 0x468950
mov eax, edx
add esp, 0x1ac
ret
call sub.ws2_32.dll_WSACleanup
or edx, 0xffffffff
mov eax, edx
add esp, 0x1ac
ret

Function at 0x468a60
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
cmp edi, 2
mov dword [esp + 8], 0
sete al
and eax, 0xff
mov dword [esp], 2
inc eax
mov dword [esp + 4], eax
call sub.ws2_32.dll_socket
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0x40000
je 0x468b1e
cmp edi, 2
je 0x468b54
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov word [esp + 0x28], 2
test esi, esi
je 0x468afc
mov eax, dword [esi + 4]
and eax, 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_htons
push edx
mov word [esp + 0x2a], ax
mov eax, dword [esi]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.ws2_32.dll_bind
sub esp, 0xc
inc eax
je 0x468b3f
test esi, esi
jne 0x468b27
add esp, 0x40
mov eax, ebx
pop ebx
pop esi
pop edi
ret
dec edi
jne 0x468b1e
mov dword [esp + 4], 0x7fffffff
mov dword [esp], ebx
call sub.ws2_32.dll_listen
inc eax
push esi
push esi
jne 0x468b1e
mov dword [esp], ebx
call sub.ws2_32.dll_closesocket
push ebx
or ebx, 0xffffffff
add esp, 0x40
mov eax, ebx
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x38]
mov dword [esp + 4], 0x8004667e
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.ws2_32.dll_ioctlsocket
sub esp, 0xc
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1002
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call sub.ws2_32.dll_setsockopt
sub esp, 0x14
jmp 0x468ab5

Function at 0x468cb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x58
mov ebx, dword [esp + 0x64]
test ebx, ebx
je 0x468d40
mov eax, dword [ebx + 4]
mov word [esp + 0x3c], 2
and eax, 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_htons
push edx
mov edx, 0x10
mov word [esp + 0x3e], ax
mov eax, dword [ebx]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call sub.ws2_32.dll_WSASendTo
sub esp, 0x24
inc eax
je 0x468d46
mov eax, dword [esp + 0x4c]
add esp, 0x58
pop ebx
ret
xor edx, edx
xor eax, eax
jmp 0x468cec
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
sete al
add esp, 0x58
and eax, 0xff
dec eax
pop ebx
ret
Function at 0x468d60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
sub esp, 0x58
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x44], 0x10
mov dword [esp + 0x48], 0
test ebx, ebx
je 0x468e06
lea edx, [esp + 0x44]
lea eax, [esp + 0x34]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edx
mov dword [esp], eax
call sub.ws2_32.dll_WSARecvFrom
sub esp, 0x24
inc eax
je 0x468e10
or eax, 0xffffffff
test byte [esp + 0x49], 0x80
jne 0x468e01
test ebx, ebx
je 0x468dfd
mov eax, dword [esp + 0x38]
mov dword [ebx], eax
mov ax, word [esp + 0x36]
and eax, 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_htons
push ecx
mov word [ebx + 4], ax
mov eax, dword [esp + 0x4c]
add esp, 0x58
pop ebx
ret
xor edx, edx
xor eax, eax
jmp 0x468d88
call sub.ws2_32.dll_WSAGetLastError
lea edx, [eax - 0x2733]
or eax, 0xffffffff
cmp edx, 0x13
ja 0x468e01
mov eax, dword [edx*4 + 0x6ea380]
jmp 0x468e01

Function at 0x468e30
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
mov edx, 0x10624dd3
mov ecx, dword [esp + 0x258]
mov esi, dword [esp + 0x254]
mov eax, ecx
mov ebx, dword [esp + 0x250]
mul edx
shr edx, 6
mov dword [esp + 0x20], 0
mov dword [esp + 0x228], edx
mov dword [esp + 0x124], 0
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
sub ecx, eax
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x22c], eax
mov eax, dword [esi]
test al, 1
je 0x468eae
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], 1
test al, 2
je 0x468ebe
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 1
lea eax, [esp + 0x228]
lea ebp, [esp + 0x124]
mov dword [esp + 0x10], eax
lea edi, [esp + 0x20]
lea eax, [ebx + 1]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.ws2_32.dll_select
sub esp, 0x14
cmp eax, 0
jl 0x468f4b
mov dword [esi], 0
mov eax, 0
jne 0x468f10
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
push ebp
push ebp
jne 0x468f46
mov dword [esp], ebx
mov dword [esp + 4], edi
call sub.ws2_32.dll___WSAFDIsSet
mov edx, eax
xor eax, eax
push ebx
test edx, edx
push ebx
je 0x468f04
or dword [esi], 2
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
or dword [esi], 1
jmp 0x468f22
or eax, 0xffffffff
jmp 0x468f04
Function at 0x4bc290
Capabilities:
Set global application hook

Disassembly:
push edi
xor eax, eax
sub esp, 0xb8
mov ecx, 0x25
lea edx, [esp + 0x1c]
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [0x72d2b4]
mov dword [esp + 0x1c], 0x94
test ecx, ecx
je 0x4bc2c0
add esp, 0xb8
pop edi
ret
mov dword [esp], edx
call sub.kernel32.dll_GetVersionExA
test eax, eax
push edx
je 0x4bc2e0
cmp dword [esp + 0x2c], 2
jne 0x4bc2e0
mov dword [0x72d2b8], 1
nop
mov dword [0x72d2b0], 1
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esp + 8], 0
mov dword [0x72d2bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4bba20
mov dword [esp], 3
call sub.USER32.dll_SetWindowsHookExA
sub esp, 0x10
mov dword [0x72d2c0], eax
mov dword [esp], 1
call sub.WINMM.DLL_timeBeginPeriod
push edi
mov dword [esp], 0x4bbd60
call fcn.00401335
mov dword [0x72d2b4], 1
add esp, 0xb8
pop edi
ret

Function at 0x4bc350
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push ebx
sub esp, 0x44
lea esi, [esp + 0x24]
lea esi, [esi]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.USER32.dll_PeekMessageA
sub esp, 0x14
test eax, eax
je 0x4bc4f0
mov eax, dword [esp + 0x28]
cmp eax, 0x100
jb 0x4bc441
cmp eax, 0x101
jbe 0x4bc3b7
sub eax, 0x104
cmp eax, 1
ja 0x4bc441
mov eax, dword [esp + 0x2c]
cmp eax, 0x10
jb 0x4bc441
cmp eax, 0x12
jbe 0x4bc3d1
sub eax, 0x5b
cmp eax, 1
ja 0x4bc441
mov dword [0x72d2a8], 0
mov dword [esp], 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
push ebx
js 0x4bc4f6
mov dword [esp], 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
push ecx
js 0x4bc510
mov dword [esp], 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
push edx
js 0x4bc502
mov dword [esp], 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
push ebx
js 0x4bc480
mov dword [esp], 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
push ecx
js 0x4bc480
mov eax, dword [esp + 0x24]
mov dword [esp + 4], 0xfffffff0
mov dword [esp], eax
call sub.USER32.dll_GetWindowLongA
and eax, 0x40010000
push edx
cmp eax, 0x40010000
push edx
je 0x4bc490
mov dword [esp], esi
call sub.USER32.dll_TranslateMessage
push ebx
mov dword [esp], esi
call sub.USER32.dll_DispatchMessageA
push eax
jmp 0x4bc360
or dword [0x72d2a8], 8
jmp 0x4bc441
mov eax, dword [esp + 0x24]
mov dword [esp], eax
jmp 0x4bc4a3
mov dword [esp], ebx
call sub.USER32.dll_GetParent
test eax, eax
push ebx
mov ebx, eax
je 0x4bc463
mov dword [esp + 4], 0xfffffff0
mov dword [esp], eax
call sub.USER32.dll_GetWindowLongA
and eax, 0x40010000
push ecx
cmp eax, 0x40010000
push ecx
je 0x4bc4a0
test ebx, ebx
je 0x4bc463
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.USER32.dll_IsDialogMessage
test eax, eax
push edx
push edx
jne 0x4bc360
jmp 0x4bc463
add esp, 0x44
pop ebx
pop esi
ret
or dword [0x72d2a8], 1
jmp 0x4bc3f1
or dword [0x72d2a8], 4
jmp 0x4bc41d
or dword [0x72d2a8], 2
jmp 0x4bc407
Function at 0x4bc520
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x10], 0xff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.USER32.dll_MsgWaitForMultipleObjects
sub esp, 0x14
add esp, 0x2c
jmp fcn.004bc350

Function at 0x4bca90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2c
mov edx, dword [0x72d2b8]
mov eax, dword [esp + 0x30]
test edx, edx
mov dword [esp], eax
jne 0x4bcaf0
call fcn.004c1750
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.SHELL32.dll_ShellExecuteA
sub esp, 0x18
cmp eax, 0x20
setg al
and eax, 0xff
add esp, 0x2c
ret
call fcn.004c1770
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.SHELL32.dll_ShellExecuteW
sub esp, 0x18
cmp eax, 0x20
setg al
and eax, 0xff
add esp, 0x2c
ret

Function at 0x4bcfe0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov edx, dword [0x7385e0]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x4bd010
call fcn.004c1750
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp fcn.004c11b0
call fcn.004c1770
mov dword [esp], eax
call sub.msvcrt.dll__wgetenv
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp fcn.004c1120

Function at 0x4bd1d0
Capabilities:
Create directory

Disassembly:
sub esp, 0x1c
mov ecx, dword [0x7385e0]
mov eax, dword [esp + 0x20]
test ecx, ecx
mov dword [esp], eax
jne 0x4bd1f5
call fcn.004c1750
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x4ce228
call fcn.004c1770
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x4ce230
jmp dword [sym.imp.msvcrt.dll__mkdir]
jmp dword [sym.imp.msvcrt.dll__wmkdir]

Function at 0x4bd210
Capabilities:
Delete directory

Disassembly:
sub esp, 0x1c
mov edx, dword [0x7385e0]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x4bd235
call fcn.004c1750
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x4ce238
call fcn.004c1770
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x4ce240
jmp dword [sym.imp.msvcrt.dll__rmdir]
jmp dword [sym.imp.msvcrt.dll__wrmdir]

Function at 0x4bd250
Capabilities:
Move file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ecx, dword [0x7385e0]
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
test ecx, ecx
mov dword [esp], eax
jne 0x4bd290
call fcn.004c1750
mov dword [esp], ebx
mov esi, eax
call fcn.004c1750
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll_rename
call fcn.004c1770
mov dword [esp], ebx
mov esi, eax
call fcn.004c1770
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp 0x4ce248
jmp dword [sym.imp.msvcrt.dll__wrename]
Function at 0x4bd2c0
Capabilities:
Delete file

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov dword [esp + 4], 0x1b6
mov dword [esp], ebx
call fcn.004bd180
mov eax, dword [0x7385e0]
mov dword [esp], ebx
test eax, eax
jne 0x4bd2f6
call fcn.004c1750
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp sub.msvcrt.dll_remove
call fcn.004c1770
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp 0x4ce250
jmp dword [sym.imp.msvcrt.dll__wremove]
Function at 0x4bd310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
mov edx, dword [0x7385e0]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x4bd335
call fcn.004c1750
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp fcn.004c9f00
call fcn.004c1770
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x4ca2c4
push edi
push esi
push ebx
sub esp, 0x330
mov ebx, dword [esp + 0x340]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
jne 0x4ca2f3
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x4ca4b6
cmp word [ebx], 0
je 0x4ca37d
mov eax, dword [sym.imp.msvcrt.dll__osver]
mov eax, dword [eax]
test ah, 0x80
je 0x4ca359
lea esi, [esp + 0x22c]
mov dword [esp + 0x10], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_WideCharToMultiByte
sub esp, 0x20
mov dword [esp], esi
call sub.kernel32.dll_GetFileAttributesA
jmp 0x4ca361
mov dword [esp], ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
push edx
jne 0x4ca379
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor ebx, ebx
jmp 0x4ca4b6
test al, 0x10
jne 0x4ca38a
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
jmp 0x4ca372
lea edi, [esp + 0x24]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__wfullpath
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x704ca8
mov esi, eax
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x704cac
mov ebx, eax
call sub.msvcrt.dll_wcslen
lea edx, [esi + ebx + 0x21d]
add eax, edx
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
jne 0x4ca3ef
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x4ca4b6
lea esi, [eax + 0x434]
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_wcscpy
cmp word [ebx + 0x434], 0
je 0x4ca465
mov dword [esp + 4], 0x2f
mov dword [esp], esi
call sub.msvcrt.dll_wcsrchr
mov dword [esp], esi
mov edi, eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax*2 + 0x432]
cmp edi, eax
je 0x4ca465
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_wcsrchr
mov dword [esp], esi
mov edi, eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax*2 + 0x432]
cmp edi, eax
je 0x4ca465
mov dword [esp + 4], 0x704ca8
mov dword [esp], esi
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x704cac
mov dword [esp], esi
call sub.msvcrt.dll_wcscat
lea edx, [ebx + 0x224]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebx + 0x42c], 0xffffffff
mov dword [ebx + 0x430], 0
mov dword [ebx + 0x21c], 0
mov word [ebx + 0x220], 0
mov word [ebx + 0x222], 0
add esp, 0x330
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x4bd820
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.004c1750
mov dword [esp], eax
call sub.ws2_32.dll_gethostbyname
test eax, eax
push edx
je 0x4bd857
movsx ecx, word [eax + 8]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
mov edx, dword [esp + 0x28]
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov dword [edx], ecx
add esp, 0x1c
ret
xor eax, eax
jmp 0x4bd853

Function at 0x4bd860
Capabilities:
Connect socket

Disassembly:
push ebx
or eax, 0xffffffff
sub esp, 0x28
cmp dword [esp + 0x38], 2
jne 0x4bd8e7
mov eax, dword [esp + 0x40]
lea ebx, [esp + 0x10]
and eax, 0xffff
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov word [esp + 0x10], 2
mov dword [esp], eax
call sub.ws2_32.dll_htons
push ecx
mov edx, dword [esp + 0x3c]
mov word [esp + 0x12], ax
mov dword [esp + 8], edx
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x30]
mov dword [esp + 8], 0x10
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ws2_32.dll_connect
sub esp, 0xc
add esp, 0x28
pop ebx
ret
Function at 0x4bdc90
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.ws2_32.dll_send
sub esp, 0x10
add esp, 0x1c
ret

Function at 0x4bdd50
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.ws2_32.dll_recv
sub esp, 0x10
add esp, 0x1c
ret

Function at 0x4bde20
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ws2_32.dll_setsockopt
sub esp, 0x14
add esp, 0x2c
ret

Function at 0x4bdec0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.ws2_32.dll_getsockname
sub esp, 0xc
add esp, 0x1c
ret

Function at 0x4bdf80
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.ws2_32.dll_WSAStartup
push ecx
push ecx
mov dword [esp], 0x4bcf00
call fcn.00401335
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x7385d0], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x7385d8], edx
mov dword [0x7385d4], eax
add esp, 0x1ac
ret

Function at 0x4c2a60
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
mov eax, dword [0x737460]
test eax, eax
je 0x4c2a75
mov eax, dword [0x737464]
add esp, 0xc
ret
call sub.kernel32.dll_TlsAlloc
mov dword [0x737460], 1
mov dword [0x737464], eax
add esp, 0xc
ret

Function at 0x4c2a90
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004c2a60
mov dword [esp], eax
call sub.kernel32.dll_TlsGetValue
push edx
add esp, 0x1c
ret

Function at 0x4c2ab0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004c2a60
mov edx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.kernel32.dll_TlsSetValue
push ecx
push ecx
add esp, 0x1c
ret
Function at 0x4c2d60
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov dword [esp], 0x7385e4
call sub.kernel32.dll_InitializeCriticalSection
push eax
call sub.kernel32.dll_TlsAlloc
mov dword [esp], 0xb8
mov dword [0x737584], eax
call sub.msvcrt.dll_malloc
mov ecx, 0x20
mov ebx, eax
lea edx, [eax + 8]
mov dword [eax + 4], 0
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x7385dc]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0xb4], eax
call sub.kernel32.dll_GetCurrentProcess
mov edi, eax
call sub.kernel32.dll_GetCurrentThread
mov esi, eax
call sub.kernel32.dll_GetCurrentProcess
lea edx, [ebx + 0xb0]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.kernel32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x4c2e39
mov eax, dword [0x737584]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.kernel32.dll_TlsSetValue
mov dword [0x73758c], ebx
push eax
push eax
mov eax, dword [0x737588]
mov dword [0x737588], ebx
mov dword [ebx], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
lea esi, [esi]
lea edi, [edi]
push edi
push esi
push ebx
xor esi, esi
sub esp, 0x2f0
mov dword [esp], 0xb8
call sub.msvcrt.dll_malloc
mov ebx, eax
mov eax, dword [esp + 0x300]
mov ecx, 0x20
lea edx, [ebx + 8]
mov dword [ebx + 4], eax
mov edi, edx
mov eax, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x304]
mov dword [ebx + 0x88], 0
mov dword [ebx + 8], eax
lea eax, [ebx + 0xb4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x4c2c80
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateThread
mov ecx, 0xb3
sub esp, 0x18
mov edx, eax
mov dword [ebx + 0xb0], eax
mov eax, esi
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10001
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.kernel32.dll_GetThreadContext
push eax
push eax
mov eax, dword [esp + 0xe8]
mov dword [ebx + 0x8c], eax
mov eax, dword [0x7385fc]
test eax, eax
jne 0x4c2f83
mov edi, 0x737590
mov esi, dword [edi]
test esi, esi
je 0x4c2f2c
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x4c2f66
mov edi, esi
mov esi, dword [edi]
test esi, esi
jne 0x4c2f1a
mov eax, dword [0x737588]
mov edx, dword [0x7385fc]
mov dword [ebx], eax
mov dword [0x737588], ebx
test edx, edx
je 0x4c2f50
mov dword [esp], 0x7385e4
call sub.kernel32.dll_LeaveCriticalSection
push eax
mov dword [0x7385fc], 1
add esp, 0x2f0
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 0xb0]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push ecx
mov dword [esp], esi
call fcn.004cdf48
jmp 0x4c2f14
mov dword [esp], 0x7385e4
call sub.kernel32.dll_EnterCriticalSection
push eax
jmp 0x4c2f0f
Function at 0x4cdabb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
jne 0x4cdaff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004cda80
mov eax, dword [esp + 0x24]
cmp eax, 4
je 0x4cdb34
cmp eax, 0x40
je 0x4cdb34
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
mov edi, ebx
mov ecx, ebp
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
cmp eax, 4
je 0x4cdb6f
cmp eax, 0x40
je 0x4cdb6f
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4cdd50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x737f60
call sub.kernel32.dll_EnterCriticalSection
mov ebx, dword [0x737f78]
push ecx
jmp 0x4cdd8f
mov eax, dword [ebx]
mov dword [esp], eax
call sub.kernel32.dll_TlsGetValue
push edx
mov esi, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4cdd8c
test esi, esi
je 0x4cdd8c
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4cdd6a
mov dword [esp], 0x737f60
call sub.kernel32.dll_LeaveCriticalSection
push eax
add esp, 0x14
pop ebx
pop esi
ret