joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e5ef
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 8]
xor ebx, ebx
cmp byte [esi + 0x15], bl
push edi
mov edi, dword [esi + 4]
mov dword [ebp - 4], eax
jne 0x47e691
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 8], eax
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x47e635
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push ebx
push 0x12
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
je 0x47e67b
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [esi + 0x14], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x47e66e
cmp dword [ebp - 4], 0x103
jne 0x47e688
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
jne 0x47e65d
jmp 0x47e688
push ebx
push dword [esi + 4]
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4825ca
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
xor esi, esi
mov dword [edx], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 9], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xc], bl
xor ecx, ecx
cmp byte [ebp - 1], bl
jne 0x48265b
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi]
inc dword [ebp - 0x10]
xor ebx, ebx
cmp al, bl
je 0x482652
cmp al, 0x41
jl 0x482613
cmp al, 0x5a
jg 0x482613
sub al, 0x41
jmp 0x482629
cmp al, 0x61
jl 0x48261f
cmp al, 0x7a
jg 0x48261f
sub al, 0x47
jmp 0x482629
cmp al, 0x30
jl 0x48262f
cmp al, 0x39
jg 0x48262f
add al, 4
mov byte [ebp + ecx - 0xc], al
jmp 0x48264a
cmp al, 0x2b
jne 0x48263a
mov byte [ebp + ecx - 0xc], 0x3e
jmp 0x48264a
cmp al, 0x2f
jne 0x482645
mov byte [ebp + ecx - 0xc], 0x3f
jmp 0x48264a
cmp al, 0x3d
jne 0x48264b
inc esi
inc ecx
cmp ecx, 4
jl 0x4825f3
jmp 0x48265b
push 4
pop esi
mov byte [ebp - 1], 1
sub esi, ecx
cmp ecx, ebx
jne 0x482664
cmp byte [ebp - 1], bl
jne 0x4826c9
mov al, byte [ebp - 0xb]
mov cl, byte [ebp - 0xc]
mov bl, al
shr bl, 4
and bl, 3
shl cl, 2
or bl, cl
mov cl, byte [ebp - 0xa]
mov byte [ebp - 8], bl
mov bl, cl
shl al, 4
shr bl, 2
and bl, 0xf
or bl, al
mov al, byte [ebp - 9]
and al, 0x3f
shl cl, 6
or al, cl
mov byte [ebp - 6], al
push 3
pop eax
mov byte [ebp - 7], bl
xor ebx, ebx
sub eax, esi
xor ecx, ecx
cmp eax, ebx
jle 0x4826bc
mov edx, dword [edx]
mov bl, byte [ebp + ecx - 8]
mov byte [edi + edx], bl
mov edx, dword [ebp + 0xc]
inc dword [edx]
inc ecx
cmp ecx, eax
jl 0x4826a7
xor ebx, ebx
cmp esi, ebx
jne 0x4826c9
cmp byte [ebp - 1], bl
je 0x4825e5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4826ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b8484]
push esi
push edi
push 8
pop ecx
mov esi, str.__43k_0l_:_nklsj_902mlkn__l
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
sete byte [ebp + 0xf]
test esi, esi
mov dword [ebp - 4], eax
jne 0x482704
push edi
call sub.MSVCR71.dll_strlen
pop ecx
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x482720
push ebx
mov eax, ecx
cdq
push 0x20
pop ebx
idiv ebx
mov al, byte [ebp + edx - 0x24]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x48270b
pop ebx
cmp byte [ebp + 0xf], 0
je 0x48272f
push esi
push edi
call fcn.004824f8
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.00497a1c
leave
ret
Function at 0x48273d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 0xc], 0
mov eax, dword [0x4b8484]
push esi
push edi
push 8
pop ecx
mov esi, str.__43k_0l_:_nklsj_902mlkn__l
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jne 0x48276f
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00482557
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
xor ecx, ecx
test edi, edi
jle 0x48278e
push ebx
mov eax, ecx
cdq
push 0x20
pop ebx
idiv ebx
mov al, byte [ebp + edx - 0x24]
xor byte [ecx + esi], al
inc ecx
cmp ecx, edi
jl 0x482779
pop ebx
mov ecx, dword [ebp - 4]
mov byte [esi + edi], 0
pop edi
mov eax, esi
pop esi
call fcn.00497a1c
leave
ret

Function at 0x482993
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x4b8484]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], eax
je 0x482a47
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x482a47
lea eax, [ebp - 0x1fc]
push eax
push 0x10008
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x482a4c
push edi
push edi
push edi
push edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1f8]
push eax
push edi
push dword [ebp - 0x1fc]
mov dword [ebp + 0xc], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x482a2d
cmp esi, edi
jne 0x482a39
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x1fc]
call fcn.00482993
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x4829e0
jmp 0x482a39
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x1fc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x482a4c
mov esi, 0x3f2
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00497a1c
leave
ret

Function at 0x482a92
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp + 0x18], esi
je 0x482ad0
lea eax, [ebp + 0x18]
push eax
push edi
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x482ad0
cmp dword [ebp + 8], 1
jne 0x482ad0
push edi
call sub.MSVCR71.dll_strlen
pop ecx
jmp 0x482ae9
push esi
push dword [ebp + 0x10]
push edi
call dword [sym.imp.MSVCR71.dll_strncpy]
push edi
mov byte [edi + esi - 1], 0
call sub.MSVCR71.dll_strlen
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x482aed
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [0x4b9568], 0
jne 0x482b23
push str.KERNEL32.DLL
mov byte [0x4b9568], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x482b23
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4b9564], eax
mov eax, dword [0x4b9564]
push esi
push edi
xor esi, esi
xor edi, edi
test eax, eax
je 0x482b4c
push edi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
call eax
test al, al
je 0x482b7f
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
jmp 0x482b7f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x482b7f
mov eax, dword [ebp - 4]
mul dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push edx
push eax
call fcn.00497b00
mov esi, eax
mov edi, edx
mov edx, edi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x482b87
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jle 0x482bb4
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [ecx]
xor edx, edx
mov dl, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4a26c0]
inc esi
dec edi
mov dword [ecx], eax
jne 0x482b95
pop esi
pop edi
ret 8
Function at 0x4857c1
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x4857e6
mov edi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x14]
lea eax, [ebp - 0xc0]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.Sock_ID_lu_connect__u_0x_p__d_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x28
lea eax, [ebp - 0xc0]
push eax
push ebx
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00497a1c
leave
ret 0x10

Function at 0x48585b
Capabilities:
Set socket configuration

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xdc
mov eax, dword [0x4b8484]
and dword [ebp - 0x70], 0
and dword [ebp - 0x74], 0
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x70]
test eax, eax
je 0x485889
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], eax
push ebx
push esi
push edi
push dword [ebp + 0x7c]
mov edi, dword [ebp + 0x78]
push edi
push dword [ebp + 0x74]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp + 0x34]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
cmp edi, 0x8004667e
mov esi, dword [sym.imp.MSVCR71.dll_sprintf]
pop ecx
pop ecx
je 0x4858f2
cmp edi, 0x4004667f
je 0x4858eb
cmp edi, 0x40047307
lea eax, [ebp + 0x50]
je 0x4858e4
push edi
push 0x4a4dbc
push eax
call esi
add esp, 0xc
jmp 0x485902
push str.SIOCATMARK
jmp 0x4858fa
push str.FIONREAD
jmp 0x4858f7
push str.FIONBIO
lea eax, [ebp + 0x50]
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp + 0x34]
push eax
push ebx
push dword [ebp + 0x7c]
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x74]
lea eax, [ebp - 0x6c]
push dword [ebp - 0x70]
push str.Sock_ID_lu_ioctlsocket__u__s_0x_p_______d___s_
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 0x64]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00497a1c
add ebp, 0x68
leave
ret 0x10
Function at 0x4859e9
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x485a0e
mov edi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x14]
lea eax, [ebp - 0xc0]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.Sock_ID_lu_getsockname__u_0x_p_0x_p_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x28
lea eax, [ebp - 0xc0]
push eax
push ebx
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00497a1c
leave
ret 0x10

Function at 0x485b17
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x485b3c
mov edi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x18]
lea eax, [ebp - 0xc0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.Sock_ID_lu_recv__u_0x_p__d__d_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x2c
lea eax, [ebp - 0xc0]
push eax
push ebx
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00497a1c
leave
ret 0x14
Function at 0x485bb7
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x485bdc
mov edi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x20]
lea eax, [ebp - 0xc0]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.Sock_ID_lu_recvfrom__u_0x_p__d__d_0x_p_0x_p_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x34
lea eax, [ebp - 0xc0]
push eax
push ebx
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00497a1c
leave
ret 0x1c

Function at 0x485c63
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x485c88
mov edi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x18]
lea eax, [ebp - 0xc0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.Sock_ID_lu_send__u_0x_p__d__d_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x2c
lea eax, [ebp - 0xc0]
push eax
push ebx
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00497a1c
leave
ret 0x14
Function at 0x485d03
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x485d28
mov edi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x20]
lea eax, [ebp - 0xc0]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.Sock_ID_lu_sendto__u_0x_p__d__d_0x_p__d_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x34
lea eax, [ebp - 0xc0]
push eax
push ebx
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00497a1c
leave
ret 0x1c
Function at 0x485daf
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x4b8484]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp - 0xec], ebx
je 0x485dde
mov ebx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0xec], eax
push dword [ebp + 0x1c]
mov esi, dword [ebp + 0x14]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
cmp dword [ebp + 0x10], 0xffff
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
jne 0x485ed7
push str.SOL_SOCKET
push eax
call sub.MSVCR71.dll_strcpy
cmp esi, 0x20
pop ecx
pop ecx
jg 0x485e83
je 0x485e7c
cmp esi, 0xffffff7f
je 0x485e75
cmp esi, 1
je 0x485e6e
cmp esi, 2
je 0x485e67
cmp esi, 4
je 0x485e60
cmp esi, 8
je 0x485e59
cmp esi, 0x10
jne 0x485ea3
push str.SO_DONTROUTE
jmp 0x485ed2
push str.SO_KEEPALIVE
jmp 0x485ed2
push str.SO_REUSEADDR
jmp 0x485ed2
push str.SO_ACCEPTCONN
jmp 0x485ed2
push str.SO_DEBUG
jmp 0x485ed2
push str.SO_DONTLINGER
jmp 0x485ed2
push str.SO_BROADCAST
jmp 0x485ed2
mov eax, 0x80
sub esi, eax
je 0x485ecd
sub esi, eax
je 0x485ec6
sub esi, 0xf01
je 0x485ebf
dec esi
je 0x485eb8
sub esi, 5
je 0x485eb1
dec esi
je 0x485eaa
push str.__INVALID__
jmp 0x485ed2
push str.SO_TYPE
jmp 0x485ed2
push str.SO_ERROR
jmp 0x485ed2
push str.SO_RCVBUF
jmp 0x485ed2
push str.SO_SNDBUF
jmp 0x485ed2
push str.SO_OOBINLINE
jmp 0x485ed2
push str.SO_LINGER
lea eax, [ebp - 0x18]
jmp 0x485ef7
cmp dword [ebp + 0x10], 6
jne 0x485f08
push str.IPPROTO_TCP
push eax
call sub.MSVCR71.dll_strcpy
cmp esi, 1
pop ecx
pop ecx
lea eax, [ebp - 0x18]
jne 0x485f01
push str.TCP_NODELAY
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
jmp 0x485f21
push str.__INVALID__
jmp 0x485ef7
mov esi, str.__INVALID__
push esi
push eax
call sub.MSVCR71.dll_strcpy
lea eax, [ebp - 0x18]
push esi
push eax
call sub.MSVCR71.dll_strcpy
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push edi
push dword [ebp + 0x1c]
lea eax, [ebp - 0x18]
push dword [ebp + 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xe8]
push ebx
push str.Sock_ID_lu_setsockopt__u__s__s_0x_p__d_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x28
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xec]
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.00497a1c
leave
ret 0x18
Function at 0x4860f6
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor esi, esi
xor edi, edi
test eax, eax
je 0x48611b
mov esi, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0xc0]
push esi
push str.Sock_ID_lu_gethostbyname__s______0x_p___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x20
lea eax, [ebp - 0xc0]
push eax
push edi
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00497a1c
leave
ret 8

Function at 0x486184
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor esi, esi
xor edi, edi
test eax, eax
je 0x4861a9
mov esi, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_gethostname]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0xc0]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_gethostname__s__d_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x24
lea eax, [ebp - 0xc0]
push eax
push edi
push dword [0x4b9768]
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00497a1c
leave
ret 0xc

Function at 0x486218
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4b8484]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor esi, esi
xor edi, edi
test eax, eax
je 0x48623d
mov esi, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [0x4b9748], eax
call fcn.00484cd3
lea eax, [ebp - 0x20]
push eax
movzx eax, word [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0xc0]
push str.Sock_ID_lu_WSAStartup_0x_X_0x_p_______d___s_
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x24
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4862b1
mov eax, dword [0x4b9768]
test eax, eax
je 0x4862b1
lea ecx, [ebp - 0xc0]
push ecx
push edi
push eax
push dword [0x4b9764]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.00497a1c
leave
ret 0xc
Function at 0x4864b0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
cmp byte [eax + 0x28], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
jne 0x4864cd
call dword [sym.imp.WS2_32.dll_connect]
jmp 0x4864d3
push eax
call fcn.004857c1
pop ebp
ret 0x10