joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f320
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0x14]
push edx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41f3c3
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41f385
xor eax, eax
jmp 0x41f3c3
push 1
push 0
push 0x1e
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov ebx, eax
test ebx, ebx
jne 0x41f3a1
xor eax, eax
jmp 0x41f3c3
mov dword [ebp - 4], 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f6c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041f410
pop ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push 0
mov eax, dword [ebp - 0x18]
push eax
push edi
movzx eax, word [ebx + 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov word [ebp - 0x10], 0x4d42
mov eax, dword [ebx]
add eax, 0xe
mov edx, dword [ebx + 0x20]
add edx, edx
add edx, edx
add eax, edx
mov edx, dword [ebx + 0x14]
add eax, edx
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], 0
mov word [ebp - 8], 0
mov eax, dword [ebx]
add eax, 0xe
mov edx, dword [ebx + 0x20]
add edx, edx
add edx, edx
add eax, edx
mov dword [ebp - 6], eax
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0xe
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x20]
lea eax, [eax*4 + 0x28]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edi
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424b40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x424b62
xor eax, eax
jmp 0x424c02
push esi
call fcn.0052f180
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x424b76
xor eax, eax
jmp 0x424c02
push ebx
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x424b94
push ebx
call fcn.0052f510
pop ecx
xor eax, eax
jmp 0x424c02
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x567a3b
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x424bf9
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [edx], ax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xffff
mov word [edx], ax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [edx], ax
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
and eax, 0xffff
mov word [edx], ax
push ebx
call fcn.0052f510
pop ecx
mov eax, 1
jmp 0x424c02
push ebx
call fcn.0052f510
pop ecx
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429d90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push 0x40
push 0x3000
push 0x51
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov byte [ebx], 0x55
mov byte [ebx + 1], 0x89
mov byte [ebx + 2], 0xe5
mov byte [ebx + 3], 0x68
mov byte [ebx + 4], 0
mov byte [ebx + 5], 0
mov byte [ebx + 6], 0
mov byte [ebx + 7], 0
mov byte [ebx + 8], 0xe8
mov byte [ebx + 9], 0
mov byte [ebx + 0xa], 0
mov byte [ebx + 0xb], 0
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0x83
mov byte [ebx + 0xe], 0xc4
mov byte [ebx + 0xf], 4
mov byte [ebx + 0x10], 0xe8
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x12], 0
mov byte [ebx + 0x13], 0
mov byte [ebx + 0x14], 0
mov byte [ebx + 0x15], 0x8b
mov byte [ebx + 0x16], 0x45
mov byte [ebx + 0x17], 8
mov byte [ebx + 0x18], 0x50
mov byte [ebx + 0x19], 0xe8
mov byte [ebx + 0x1a], 0
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1c], 0
mov byte [ebx + 0x1d], 0
mov byte [ebx + 0x1e], 0x83
mov byte [ebx + 0x1f], 0xc4
mov byte [ebx + 0x20], 4
mov byte [ebx + 0x21], 0x8b
mov byte [ebx + 0x22], 0x45
mov byte [ebx + 0x23], 0xc
mov byte [ebx + 0x24], 0x50
mov byte [ebx + 0x25], 0xe8
mov byte [ebx + 0x26], 0
mov byte [ebx + 0x27], 0
mov byte [ebx + 0x28], 0
mov byte [ebx + 0x29], 0
mov byte [ebx + 0x2a], 0x83
mov byte [ebx + 0x2b], 0xc4
mov byte [ebx + 0x2c], 4
mov byte [ebx + 0x2d], 0x8b
mov byte [ebx + 0x2e], 0x45
mov byte [ebx + 0x2f], 0x10
mov byte [ebx + 0x30], 0x50
mov byte [ebx + 0x31], 0xe8
mov byte [ebx + 0x32], 0
mov byte [ebx + 0x33], 0
mov byte [ebx + 0x34], 0
mov byte [ebx + 0x35], 0
mov byte [ebx + 0x36], 0x83
mov byte [ebx + 0x37], 0xc4
mov byte [ebx + 0x38], 4
mov byte [ebx + 0x39], 0x6a
mov byte [ebx + 0x3a], 3
mov byte [ebx + 0x3b], 0xe8
mov byte [ebx + 0x3c], 0
mov byte [ebx + 0x3d], 0
mov byte [ebx + 0x3e], 0
mov byte [ebx + 0x3f], 0
mov byte [ebx + 0x40], 0x83
mov byte [ebx + 0x41], 0xc4
mov byte [ebx + 0x42], 4
mov byte [ebx + 0x43], 0x6a
mov byte [ebx + 0x44], 0xff
mov byte [ebx + 0x45], 0xe8
mov byte [ebx + 0x46], 0
mov byte [ebx + 0x47], 0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x49], 0
mov byte [ebx + 0x4a], 0x83
mov byte [ebx + 0x4b], 0xc4
mov byte [ebx + 0x4c], 4
mov byte [ebx + 0x4d], 0x5d
mov byte [ebx + 0x4e], 0xc2
mov byte [ebx + 0x4f], 0xc
mov byte [ebx + 0x50], 0
mov eax, dword [ebp + 8]
push eax
push 4
push ebx
call fcn.00429710
add esp, 0xc
push 0xd
push fcn.0044f750
push 9
push ebx
call fcn.00429770
add esp, 0x10
push 0x15
push fcn.0044f130
push 0x11
push ebx
call fcn.00429770
add esp, 0x10
push 0x1e
push fcn.0044f3d0
push 0x1a
push ebx
call fcn.00429770
add esp, 0x10
push 0x2a
push fcn.0044f3d0
push 0x26
push ebx
call fcn.00429770
add esp, 0x10
push 0x36
push fcn.0044f3d0
push 0x32
push ebx
call fcn.00429770
add esp, 0x10
push 0x40
push fcn.0044cd40
push 0x3c
push ebx
call fcn.00429770
add esp, 0x10
push 0x4a
push fcn.00486bc0
push 0x46
push ebx
call fcn.00429770
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x10
push 0x51
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x429f91
mov eax, ebx
jmp 0x429f93
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439030
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004858f0
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4390e6
mov eax, dword [ebx + 8]
mov eax, dword [eax + 8]
test eax, eax
je 0x439106
push ebx
call fcn.004398e0
pop ecx
test eax, eax
je 0x439106
push 0
call fcn.0043ae30
pop ecx
mov dword [ebp - 0xc], eax
push 0
call fcn.00489310
pop ecx
mov dword [ebp - 4], eax
push 0
call fcn.00489310
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0048c2e0
add esp, 8
push ebx
mov eax, dword [ebp - 8]
push eax
call fcn.0048c6d0
add esp, 8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
call fcn.00477760
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00489390
pop ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
push eax
call fcn.00489390
pop ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
jmp 0x439108
push str.____Dynamic_symbol_not_found:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5d3ce9
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43bd40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
xor ebx, ebx
jmp 0x43bdf8
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00530000
add esp, 8
test eax, eax
jne 0x43bdb6
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43bdf8
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43bdaf
xor eax, eax
jmp 0x43be1f
mov eax, 0x80004005
jmp 0x43be1f
lea eax, [ebp - 4]
push eax
push 8
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43bdf8
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0043bd40
add esp, 0x10
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x43be1f
push 0x104
mov eax, dword [ebp + 0x10]
push eax
mov eax, ebx
inc ebx
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x43bd4f
mov eax, 0x80004005
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4560a0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
movzx esi, word [ebp + 8]
cmp esi, 0x65
jl 0x4560be
cmp esi, 0x69
jg 0x4560d6
jmp dword [esi*4 + 0x5d59b8]
test esi, esi
jl case.default.0x4560cf
cmp esi, 4
jg case.default.0x4560cf
jmp dword [esi*4 + 0x5d5b60]
cmp esi, 0x3e9
jl case.default.0x4560cf
cmp esi, 0x3ef
jg case.default.0x4560cf
jmp dword [esi*4 + 0x5d4bd0]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x14]
mov ebx, eax
shr ebx, 0xa
jmp 0x456233
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x14], 0xffffffff
jae 0x456121
mov edi, dword [ebp - 0x14]
jmp 0x456124
or edi, 0xffffffff
mov ebx, edi
shr ebx, 0xa
jmp 0x456233
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x14]
mov ebx, eax
shr ebx, 0xa
jmp 0x456233
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 4]
mov ebx, eax
shr ebx, 0xa
jmp 0x456233
xor ebx, ebx
jmp 0x456233
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46fc40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp + 0xc], 0
jne 0x46fc63
mov edx, dword [ebp + 8]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x46fc59
mov dword [ebp + 0xc], eax
cmp dword [0x6b20cc], 0
je 0x46fc71
call fcn.004abe20
cmp dword [ebp + 0xc], 0
je 0x46fc87
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004ac800
add esp, 8
cmp dword [0x6b20cc], 0
je 0x46fc95
call fcn.004abe50
pop ebp
ret
Function at 0x47bab0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov dword [ebp - 0x104], 0
xor ebx, ebx
jmp 0x47bad8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [ebp + ebx*4 - 0x100], eax
je 0x47bae0
inc ebx
cmp ebx, dword [ebp - 0x104]
jb 0x47bac8
cmp ebx, dword [ebp - 0x104]
jne 0x47bb04
cmp dword [ebp - 0x104], 0x40
jae 0x47bb04
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x100], eax
inc dword [ebp - 0x104]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x47bb33
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x47bb92
xor eax, eax
jmp 0x47bba5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
push eax
mov edx, 0x10624dd3
imul edx
pop eax
shr eax, 0x1f
sar edx, 6
add eax, edx
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x47bb92
xor eax, eax
jmp 0x47bba5
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47bbb0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov dword [ebp - 0x104], 0
xor ebx, ebx
jmp 0x47bbd8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [ebp + ebx*4 - 0x100], eax
je 0x47bbe0
inc ebx
cmp ebx, dword [ebp - 0x104]
jb 0x47bbc8
cmp ebx, dword [ebp - 0x104]
jne 0x47bc04
cmp dword [ebp - 0x104], 0x40
jae 0x47bc04
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x100], eax
inc dword [ebp - 0x104]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x47bc33
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x47bc92
xor eax, eax
jmp 0x47bca5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
push eax
mov edx, 0x10624dd3
imul edx
pop eax
shr eax, 0x1f
sar edx, 6
add eax, edx
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x10c]
push eax
push 0
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x47bc92
xor eax, eax
jmp 0x47bca5
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47bcb0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov dword [ebp - 0x104], 0
xor ebx, ebx
jmp 0x47bcd8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [ebp + ebx*4 - 0x100], eax
je 0x47bce0
inc ebx
cmp ebx, dword [ebp - 0x104]
jb 0x47bcc8
cmp ebx, dword [ebp - 0x104]
jne 0x47bd04
cmp dword [ebp - 0x104], 0x40
jae 0x47bd04
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x100], eax
inc dword [ebp - 0x104]
mov dword [ebp - 0x208], 0
xor ebx, ebx
jmp 0x47bd22
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [ebp + ebx*4 - 0x204], eax
je 0x47bd2a
inc ebx
cmp ebx, dword [ebp - 0x208]
jb 0x47bd12
cmp ebx, dword [ebp - 0x208]
jne 0x47bd4e
cmp dword [ebp - 0x208], 0x40
jae 0x47bd4e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp + ebx*4 - 0x204], eax
inc dword [ebp - 0x208]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x47bd89
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x47bdf0
mov eax, 2
jmp 0x47be2e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
push eax
mov edx, 0x10624dd3
imul edx
pop eax
shr eax, 0x1f
sar edx, 6
add eax, edx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc eax
push eax
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x47bdf0
mov eax, 2
jmp 0x47be2e
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x47be0e
mov eax, 2
jmp 0x47be2e
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x47be2c
mov eax, 1
jmp 0x47be2e
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47be40
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x47be91
mov ecx, str.255.255.255.255
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx]
mov ah, byte [ecx]
sub ah, al
jne 0x47be76
test al, al
je 0x47be7b
inc edx
inc ecx
jmp 0x47be66
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47bea1
push 2
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyaddr]
mov ebx, eax
jmp 0x47bea1
push 2
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyaddr]
mov ebx, eax
test ebx, ebx
jne 0x47beb1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
jne 0x47bedd
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x47bedd
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp + 0xc]
mov dword [edx + 8], str.Generic_error_in_GetHostByName__
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47bf50
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, dword [ebp + 8]
push eax
call fcn.0047bef0
pop ecx
push 0x10
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.WSOCK32.dll_connect]
mov ebx, eax
test ebx, ebx
je 0x47c0a1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x47bfdb
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [eax + 0xc]
push edx
call fcn.00491010
pop ecx
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
jmp 0x47c0a1
mov eax, dword [ebp + 8]
push eax
call fcn.0047bcb0
pop ecx
mov ebx, eax
cmp ebx, 2
jne 0x47c005
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 2
mov edx, dword [ebp + 8]
mov dword [edx + 8], str.Connection_failed
jmp 0x47c01e
cmp ebx, 1
je 0x47c01e
mov edx, dword [ebp + 8]
or dword [edx + 0xc], 0xffffffff
mov edx, dword [ebp + 8]
mov dword [edx + 8], str.Timeout
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.WSOCK32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x47c08d
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x30], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.WSOCK32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x47c081
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x34], eax
jmp 0x47c0a1
mov edx, dword [ebp + 8]
mov dword [edx + 0x34], 0x578
jmp 0x47c0a1
mov edx, dword [ebp + 8]
mov dword [edx + 0x30], 0x578
mov edx, dword [ebp + 8]
mov dword [edx + 0x34], 0x578
mov eax, dword [ebp + 8]
push eax
call fcn.0047bf20
pop ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
sete al
and eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47d8b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 1
push 0x47c0c0
call fcn.00486e90
add esp, 8
mov ebx, eax
push 0x400
push 2
call fcn.00485e90
add esp, 8
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x47d8ef
cmp dword [ebx], 0xf0123a42
jne 0x47d8ef
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x47d932
push 1
call fcn.00485f30
pop ecx
mov dword [ebp - 0x14], eax
push 2
call fcn.00485f30
pop ecx
mov dword [ebp - 0x18], eax
push 3
call fcn.00485f30
pop ecx
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp + 8]
push eax
push 0
push 0xbc4
push 1
call fcn.004769a0
add esp, 0x20
jmp 0x47da4b
mov eax, dword [ebp - 0x10]
push eax
call fcn.004894a0
pop ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004894c0
pop ecx
mov dword [ebp - 4], eax
push 0x1a
push 3
call fcn.00485e90
add esp, 8
test eax, eax
je 0x47d96e
push 3
call fcn.00486ac0
pop ecx
mov esi, eax
cmp esi, dword [ebp - 4]
jge 0x47d96e
mov dword [ebp - 4], esi
xor edi, edi
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0x5e0848
xor esi, esi
jmp 0x47da1a
cmp dword [ebp + 0xc], 1
jne 0x47d9b0
mov eax, dword [ebp - 4]
sub eax, edi
cmp dword [ebx + 0x30], eax
jle 0x47d9a2
mov eax, dword [ebp - 4]
sub eax, edi
mov dword [ebp - 0x14], eax
jmp 0x47d9a8
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jmp 0x47d9b6
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
xor esi, esi
push ebx
call fcn.0047bbb0
pop ecx
test eax, eax
je 0x47d9db
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
test esi, esi
jle 0x47d9e3
add edi, esi
jmp 0x47da14
test esi, esi
jne 0x47d9f7
or dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 8], str.Timeout
jmp 0x47da23
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebx + 0xc], eax
push eax
call fcn.00491010
pop ecx
mov dword [ebx + 8], eax
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
jmp 0x47da23
cmp dword [ebp + 0xc], 0
je 0x47da23
cmp edi, dword [ebp - 4]
jl 0x47d988
mov dword [ebx + 0x20], edi
test esi, esi
jle 0x47da3b
call fcn.00488df0
push edi
push eax
call fcn.0048a010
add esp, 8
jmp 0x47da4b
call fcn.00488df0
push 0xffffffffffffffff
push eax
call fcn.0048a010
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret