joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f590
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4913
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x63ae80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x20], 0x6470b0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], eax
lea edi, [ebx + 0x34]
mov dword [ebx], vtable.TiXmlDocument.0
mov dword [edi], 0x6470b0
mov byte [ebp - 4], 1
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x3c], ecx
push 0x60d3b0
xor esi, esi
mov dword [ebx + 0x38], 4
mov byte [ebx + 0x44], al
mov byte [ebx + 0x2c], al
mov dword [ebx + 0x30], eax
call fcn.004723e0
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46f760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x46f7b7
cmp byte [ebx + 0x2c], 0
jne 0x46f7ad
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [0x63ca60]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46f790
sub eax, esi
push edx
lea edi, [ebx + 0x34]
mov esi, eax
call fcn.004723e0
or eax, 0xffffffff
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x46f7d1
mov edi, edi
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x46f7c0
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
push edi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.005ac3d5
push edi
call fcn.005aceab
push 0
mov esi, eax
push 0
push edi
mov dword [ebp - 4], esi
call fcn.005ac3d5
add esp, 0x1c
test esi, esi
jg 0x46f82f
cmp byte [ebx + 0x2c], 0
jne 0x46f7ad
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 0xc
mov edx, dword [0x63ca88]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46f823
jmp 0x46f797
lea eax, [esi + 1]
push eax
call fcn.004a4d50
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edi, eax
push esi
push edi
mov byte [edi], 0
call fcn.005aa5e7
add esp, 0x14
cmp eax, 1
je 0x46f88c
push edi
call fcn.004a4d8a
add esp, 4
cmp byte [ebx + 0x2c], 0
jne 0x46f7ad
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [0x63ca60]
mov eax, edx
lea esi, [eax + 1]
jmp 0x46f880
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46f880
jmp 0x46f797
mov edx, dword [ebp - 4]
mov byte [edi + edx], 0
cmp byte [edi], 0
mov eax, edi
mov esi, edi
je 0x46f8bc
lea esp, [esp]
mov cl, byte [eax]
cmp cl, 0xd
jne 0x46f8b3
mov byte [esi], 0xa
inc eax
inc esi
cmp byte [eax], 0xa
jne 0x46f8b7
jmp 0x46f8b6
mov byte [esi], cl
inc esi
inc eax
cmp byte [eax], 0
jne 0x46f8a0
push 0
mov byte [esi], 0
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0
push edi
mov ecx, ebx
call edx
push edi
call fcn.004a4d8a
add esp, 4
xor eax, eax
cmp byte [ebx + 0x2c], al
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x472510
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
cmp al, 0x41
jl 0x47252e
cmp al, 0x5a
jle 0x47253a
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x4725b9
lea edx, [eax - 0x61]
cmp dl, 0x19
ja 0x472547
add al, 0xe0
mov byte [ebp + 8], al
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [ebp - 0x104], 0
lea esi, [ebp - 0x104]
je 0x472593
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov bl, byte [esi]
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x47257e
add bl, 0xe0
push esi
call edi
cmp byte [ebp + 8], bl
jne 0x47258b
cmp eax, 3
je 0x4725a6
add esi, 4
cmp byte [esi], 0
jne 0x472571
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
Function at 0x473430
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push eax
push ecx
call ebx
test eax, eax
jne 0x47346a
push 0x3e8
call edi
dec esi
test esi, esi
jg 0x473447
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x473480
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 4
mov eax, dword [ebp + 8]
push eax
call ebx
test eax, eax
jne 0x4734b4
push 0x3e8
call edi
dec esi
test esi, esi
jg 0x473497
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x473ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, 0x10
push edi
mov edi, ecx
cmp dword [eax + 0x14], ebx
jb 0x473bb7
mov eax, dword [eax]
push eax
push 0x86
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x473bd4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x473bcb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x473bcb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 4], esi
cmp dword [edi + 0x14], ebx
jb 0x473c06
mov eax, dword [edi]
jmp 0x473c08
mov eax, edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x473bcb
push 0
push esi
push 0
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x473bcb
push 0
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 8]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
push ecx
push esi
call fcn.005a9de0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474e60
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x611154
push eax
mov esi, ecx
call fcn.005ab54c
mov ebx, eax
xor eax, eax
add esp, 8
cmp ebx, eax
jne 0x474ea0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [ebp - 0x808], eax
push edi
jmp 0x474ed0
push ebx
push 0x800
lea eax, [ebp - 0x804]
push 1
push eax
call fcn.005aa5e7
mov edi, eax
add dword [ebp - 0x808], edi
lea ecx, [ebp - 0x804]
push ecx
mov ecx, edi
call fcn.00474c00
add esp, 0x14
cmp edi, 0x800
jge 0x474ed0
push ebx
call fcn.005a9734
add esp, 4
mov ecx, esi
call fcn.00474d30
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x808]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret

Function at 0x475010
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push 0x611720
push eax
call fcn.005ab54c
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x475092
push 0
push 4
push 0
push 0
push 0x6116cc
call fcn.004a5870
mov esi, eax
test esi, esi
je 0x475089
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
cmp edi, 0xffffffff
je 0x47507e
mov ecx, dword [esi + 0x2c]
push ecx
mov dword [esi + 0x28], 0
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x475098
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 1
mov ecx, esi
call eax
push ebx
call fcn.005a9734
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x475390
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4753e0
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4753da
shr eax, 8
cmp al, 2
jne 0x4753da
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 2
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
Function at 0x47f4f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x47f523
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x47f660
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x47f67b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x47f6af
cmp eax, 2
jg 0x47f6af
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x5dc968]
push 2
push edx
call fcn.005a91c0
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.005a91c0
add esp, 0x20
xor eax, eax
ret

Function at 0x47f990
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x154]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x47fa0c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x47f9e1
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push eax
push esi
call fcn.00484fd0
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.0047f820
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x85f4], edx
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4818f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [esi + 0x45c], eax
push 4
lea ecx, [ebp - 0x14]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x481943
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0047f7a0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x460]
push edx
mov dword [ebp - 0x10], 1
call fcn.0049bdd0
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x464]
push eax
call fcn.0049bdd0
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0xc
lea edx, [ebp - 0x10]
push edx
push 0x98000004
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4819b5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0047f7a0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
Function at 0x482020
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x8c], 2
mov ebx, dword [esi]
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x110], ebx
je 0x4821e6
cmp dword [esi + 0x1d0], 0
push edi
jne 0x4821dc
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push edi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x4820b7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.00484fd0
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.0047f820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x84]
push eax
push edi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x48210a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.00484fd0
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.0047f820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0xb8]
lea ebx, [esi + 0xe8]
lea esi, [ebp - 0x104]
mov dword [ebp - 0x114], edi
call fcn.00481fe0
test eax, eax
jne 0x482167
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x108]
mov esi, eax
push esi
push ecx
call fcn.00484fd0
mov edx, dword [ebp - 0x110]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.0047f820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
mov esi, dword [ebp - 0x114]
lea edi, [eax + 0x58]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [eax + 0x11c]
lea edi, [eax + 0xec]
lea esi, [ebp - 0x84]
call fcn.00481fe0
test eax, eax
jne 0x4821d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x108]
push esi
push eax
call fcn.00484fd0
mov ecx, dword [ebp - 0x110]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.0047f820
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x108]
push esi
call fcn.00481f80
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
Function at 0x482200
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x35c]
push 4
lea ecx, [ebp - 4]
push ecx
push 1
push 6
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x482246
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00484fd0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0047f7a0
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0047f7a0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x482260
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x63ae80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x63e070]
mov dword [ebp - 0xa4], 0x4020
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], 4
test eax, eax
jne 0x48230a
push 0x9c
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.005a9d60
add esp, 0xc
push 3
push 2
push 0
push 0
mov dword [ebp - 0xa0], 0x9c
mov dword [ebp - 0x9c], 6
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x4822fe
mov dword [0x63e070], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret
mov dword [0x63e070], 1
jmp 0x48230f
cmp eax, 2
je 0x48235f
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 0xac]
push edx
lea eax, [ebp - 0xa8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x482344
mov ecx, dword [ebp - 0xa8]
cmp ecx, dword [ebp - 0xa4]
jg 0x48235e
push 4
lea edx, [ebp - 0xa4]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6d8e
mov esp, ebp
pop ebp
ret

Function at 0x482390
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x5b8]
test esi, esi
je 0x4823db
mov eax, dword [edi + 0x44]
test eax, eax
je 0x4823db
push 0x482370
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0
mov edx, dword [eax + 0x34]
push ecx
push edx
call fcn.00499f10
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4823e4
mov dword [edi + 0x5b8], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4823ed
mov dword [eax], esi
cmp dword [esi + 0x17c], 0
mov edi, dword [esi + 0x154]
jne 0x4823db
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4823db
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x482d50
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x482ee6
push edi
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x482ec8
push esi
cmp dword [edi + 4], 2
jne 0x482e4c
cmp dword [edi + 0x18], ebx
je 0x482e4c
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x482e4c
cmp eax, 0x10
jb 0x482e4c
push 0x20
call dword [section..data]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x482e59
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [section..data]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x482e62
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x482e37
push eax
call dword [0x63600c]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x482e75
cmp dword [ebp - 4], ebx
jne 0x482e3f
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x482e49
mov dword [eax + 0x1c], esi
mov dword [ebp - 0xc], esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x482d92
jmp 0x482e90
mov dword [ebp - 8], 8
jmp 0x482e90
push esi
mov dword [ebp - 8], 8
call dword [0x636004]
add esp, 4
jmp 0x482e90
mov edx, dword [esi + 0x18]
push edx
mov dword [ebp - 8], 8
call dword [0x636004]
push esi
call dword [0x636004]
add esp, 8
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, ebx
je 0x482e9f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], ebx
je 0x482ec3
mov eax, dword [ebp - 4]
push eax
call fcn.00482d00
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, ebx
pop edi
mov dword [ebp - 4], ebx
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], ebx
jne 0x482eda
push 0x2af9
mov dword [ebp - 8], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [edx], ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.005a9bc4
add esp, 0x18
test eax, eax
je 0x4845b4
cmp eax, 0xffffffff
jne 0x4845b6
xor eax, eax
pop ebp
ret
Function at 0x48d970
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x5dcb74
push ecx
call fcn.0047f7a0
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.0048caf0
test eax, eax
jne 0x48d9a4
mov eax, esi
pop ebp
jmp fcn.0048cf70
pop ebp
ret