joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43faac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc8c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x21]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
push eax
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x200]
push edx
call fcn.00454ca4
pop ecx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004987e8
pop ecx
cmp eax, 2
jne 0x43fb29
movsx eax, byte [ebp - 0x1ff]
cmp eax, 0x3a
jne 0x43fb29
push 0x4b8419
lea edx, [ebp - 0x200]
push edx
call fcn.004986dc
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x21]
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
push ecx
call sub.USER32.dll_SetWindowTextA
lea eax, [ebp - 0x200]
push eax
call fcn.004987e8
pop ecx
cmp eax, 3
jbe 0x43fb7f
lea edx, [ebp - 0x200]
push edx
call fcn.004987e8
pop ecx
movsx ecx, byte [ebp + eax - 0x201]
cmp ecx, 0x5c
jne 0x43fb7f
lea eax, [ebp - 0x200]
push eax
call fcn.004987e8
pop ecx
lea edx, [ebp - 0x200]
mov byte [ebp + eax - 0x201], 0
push edx
mov ecx, dword [ebx + 0x21]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push edx
call sub.USER32.dll_SetWindowTextA
mov ecx, dword [ebx + 0x25]
push ecx
mov eax, dword [ecx + 0xc]
call dword [eax + 0x54]
pop ecx
lea edx, [ebp - 0x200]
push edx
call fcn.004987e8
pop ecx
movsx ecx, byte [ebp + eax - 0x201]
cmp ecx, 0x5c
je 0x43fbb8
push 0x4b8419
lea eax, [ebp - 0x200]
push eax
call fcn.004986dc
add esp, 8
push 0x4b84bf
lea edx, [ebp - 0x200]
push edx
call fcn.004986dc
add esp, 8
mov edi, 0x10
lea esi, [ebp - 0x374]
lea eax, [ebp - 0x200]
push edi
push esi
push eax
call fcn.0049bd1c
add esp, 0xc
test eax, eax
jne 0x43fc2a
lea edi, [esi + 0x10]
push 0x4b84c3
push edi
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
je 0x43fc1f
test byte [esi + 8], 0x10
je 0x43fc1f
lea eax, [esi + 0x10]
push eax
call fcn.004a2a54
pop ecx
lea edx, [esi + 0x10]
push edx
mov ecx, dword [ebx + 0x25]
push ecx
mov eax, dword [ecx + 0xc]
call dword [eax + 0x5c]
add esp, 8
push esi
call fcn.0049bddc
pop ecx
test eax, eax
je 0x43fbec
push str.dontexis.ttt
push 0x4000
push 0x18d
mov edx, dword [ebx + 0x25]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
push eax
call sub.USER32.dll_SendMessageA
mov edx, dword [ebx + 0x21]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
push eax
call sub.USER32.dll_GetWindowTextLengthA
push eax
push eax
push 0xb1
mov edx, dword [ebx + 0x21]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
push eax
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov edx, dword [ebx + 0x21]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xc]
push eax
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4400a8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
mov eax, 0x4b80b8
push ebx
mov ebx, dword [ebp + 8]
call fcn.0049af0c
push 0x4f
lea edx, [ebp - 0x78]
push edx
mov ecx, dword [ebx + 0x21]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push edx
call sub.USER32.dll_GetWindowTextA
lea ecx, [ebp - 0x78]
push ecx
call fcn.00454ca4
pop ecx
lea eax, [ebp - 0x78]
mov word [ebp - 0x18], 8
push eax
lea edx, [ebp - 4]
push edx
call fcn.004a79d0
add esp, 8
lea ecx, [ebp - 4]
inc dword [ebp - 0xc]
push 0xffffffffffffffff
push 0
push ecx
mov eax, dword [ebx + 0x1d]
push eax
call fcn.004a7618
add esp, 0x10
dec dword [ebp - 0xc]
push 2
lea edx, [ebp - 4]
push edx
call fcn.004a8304
add esp, 8
push ebx
call fcn.00488933
pop ecx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442d9c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov ebx, 1
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.00442ab8
pop ecx
push ebx
push 0x4b9b6d
push 0x4b9b68
lea eax, [ebp - 0x120]
push eax
call fcn.0049d914
add esp, 0x10
mov edx, dword [esi + 0x1e]
lea ecx, [ebp - 0x104]
push edx
push 0xff
push ecx
lea eax, [ebp - 0x120]
push 0x4b9ac4
push eax
push edi
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
je 0x442e6a
movsx eax, byte [ebp - 0x104]
cmp eax, 0x44
je 0x442e0b
cmp eax, 0x41
jne 0x442e64
movsx edx, byte [ebp - 0x103]
cmp edx, 0x2c
jne 0x442e64
push 0x100
call fcn.004a4fc0
pop ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push esi
push edi
mov esi, ecx
xor eax, eax
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push eax
lea edx, [esi + 0x27f]
push edx
call fcn.00404120
add esp, 8
inc ebx
jmp 0x442dba
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454294
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc9c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, str._s_d
push ebx
call fcn.004543cc
pop ecx
mov esi, 1
push esi
lea eax, [edi + 5]
push eax
push edi
lea edx, [ebp - 0x24]
push edx
call fcn.0049d914
add esp, 0x10
lea ecx, [ebx + 0x24]
lea eax, [ebp - 0xc4]
lea edx, [edi + 4]
push ecx
push 0xa0
push eax
push edx
lea ecx, [ebp - 0x24]
lea eax, [edi + 0x12]
push ecx
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
je 0x4543c4
inc esi
lea edx, [ebp - 0xc4]
push edx
call sub.KERNEL32.dll_LoadLibraryA
mov dword [ebp - 8], eax
test eax, eax
jne 0x454322
push 0xa0
lea edx, [ebp - 0x164]
push edx
push 0x7ff
mov ecx, dword [ebx + 0x123]
push ecx
call sub.USER32.dll_LoadStringA
jmp 0x454388
lea eax, [edi + 0x1b]
push eax
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_GetProcAddress
mov dword [ebp - 4], eax
test eax, eax
jne 0x45435e
push 0xa0
lea edx, [ebp - 0x164]
push edx
push 0x800
mov ecx, dword [ebx + 0x123]
push ecx
call sub.USER32.dll_LoadStringA
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_FreeLibrary
jmp 0x454388
push 0xa0
lea edx, [ebp - 0x164]
push edx
push 0x7fe
mov ecx, dword [ebx + 0x123]
push ecx
call sub.USER32.dll_LoadStringA
lea eax, [ebp - 8]
push eax
push ebx
call fcn.00454678
add esp, 8
lea edx, [ebp - 0xc4]
push edx
lea ecx, [ebp - 0x164]
push ecx
lea eax, [ebp - 0x364]
push eax
call fcn.0049d914
add esp, 0xc
lea edx, [ebp - 0x364]
push edx
push 0x12
push 0x403
mov ecx, dword [ebx + 0x127]
push ecx
call sub.USER32.dll_SendMessageA
jmp 0x4542b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4551bc
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], pe_nt_image_headers32
mov byte [ebp - 0x20c], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.txtfile_shellopencommand
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4552e7
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x20c]
push ecx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x4552de
cmp dword [ebp - 0xc], 2
jne 0x455262
push pe_nt_image_headers32
lea ecx, [ebp - 0x40c]
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
xor eax, eax
lea edi, [ebp - 0x40c]
or ecx, 0xffffffff
lea esi, [ebp - 0x20c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4bee13
lea eax, [ebp - 0x20c]
push eax
call fcn.00498905
add esp, 8
mov esi, eax
test eax, eax
je 0x4552de
lea edi, [esi + 2]
push edi
call fcn.004987e8
pop ecx
inc eax
push eax
push edi
push esi
call fcn.004985e4
add esp, 0xc
push esi
call fcn.004987e8
pop ecx
inc eax
push eax
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004987e8
pop ecx
add eax, esi
push eax
call fcn.004985e4
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.004987e8
pop ecx
push eax
mov ecx, dword [ebp + 8]
push ecx
push esi
call fcn.004985c0
add esp, 0xc
push 1
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jbe 0x4552de
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455cc4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x4beef8], ebx
cmp dword [0x4bef08], 0
jne 0x455cee
push 0x4d12dc
push 0x101
call sub.WSOCK32.dll_WSAStartup
jmp 0x455cff
push 0x4d12dc
push 0x101
push 0
call fcn.0045aca0
test eax, eax
jne 0x455de0
cmp word [0x4d12dc], 0x101
jne 0x455d1e
mov dword [0x4beefc], 1
jmp 0x455d3d
cmp dword [0x4bef08], 0
jne 0x455d31
call sub.WSOCK32.dll_WSACleanup
jmp 0x455de0
push 0
call fcn.0045ad34
jmp 0x455de0
xor eax, eax
xor edx, edx
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x24], sym.serv_u32.exe__RWinSocket_DispatchProc_qqsp6HWND__uiuil
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x28]
mov dword [ebp - 4], str.RSockWin
push edx
call sub.USER32.dll_RegisterClassA
push sym.serv_u32.exe__RWinSocket_DispatchProc_qqsp6HWND__uiuil
push 0x3e8
push 0
push 0
call sub.USER32.dll_SetTimer
mov dword [0x4d12d0], eax
cmp dword [0x4bef08], 0
jne 0x455da7
push sym.serv_u32.exe__RWinSocket_BlockingHookProc_qqsv
call sub.WSOCK32.dll_WSASetBlockingHook
jmp 0x455db3
push sym.serv_u32.exe__RWinSocket_BlockingHookProc_qqsv
push 0
call fcn.0045b930
push 1
push 0x4d12ac
call fcn.00403c90
add esp, 8
push 1
push 0x4d146a
call fcn.00404368
add esp, 8
push 1
push 0x4d148a
call fcn.00404040
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456680
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x4beefc], 0
jne 0x4566a2
mov eax, 8
jmp 0x456827
cmp dword [ebx + 0xc], 7
je 0x4566b2
mov eax, 7
jmp 0x456827
cmp dword [ebx + 0x78], 0
je 0x4566c2
mov eax, 0x10
jmp 0x456827
cmp dword [ebx + 0xd6], 0
je 0x4566d5
mov eax, 0x10
jmp 0x456827
cmp dword [ebx + 0x102], 0
je 0x4566e8
mov eax, 0x10
jmp 0x456827
cmp dword [ebx + 0x88], 0
je 0x4566fb
mov eax, 0x10
jmp 0x456827
xor edx, edx
mov dword [esi + 0x7c], edx
push ebx
call fcn.00457ae8
pop ecx
mov dword [ebp - 4], 0x10
push esi
call fcn.00457c0c
pop ecx
mov edi, eax
mov dword [ebp - 8], ebx
cmp dword [0x4bef08], 0
jne 0x456733
lea ecx, [ebp - 4]
lea eax, [ebp - 0x24]
push ecx
push eax
push edi
call sub.WSOCK32.dll_accept
jmp 0x456745
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x24]
push ecx
push edi
mov eax, dword [ebp - 8]
push eax
call fcn.00459960
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x456788
mov esi, ebx
cmp dword [0x4bef08], 0
jne 0x45675f
call sub.WSOCK32.dll_WSAGetLastError
jmp 0x456765
push esi
call fcn.0045adb4
mov esi, eax
cmp esi, 0x2733
jne 0x456779
mov eax, 0xd
jmp 0x456827
push esi
push ebx
call fcn.00458714
add esp, 8
jmp 0x456827
mov dword [ebp - 0xc], 1
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x4567ae
lea ecx, [ebp - 0xc]
push ecx
push 0x8004667e
push eax
call sub.WSOCK32.dll_ioctlsocket
jmp 0x4567be
lea ecx, [ebp - 0xc]
push ecx
push 0x8004667e
push eax
push edx
call fcn.00459bb0
mov edi, dword [ebx + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
cmp dword [0x4bef08], 0
jne 0x4567e6
push 0x23
push 0x400
push edi
mov edx, dword [ebp - 0x10]
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x4567fb
push 0x23
push 0x400
push edi
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.0045b6a0
test eax, eax
je 0x456806
mov eax, 0x14
jmp 0x456827
cmp dword [ebx + 0x44], 0
je 0x45681b
xor edx, edx
mov dword [esi + 0x30], edx
xor ecx, ecx
mov dword [esi + 0x48], ecx
xor eax, eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x88], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4570a8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
cmp dword [0x4beefc], 0
jne 0x4570c9
mov eax, 8
jmp 0x4571fb
cmp dword [ebx + 0x8c], 0
je 0x4570dc
mov eax, 0x10
jmp 0x4571fb
cmp dword [ebx + 0x102], 0
je 0x4570ef
mov eax, 0x10
jmp 0x4571fb
cmp dword [ebx + 0x78], 0
je 0x457105
cmp dword [ebx + 0xc], 7
jne 0x457105
mov eax, 0x10
jmp 0x4571fb
cmp dword [ebx + 0x88], 0
jne 0x457118
mov eax, 0x11
jmp 0x4571fb
test eax, eax
jg 0x457123
xor eax, eax
jmp 0x4571fb
cmp dword [ebx + 8], 0xffffffff
jne 0x457133
mov eax, 0x11
jmp 0x4571fb
mov ecx, edx
and ecx, 1
mov dword [ebx + 0x10a], ecx
mov dword [ebx + 0x102], 1
cmp dword [ebx + 0x44], 0
je 0x457158
xor ecx, ecx
mov dword [ebx + 0x48], ecx
xor ecx, ecx
mov dword [ebx + 0x3c], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x11a], ecx
mov dword [ebx + 0x116], ecx
mov dword [ebx + 0x122], eax
mov dword [ebx + 0x11e], eax
xor eax, eax
mov dword [ebx + 0x132], eax
mov dword [ebp - 4], 1
test dl, 2
je 0x4571c4
cmp dword [ebx + 0xc], 7
jne 0x4571c4
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x4571b0
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x4571c4
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
push edx
call fcn.0045a67c
xor eax, eax
mov dword [ebx + 0x126], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x12a], eax
test eax, eax
je 0x4571dd
xor edx, edx
mov dword [eax], edx
mov dword [ebx + 0x112], 2
push 1
push 0
push 0x400
mov ecx, dword [ebx + 0x10]
push ecx
call sub.USER32.dll_PostMessageA
xor eax, eax
pop ebx
pop ecx
pop ebp
ret
Function at 0x4573d8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x4beefc], 0
jne 0x4573f8
mov eax, 8
jmp 0x45752e
cmp dword [ebx + 0xc], 7
je 0x457408
mov eax, 7
jmp 0x45752e
cmp dword [ebx + 0x8c], 0
je 0x45741b
mov eax, 0x10
jmp 0x45752e
cmp dword [ebx + 0x78], 0
je 0x45742b
mov eax, 0x10
jmp 0x45752e
cmp dword [ebx + 0x102], 0
je 0x45743e
mov eax, 0x10
jmp 0x45752e
cmp dword [ebx + 0x88], 0
jne 0x457451
mov eax, 0x11
jmp 0x45752e
cmp esi, 3
jge 0x457460
mov eax, 0x14
jmp 0x45752e
cmp dword [ebx + 8], 0xffffffff
jne 0x457470
mov eax, 0x11
jmp 0x45752e
push esi
call fcn.004a4fc0
mov edi, eax
pop ecx
mov dword [ebx + 0x116], edi
mov dword [ebx + 0x11a], edi
mov dword [ebx + 0x122], esi
xor eax, eax
mov dword [ebx + 0x11e], esi
mov dword [ebx + 0x126], eax
xor edx, edx
xor ecx, ecx
mov dword [ebx + 0x132], edx
xor eax, eax
mov dword [ebx + 0x102], 1
mov dword [ebx + 0x106], 1
mov dword [ebx + 0x10e], ecx
mov dword [ebx + 0x10a], eax
cmp dword [ebx + 0x44], 0
je 0x4574d0
xor edx, edx
mov dword [ebx + 0x3c], edx
mov dword [ebp - 4], 1
test byte [ebp + 0x10], 2
je 0x45751a
cmp dword [ebx + 0xc], 7
jne 0x45751a
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x457506
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x45751a
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
push edx
call fcn.0045a67c
push 1
push 0
push 0x400
mov eax, dword [ebx + 0x10]
push eax
call sub.USER32.dll_PostMessageA
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x457648
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x4beefc], 0
jne 0x457668
mov eax, 8
jmp 0x457880
cmp dword [ebx + 0x88], 0
jne 0x45767b
mov eax, 0x11
jmp 0x457880
test eax, eax
je 0x45768c
mov dword [ebx + 0x4c], eax
mov eax, 0x10
jmp 0x457880
xor edx, edx
mov dword [ebx + 0x78], edx
mov dword [ebx + 0xd6], edx
mov dword [ebx + 0x102], edx
cmp dword [ebx + 0x44], 0
je 0x4576a8
xor eax, eax
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x6c], 0
jne 0x4576cf
mov dword [ebx + 0x6c], 1
push 0
call fcn.004a99ac
pop ecx
mov esi, eax
mov dword [ebx + 0x70], esi
test esi, esi
jg 0x4576fa
mov dword [ebx + 0x70], 0xffffffe7
jmp 0x4576fa
push 0
call fcn.004a99ac
pop ecx
sub eax, dword [ebx + 0x70]
cmp eax, 0xf
jle 0x4576fa
push ebx
call fcn.00457ae8
pop ecx
push 0x19
push 6
push ebx
call fcn.00458824
add esp, 0xc
xor eax, eax
jmp 0x457880
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 8]
mov esi, ebx
cmp dword [0x4bef08], 0
jne 0x457718
push 0
push 0
push eax
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x457724
push 0
push 0
push eax
push edx
push esi
call fcn.0045b6a0
cmp dword [ebx + 0xc], 7
jne 0x4577bb
mov ax, word [ebx + 0x74]
cmp dword [0x4bef08], 0
mov word [ebp - 4], ax
mov edx, ebx
mov word [ebp - 2], 0x1e
mov eax, dword [ebx + 8]
jne 0x457762
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x457779
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
push edx
call fcn.0045a67c
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x457791
push 0
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x45779a
push 0
push eax
push edx
call fcn.0045a9e4
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x4577b2
push 1
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x4577bb
push 1
push eax
push edx
call fcn.0045a9e4
mov esi, dword [ebx + 8]
mov edi, ebx
cmp dword [0x4bef08], 0
jne 0x4577d1
push esi
call sub.WSOCK32.dll_closesocket
jmp 0x4577d8
push esi
push edi
call fcn.00459a90
mov esi, eax
inc esi
jne 0x457862
mov esi, ebx
cmp dword [0x4bef08], 0
jne 0x4577f3
call sub.WSOCK32.dll_WSAGetLastError
jmp 0x4577f9
push esi
call fcn.0045adb4
mov esi, eax
cmp esi, 0x2733
jne 0x45781c
push 0
push 0
push 0x403
mov ecx, dword [ebx + 0x10]
push ecx
call sub.USER32.dll_PostMessageA
mov eax, 0x10
jmp 0x457880
cmp dword [ebx + 0x74], 0
jne 0x457842
mov dword [ebx + 0x74], 1
push 0
push 0
push 0x403
mov edx, dword [ebx + 0x10]
push edx
call sub.USER32.dll_PostMessageA
mov eax, 0x10
jmp 0x457880
push ebx
call fcn.00457ae8
pop ecx
push 0x18
push 6
push ebx
call fcn.00458824
add esp, 0xc
push esi
push ebx
call fcn.00458714
add esp, 8
jmp 0x457880
push 0x17
push 6
push ebx
call fcn.00458824
xor edx, edx
add esp, 0xc
mov dword [ebx + 0x88], edx
xor eax, eax
mov dword [ebx + 8], 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x457ae8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 8]
cmp edx, 0xffffffff
je 0x457bd6
mov eax, dword [ebx + 0x10]
mov esi, ebx
cmp dword [0x4bef08], 0
jne 0x457b18
push 0
push 0
push eax
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x457b24
push 0
push 0
push eax
push edx
push esi
call fcn.0045b6a0
cmp dword [ebx + 0xc], 7
jne 0x457bb9
mov word [ebp - 4], 1
mov word [ebp - 2], 0
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x457b60
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x457b77
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
push edx
call fcn.0045a67c
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x457b8f
push 0
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x457b98
push 0
push eax
push edx
call fcn.0045a9e4
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x457bb0
push 1
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x457bb9
push 1
push eax
push edx
call fcn.0045a9e4
mov eax, dword [ebx + 8]
mov edx, ebx
cmp dword [0x4bef08], 0
jne 0x457bcf
push eax
call sub.WSOCK32.dll_closesocket
jmp 0x457bd6
push eax
push edx
call fcn.00459a90
mov dword [ebx + 8], 0xffffffff
xor ecx, ecx
xor eax, eax
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0xd6], ecx
mov dword [ebx + 0x102], ecx
mov dword [ebx + 0x88], eax
xor edx, edx
xor eax, eax
mov dword [ebx + 0xf2], edx
mov dword [ebx + 0x126], eax
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x457c54
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0xffffffff
jne 0x457c6a
xor eax, eax
jmp 0x457cc3
mov dword [ebp - 4], 0x10
mov esi, dword [ebx + 8]
mov edi, ebx
cmp dword [0x4bef08], 0
jne 0x457c8f
lea edx, [ebp - 4]
lea ecx, [ebp - 0x14]
push edx
push ecx
push esi
call sub.WSOCK32.dll_getsockname
jmp 0x457c9e
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x14]
push edx
push esi
push edi
call fcn.00459d54
inc eax
jne 0x457ca5
xor eax, eax
jmp 0x457cc3
mov si, word [ebp - 0x12]
cmp dword [0x4bef08], 0
mov edi, ebx
jne 0x457cbc
push esi
call sub.WSOCK32.dll_ntohs
jmp 0x457cc3
push esi
push edi
call fcn.0045a374
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459b18
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x459b33
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
call sub.WSOCK32.dll_connect
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0xa0]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
push esi
push str.Sock_ID_lu_connect__u_0x_p__d_______d___s_
push ecx
call fcn.0049d914
add esp, 0x20
lea eax, [ebp - 0xa0]
mov edx, dword [0x4bef10]
mov ecx, dword [0x4bef0c]
push eax
push 0
push edx
push ecx
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x459bb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x459bcb
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x14]
push eax
push edi
mov edx, dword [ebp + 0xc]
push edx
call sub.WSOCK32.dll_ioctlsocket
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xd0]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
mov ecx, edi
sub ecx, 0x8004667e
je 0x459c17
sub ecx, 0xc0000001
je 0x459c2a
sub ecx, 0xc88
je 0x459c3e
jmp 0x459c54
push esi
lea edi, [ebp - 0xb4]
mov eax, edi
mov esi, str.FIONBIO
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
jmp 0x459c69
push esi
lea edi, [ebp - 0xb4]
mov eax, edi
mov esi, str.FIONREAD
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x459c69
push esi
lea edi, [ebp - 0xb4]
mov eax, edi
mov esi, str.SIOCATMARK
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x459c69
push edi
push 0x4bf356
lea edx, [ebp - 0xb4]
push edx
call fcn.0049d914
add esp, 0xc
lea ecx, [ebp - 0xd0]
lea edx, [ebp - 0xb4]
push ecx
push ebx
mov eax, dword [ebp + 0x14]
push eax
push edx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xa0]
push ecx
push esi
push str.Sock_ID_lu_ioctlsocket__u__s_0x_p_______d___s_
push eax
call fcn.0049d914
add esp, 0x20
lea edx, [ebp - 0xa0]
mov ecx, dword [0x4bef10]
mov eax, dword [0x4bef0c]
push edx
push 0
push ecx
push eax
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10