joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441f20
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
sub esp, 0x38
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetCursorPos]
push edi
lea eax, [esp + 0x18]
push eax
call ebp
mov edx, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [esp + 0x18]
lea edi, [esi + 4]
push ecx
push edx
call ebx
mov ecx, dword [edi]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [edi]
lea edx, [esp + 0x30]
push edx
push eax
call ebx
test eax, eax
je 0x441f6d
mov edx, dword [edi]
lea ecx, [esp + 0x38]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x48]
cmp eax, 1
jne 0x441fb6
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x441fa6
mov eax, dword [edi]
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, esi
call fcn.004422c0
jmp 0x44208f
mov ecx, dword [edi]
push 2
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x44208f
cmp eax, 2
jne 0x441fd1
mov edx, dword [edi]
push eax
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, esi
call fcn.004422c0
jmp 0x44208f
cmp eax, 3
jne 0x44208f
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call ebp
mov eax, dword [esi + 0x53c]
cmp eax, 0xffffffff
je 0x442058
sub eax, ebx
je 0x4420c0
sub eax, 1
je 0x4420a7
sub eax, 1
jne 0x442058
mov eax, dword [esp + 0x10]
sub eax, dword [esi + 0x534]
xor ecx, ecx
cmp eax, ebx
jne 0x442020
cmp ecx, ebx
je 0x442058
mov edx, dword [esi + 0x524]
mov ebx, dword [esi + 0x530]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0x528]
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x52c]
add edx, eax
push 1
add ebx, ecx
push edi
lea eax, [esp + 0x28]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
call fcn.004104d0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
and ax, 0xff00
cmp ax, 0xff00
je 0x44208f
mov eax, dword [edi]
push 3
push eax
mov dword [esi + 0x53c], 0xffffffff
call dword [sym.imp.USER32.dll_KillTimer]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [edi]
jne 0x44208f
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [esp + 0x4c]
pop edi
pop ebp
mov dword [ecx], 0
mov eax, 1
pop ebx
add esp, 0x38
ret 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub eax, dword [esi + 0x534]
sub ecx, dword [esi + 0x538]
jmp 0x442018
mov ecx, dword [esp + 0x14]
xor eax, eax
sub ecx, dword [esi + 0x538]
jmp 0x44201c

Function at 0x443590
Capabilities:
Hide graphical window

Disassembly:
push esi
lea esi, [edi + 0x40]
call fcn.00438860
mov eax, dword [edi + 0x294]
test eax, eax
pop esi
je 0x4435db
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4435db
mov eax, dword [edi + 0x294]
mov ecx, dword [eax + 4]
add eax, 4
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4435db
mov edx, dword [edi + 0x294]
mov eax, dword [edx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov dword [ebx], 0
ret
Function at 0x4435f0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x294]
test eax, eax
je 0x443631
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x443631
mov eax, dword [esi + 0x294]
mov ecx, dword [eax + 4]
add eax, 4
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x443631
mov edx, dword [esi + 0x294]
mov eax, dword [edx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x443640
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x3f2
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
jne 0x443705
xor eax, eax
cmp dword [ebx + 0x1bc], eax
sete al
mov esi, eax
call fcn.00418ae0
mov edi, dword [0x4d6b68]
mov dword [0x4d6b64], 1
mov dword [edi + 0xc44], esi
call fcn.00418ae0
call fcn.0041c3e0
test eax, eax
jne 0x443692
push edi
call fcn.00418b80
test esi, esi
mov dword [ebx + 0x1bc], esi
je 0x4436c8
lea edi, [ebx + 0x40]
call fcn.00438620
push 3
push 0x9f
lea esi, [ebx + 0x1c8]
call fcn.00429190
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
ret 8
cmp dword [ebx + 0x60], 0
je 0x4436e1
mov dword [ebx + 0x60], 0
call fcn.00434f10
mov ecx, eax
call fcn.004058f0
push 3
push 0x9e
lea esi, [ebx + 0x1c8]
call fcn.00429190
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
ret 8
cmp eax, 0x3f6
jne 0x443731
call fcn.00434f10
push eax
call fcn.00406a70
lea esi, [ebx + 0x40]
call fcn.00438580
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
ret 8
cmp eax, 0x3f7
jne 0x4437c4
cmp dword [ebx + 0x294], 0
jne 0x443776
push 0x8c
call fcn.0047f682
add esp, 4
test eax, eax
je 0x44375f
mov esi, eax
call fcn.0040e8e0
jmp 0x443761
xor eax, eax
test eax, eax
mov dword [ebx + 0x294], eax
je 0x443776
mov ecx, dword [ebx + 4]
push ecx
mov edi, eax
call fcn.00443930
mov eax, dword [ebx + 0x294]
test eax, eax
je 0x4437c4
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4437c4
mov eax, dword [ebx + 0x294]
add eax, 4
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4437b2
mov ecx, dword [ebx + 0x294]
mov edx, dword [ecx + 4]
push 0
push edx
jmp 0x4437be
mov eax, dword [ebx + 0x294]
mov ecx, dword [eax + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov dword [ebp], 0
mov eax, 1
pop ebp
ret 8
Function at 0x443f90
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
sub esp, 0x14
push ebx
push ebp
push edi
lea ebp, [esi + 0x20]
push eax
mov edi, ebp
call fcn.00444940
mov ecx, dword [esi + 0x24]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push ecx
call ebx
mov eax, dword [esi + 4]
push eax
lea edi, [esi + 0x1450]
mov dword [0x4d6bc4], eax
call fcn.00444a40
mov edx, dword [esi + 0x1454]
push 0
push edx
call ebx
mov eax, dword [esi + 4]
push eax
lea edi, [esi + 0x1544]
call fcn.00444ac0
mov ecx, dword [esi + 0x1548]
push 0
push ecx
call ebx
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x403
push edx
call edi
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esi + 0x1448], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
lea edx, [esp + 0x10]
push edx
push eax
call ebx
test eax, eax
je 0x44402e
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add eax, 1
add ecx, 1
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
mov eax, dword [esi + 0x1448]
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esi + 4]
push 0x402
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esi + 0x144c], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
test eax, eax
je 0x44409a
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push edx
push eax
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add eax, 1
add ecx, 1
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
mov eax, dword [esi + 0x144c]
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esi + 4]
push 0x412
push ecx
call edi
mov dword [esi + 0x1444], eax
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4440f5
mov eax, ebp
call fcn.0043d590
call fcn.004352b0
push 5
call fcn.00411200
push eax
push 5
push 0x4bcf70
lea edi, [esi + 0x1648]
call fcn.00415d20
add esp, 0x10
cmp dword [esi + 0x1644], 0
je 0x444146
mov eax, dword [esi + 4]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x24]
mov dword [ecx], 0
mov eax, 1
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov edx, dword [esp + 0x24]
pop edi
pop ebp
mov dword [edx], 0
mov eax, 1
pop ebx
add esp, 0x14
ret 4
Function at 0x446b20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0x194], eax
cmp byte [esi + 0x74], 0
jne 0x446b76
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x446b72
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x446b78
or eax, 0xffffffff
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0047f460
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x74], 1
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0047f460
mov esp, ebp
pop ebp
ret

Function at 0x446d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a1ef8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
push eax
push ecx
push ecx
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x2c]
mov edx, esp
mov dword [esp + 0x30], esp
push edx
mov ecx, edi
call fcn.0042f4b0
mov esi, dword [esp + 0x28]
call fcn.00446db0
mov esi, eax
lea eax, [edi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x446d92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0xc

Function at 0x446fd0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
push 0x10
push 0x81da
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x446ffa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x44703f
or eax, 0xffffffff
ret 4
mov edx, dword [esp + 4]
mov eax, dword [esi + 0x6c]
push edi
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test edi, edi
jne 0x44702d
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 0x68]
push 0x10
push ecx
push 0x81da
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
pop edi
ret 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x44703c
xor edi, edi
mov eax, edi
pop edi
ret 4
Function at 0x448d10
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, eax
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax*4]
sub ecx, eax
neg ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, 0xc
sub ecx, edx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
push ecx
xor esi, esi
call fcn.00482392
add esp, 4
cmp ebx, 2
mov ecx, eax
jle 0x448dfa
lea edx, [ebx - 3]
mov eax, 0xaaaaaaab
mul edx
push ebp
mov ebp, edx
shr ebp, 1
add ebp, 1
lea eax, [ebp*4]
sub eax, ebp
neg eax
add ebx, eax
mov dword [esp + 0x14], ebx
jmp 0x448d90
movzx eax, byte [edi]
movzx ebx, byte [edi + 1]
mov edx, eax
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
and eax, 3
shl eax, 4
mov edx, ebx
shr edx, 4
movzx eax, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], al
movzx eax, byte [edi + 2]
add esi, 1
mov edx, eax
shr edx, 6
and ebx, 0xf
movzx edx, byte [edx + ebx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add esi, 1
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
add esi, 1
mov byte [ecx + esi], al
add esi, 1
add edi, 3
sub ebp, 1
jne 0x448d90
mov ebx, dword [esp + 0x14]
pop ebp
test ebx, ebx
je 0x448e5c
movzx eax, byte [edi]
mov edx, eax
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 3
mov byte [ecx + esi], dl
add esi, 1
shl eax, 4
cmp ebx, 1
jle 0x448e42
movzx edx, byte [edi + 1]
mov edi, edx
shr edi, 4
mov al, byte [edi + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
add esi, 1
and edx, 0xf
mov dl, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
jmp 0x448e52
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
add esi, 1
mov byte [ecx + esi], 0x3d
add esi, 1
mov byte [ecx + esi], 0x3d
add esi, 1
mov eax, dword [esp + 0x14]
test eax, eax
mov byte [ecx + esi], 0
je 0x448e6a
mov dword [eax], esi
pop edi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x448ff0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x68]
push eax
call ebx
test eax, eax
jne 0x449078
mov esi, dword [esp + 0x14]
test esi, esi
je 0x44902b
push esi
call ebx
test eax, eax
je 0x44902b
mov eax, esi
mov dword [edi + 0x68], 0
push eax
mov dword [edi + 0x68], esi
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
lea esi, [edi + 0x108]
mov dword [eax], 0
call fcn.004495f0
test eax, eax
je 0x449078
mov ecx, dword [edi + 0x10c]
push ecx
call ebx
test eax, eax
je 0x449078
mov edx, dword [edi + 0x10c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x10c]
mov dword [edi + 0x68], 0
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
push eax
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x44a4f0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4d16b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x820], edi
call dword [section..data]
lea esi, [edi + 0x202]
test esi, esi
mov dword [ebp - 0x81c], eax
jne 0x44a534
mov dword [ebp - 0x818], esi
jmp 0x44a592
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jg 0x44a584
lea ebx, [eax + eax]
mov eax, ebx
call fcn.0048b020
mov edi, esp
test edi, edi
je 0x44a57e
mov eax, dword [ebp - 0x81c]
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push eax
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp - 0x814]
neg eax
sbb eax, eax
and eax, edi
jmp 0x44a586
mov ebx, dword [ebp - 0x814]
xor eax, eax
mov edi, dword [ebp - 0x820]
mov dword [ebp - 0x818], eax
add edi, 0x102
je 0x44a5ea
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jg 0x44a5ea
lea ebx, [eax + eax]
mov eax, ebx
call fcn.0048b020
mov esi, esp
test esi, esi
je 0x44a5e4
mov ecx, dword [ebp - 0x81c]
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push ecx
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp - 0x814]
neg eax
sbb eax, eax
and eax, esi
jmp 0x44a5ec
mov ebx, dword [ebp - 0x814]
xor eax, eax
mov edx, dword [ebp - 0x818]
push edx
mov edi, eax
lea esi, [ebp - 0x810]
call fcn.0044a1e0
mov eax, dword [ebp - 0x410]
mov edx, dword [ebx]
push 0
push eax
mov ecx, esi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x44a697
push 0x3ff
lea eax, [ebp - 0x407]
push 0
push eax
mov byte [ebp - 0x408], 0
call fcn.004854b0
mov edx, dword [ebx]
add esp, 0xc
push 0
push 0x400
lea ecx, [ebp - 0x408]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 2
jge 0x44a671
mov esi, dword [ebx]
test esi, esi
mov edi, 0xffffffa2
je 0x44a66d
push 1
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x44a6b2
xor eax, eax
cmp byte [ebp - 0x407], al
sete al
test eax, eax
je 0x44a690
mov eax, dword [ebp - 0x820]
push eax
mov ecx, ebx
call fcn.0044a2a0
jmp 0x44a6b8
mov eax, 0xffffffa5
jmp 0x44a6b8
mov esi, dword [ebx]
test esi, esi
je 0x44a6ad
push 1
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffa1
mov dword [ebx], 0xffffffff
lea esp, [ebp - 0x830]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f460
mov esp, ebp
pop ebp
ret
Function at 0x44a6d0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x414
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebp
push edi
push 0
push 4
lea eax, [esp + 0x14]
mov edi, ecx
mov ecx, dword [esi]
push eax
push ecx
mov byte [esp + 0x1c], 5
mov byte [esp + 0x1d], 2
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 2
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x44a7d3
push 0x3ff
lea edx, [esp + 0x15]
push 0
push edx
mov byte [esp + 0x1c], 0
call fcn.004854b0
mov ecx, dword [esi]
add esp, 0xc
push 0
push 0x400
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 2
jge 0x44a76b
mov edi, dword [esi]
test edi, edi
mov ebp, 0xffffffa2
je 0x44a764
push 1
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebp
jmp 0x44a7ee
mov al, byte [esp + 0x11]
test al, al
je 0x44a797
cmp al, 2
jne 0x44a7b6
mov edx, edi
mov ecx, esi
call fcn.0044a4f0
pop edi
pop ebp
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0047f460
add esp, 0x414
ret
push edi
mov ecx, esi
call fcn.0044a2a0
pop edi
pop ebp
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0047f460
add esp, 0x414
ret
mov edi, dword [esi]
test edi, edi
je 0x44a7cc
push 1
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffa3
jmp 0x44a7ee
mov edi, dword [esi]
test edi, edi
je 0x44a7e9
push 1
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffa1
mov ecx, dword [esp + 0x414]
pop edi
pop ebp
xor ecx, esp
mov dword [esi], 0xffffffff
call fcn.0047f460
add esp, 0x414
ret
Function at 0x44a810
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
call dword [section..data]
cmp word [ebx], 0
je 0x44a92b
cmp word [ebx + 0x100], 0
je 0x44a92b
cmp word [ebx + 0x282], 0
je 0x44a92b
cmp word [ebx + 0x382], 0
je 0x44a92b
mov esi, dword [ebp]
cmp esi, 0xffffffff
je 0x44a873
call fcn.0044b0f0
mov dword [ebp], 0xffffffff
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebp], eax
jne 0x44a8a0
mov eax, 0xffffff9d
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0047f460
add esp, 0x1c
ret 4
mov esi, eax
call fcn.0044b110
movzx eax, word [ebx + 0x100]
push eax
mov ecx, ebx
lea edi, [esp + 0x18]
call fcn.00449970
add esp, 4
test eax, eax
jne 0x44a912
mov edx, dword [ebp]
push 0x10
mov ecx, edi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x44a8f9
mov ecx, ebx
mov esi, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
call fcn.0044a6d0
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0047f460
add esp, 0x1c
ret 4
mov eax, 0xffffffa0
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0047f460
add esp, 0x1c
ret 4
mov eax, 0xffffff9f
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0047f460
add esp, 0x1c
ret 4
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 0xffffff9c
call fcn.0047f460
add esp, 0x1c
ret 4
Function at 0x44b050
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0x10], eax
xor eax, eax
push ebx
push ebp
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x20]
push eax
xor ebp, ebp
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
test esi, esi
mov word [esp + 0xa], ax
jne 0x44b094
xor ebx, ebx
jmp 0x44b0c6
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
test ebx, ebx
je 0x44b0a6
cmp ebx, 0xffffffff
jne 0x44b0c6
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x44b0ba
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov ebx, dword [edx]
jmp 0x44b0c6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
test ebp, ebp
jne 0x44b0df
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, ebp
mov ecx, dword [esp + 0x18]
pop ebp
pop ebx
xor ecx, esp
call fcn.0047f460
add esp, 0x14
ret

Function at 0x44b110
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, 0x1388
push 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x1005
push 0xffff
push esi
call edi
cmp dword [esp + 4], 0
je 0x44b156
push 4
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push esi
call edi
xor eax, eax
pop edi
add esp, 8
ret

Function at 0x44d8c0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
call fcn.00483d0a
add esp, 8
push 1
call fcn.00483bee
int3
Function at 0x44e620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a156b
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esi], edi
mov dword [ecx], edi
push 0x4ac230
xor ebx, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
mov dword [edx], edi
call fcn.00405240
mov dword [esp + 0x10], edi
mov dword [esp + 0xc8], edi
push edi
mov eax, connect
lea edi, [esp + 0x14]
call fcn.0044eb30
add esp, 4
test eax, eax
jge 0x44e6b9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44e6b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x44e753
push 0x90
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004854b0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x90
lea edx, [esp + 0x30]
push edx
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44e70d
call fcn.00405370
test eax, eax
jge 0x44e717
test ebx, ebx
je 0x44e709
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x44e753
cmp dword [esp + 0x14], 0x90
jne 0x44e6fe
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov dword [edx], ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x30]
mov dword [ecx], eax
call fcn.004051b0
cmp dword [esi], 0
je 0x44e6fe
test ebx, ebx
je 0x44e74e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.0047f460
mov esp, ebp
pop ebp
ret