joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4326bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x4326ed
je 0x432747
sub eax, 7
je 0x43270e
dec eax
je 0x432738
sub eax, 0x17
je 0x4327ec
jmp 0x43282a
add eax, 0xffffff00
sub eax, 9
jb 0x4327d8
add eax, 0xffffff09
sub eax, 0xb
jb 0x4327a0
jmp 0x43282a
mov eax, ebx
call fcn.0041c018
mov edi, eax
test edi, edi
je 0x43288a
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x432893
jmp 0x43288a
test byte [ebx + 0x44], 0x20
jne 0x432893
jmp 0x43288a
mov edx, esi
mov eax, ebx
call fcn.0042fc34
cmp dword [esi + 0xc], 0xffffffff
jne 0x432893
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.0044e72c
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0042e770
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00432594
test eax, eax
je 0x432893
mov dword [esi + 0xc], 1
jmp 0x432893
mov edx, esi
mov eax, ebx
call fcn.00432628
test al, al
je 0x43288a
cmp dword [esi + 0xc], 0
jne 0x432893
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00434d24
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x432893
mov eax, ebx
call fcn.0042f2d0
test al, al
jne 0x432893
jmp 0x43288a
mov eax, ebx
call fcn.00434d24
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x43288a
cmp dword [0x46a4e8], 0
je 0x43288a
mov eax, dword [0x46a4e8]
cmp ebx, dword [eax + 0x24]
jne 0x43288a
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x46a4e8]
call fcn.0042fb68
jmp 0x43288a
mov eax, dword [0x46ed24]
cmp byte [eax + 0x20], 0
je 0x43288a
mov eax, dword [0x46ed24]
cmp dword [eax + 0x1c], 0
je 0x43288a
mov eax, dword [esi]
mov edx, dword [0x46ed24]
cmp eax, dword [edx + 0x1c]
jne 0x43288a
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0041bf5c
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00456070
jmp 0x432893
mov edx, esi
mov eax, ebx
call fcn.0042fc34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432d54
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x432d70
cmp dword [esi + 4], 0
je 0x432d9d
test byte [ebx + 0x45], 1
jne 0x432d8f
mov eax, ebx
call fcn.00431c04
test eax, eax
jne 0x432d8f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x432ead
mov edx, esi
mov eax, ebx
call fcn.004329cc
jmp 0x432ead
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x432ea6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00434d24
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042fb68
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00432d54
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00434d24
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432ead
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c2a8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43c380
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46eda8], 0
jne 0x43c364
lea eax, [ebp - 4]
mov edx, 0x43c398
call fcn.00456b88
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00456f34
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x43c364
mov eax, ebx
call fcn.0045583c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43c35d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x43c347
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x43c3a8
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x43c347
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x46eda8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c364
mov eax, dword [ebp - 0xc]
call fcn.00455854
ret
mov ebx, dword [0x46eda8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c387
lea eax, [ebp - 4]
call fcn.00456af0
ret

Function at 0x442c94
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x46edcc], 0
jne 0x442cb7
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x442c18
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x46edcc], eax
ret

Function at 0x44a85c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jne 0x44a871
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4513d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x45140d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00456bd8
jmp 0x451416
mov eax, ebx
mov edx, esi
call fcn.00456b44
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x451420
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x451441
mov al, byte [esp]
jmp 0x451443
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x455d04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46a8dc]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x455d9c
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x455d7c
xor eax, eax
push ebp
push 0x455d75
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x455db8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455d7c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x46a8dc]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46a8dc], ax
mov esp, ebp
pop ebp
ret

Function at 0x456aa4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0045583c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46f061], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x456a6c
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x458020
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4581dc
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x458081
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4581f8
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4580f3
xor eax, eax
push ebp
push 0x4580ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00457e78
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4580d5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x458218
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4580f3
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4581d4
cmp byte [ebp - 0xd], 0
jne 0x458135
cmp byte [ebp - 0x12], 0
je 0x4581d4
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x45814e
dec ebx
cmp byte [ebx], 0x2e
je 0x45815d
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x45814d
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4581d4
inc ebx
cmp byte [ebp - 0x12], 0
je 0x45818a
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4581d4
cmp byte [ebp - 0xd], 0
je 0x4581d4
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4581d4
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4585f8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x4586e0
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x46f444], 1
jae 0x4586d2
xor eax, eax
mov dword [0x46f050], eax
xor eax, eax
mov dword [0x46f058], eax
xor eax, eax
mov dword [0x46f05c], eax
mov byte [0x46f062], 2
mov byte [0x46f063], 2
mov byte [0x46f064], 3
mov word [0x46f40c], 0
mov word [0x46f41c], 1
mov word [0x46f42c], 0xa
mov dword [0x46f434], 0x80020004
mov dword [0x46f400], 0x4577b4
mov dword [0x46f404], 0x4577ac
mov dword [0x46f408], 0x4577b4
call fcn.00455cd4
test al, al
je 0x458691
call fcn.00455d04
call fcn.00455dc8
mov eax, 0x46f068
mov edx, 0x4586ec
call fcn.00453592
mov eax, 0x46f234
mov edx, 0x4586ec
call fcn.00453592
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x46f048], eax
call fcn.004544f8
mov dword [0x46f044], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x46f03c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4586e7
ret

Function at 0x459580
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4596bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4596d4
mov dl, 4
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOn_qqrv
xor edx, edx
push ebp
push 0x45969f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x45963e
test si, si
jne 0x4595f0
mov eax, dword [ebp - 8]
call fcn.00450b7c
mov esi, eax
cmp esi, 0xffff
jbe 0x4595f0
call fcn.00455dd4
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x45963e
cmp eax, 0xffffffff
jle 0x45961f
sub ebx, eax
jmp 0x45962e
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
test ebx, ebx
je 0x45963e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x4595f3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x459689
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x4596ec
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_EAbortError_]
call fcn.00451b68
call fcn.004565ec
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x459689
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4596a6
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_TimerOff_qqrv
ret
Function at 0x459800
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x459996
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4599ac
lea edx, [ebp - 0xc]
movzx eax, si
call fcn.004507bc
push dword [ebp - 0xc]
push 0x4599bc
lea eax, [ebp - 8]
mov edx, 3
call fcn.00456e30
mov ecx, dword [ebp - 8]
mov dl, 8
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
test si, si
jne 0x4598a1
push 2
push 0x10000
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
cmp eax, 0xffffffff
jne 0x459890
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [ebp - 4]
call fcn.00456af0
jmp 0x4598f7
mov esi, eax
cmp esi, 0xffff
jbe 0x4598f7
call fcn.00455dd4
jmp 0x4598f7
push 2
push 0x10000
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
movzx edx, si
cmp eax, edx
jge 0x4598f7
test eax, eax
jne 0x4598d1
mov eax, dword [ebp - 4]
call fcn.00456af0
jmp 0x45997b
inc eax
jne 0x4598e2
lea ecx, [ebp - 0x14]
mov dx, 0x2733
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
cmp byte [ebx + 0x10088], 0
je 0x4598a1
cmp byte [ebx + 0x10088], 0
jne 0x459946
movzx edi, si
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0045705c
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.00456f40
mov edx, 1
dec edx
cmp edx, dword [eax - 4]
jb 0x459928
call fcn.00455dd4
inc edx
lea eax, [eax + edx - 1]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov edx, dword [ebp - 4]
xchg edx, eax
call fcn.0045705c
jmp 0x45997b
mov byte [ebx + 0x10088], 0
mov ecx, 0x4599c8
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_EAbortError_]
call fcn.00451b68
call fcn.004565ec
cmp word [ebx + 0x10282], 0
je 0x45997b
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45999d
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00456b14
ret
Function at 0x459db4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00456f24
xor eax, eax
push ebp
push 0x459f71
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x459f88
mov dl, 8
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4442e4]
call fcn.004477d8
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x459f01
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x459ec5
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, 0x10000
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov esi, eax
mov ebx, esi
push 0
push ebx
mov eax, esi
sub eax, ebx
cmp eax, 0x10000
jbe 0x459e49
call fcn.00455dd4
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 0x24]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x459ec5
cmp eax, 0xffffffff
jle 0x459e96
sub ebx, eax
mov edx, dword [ebp - 4]
add dword [edx + 0x10084], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x100c2], 0
je 0x459ea5
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x100c4]
call dword [edi + 0x100c0]
jmp 0x459ea5
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
test ebx, ebx
je 0x459ec5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x459e36
mov eax, dword [ebp - 0xc]
call fcn.004475b4
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.004475d0
cmp ebx, eax
je 0x459eeb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x459e0f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459f08
mov eax, dword [ebp - 0xc]
call fcn.00455e94
ret
Function at 0x459fb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a131
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45a148
mov dl, 8
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004475c4
cmp byte [ebx + 0x10088], 0
jne 0x45a0dd
xor eax, eax
mov dword [ebx + 0x10084], eax
mov eax, dword [ebp - 4]
call fcn.004475d0
mov dword [ebx + 0x100b0], eax
mov eax, dword [ebp - 4]
call fcn.004475d0
push eax
mov eax, dword [ebp - 4]
call fcn.004475b4
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jle 0x45a02c
mov eax, 0x10000
lea edx, [ebx + 0x24]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x45a053
call fcn.00455dd4
lea eax, [ebx + eax + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x45a11b
test eax, eax
jle 0x45a093
sub esi, eax
add dword [ebx + 0x10084], eax
cmp word [ebx + 0x100c2], 0
je 0x45a0a1
mov edx, ebx
mov eax, dword [ebx + 0x100c4]
call dword [ebx + 0x100c0]
jmp 0x45a0a1
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
test esi, esi
je 0x45a0ba
cmp byte [ebx + 0x10088], 0
je 0x45a03f
mov eax, dword [ebp - 4]
call fcn.004475d0
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004475b4
cmp esi, eax
je 0x45a0dd
cmp byte [ebx + 0x10088], 0
je 0x45a00b
cmp byte [ebx + 0x10088], 0
je 0x45a11b
mov byte [ebx + 0x10088], 0
mov ecx, 0x45a15c
mov dl, 1
mov eax, dword [sym.Strm.exe__Psock_EAbortError_]
call fcn.00451b68
call fcn.004565ec
cmp word [ebx + 0x10282], 0
je 0x45a11b
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a138
lea eax, [ebp - 0xc]
call fcn.00456af0
ret
Function at 0x45a170
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00456f24
xor eax, eax
push ebp
push 0x45a306
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45a31c
mov dl, 8
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4442e4]
call fcn.004477d8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45a296
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004475d0
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004475c4
jmp 0x45a264
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
jle 0x45a246
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00447640
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x45a258
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100bc]
call dword [ebx + 0x100b8]
jmp 0x45a258
inc ebx
jne 0x45a258
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.Strm.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x46e844]
mov eax, dword [eax]
call fcn.00424674
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10290], 0
je 0x45a280
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45a1e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a29d
mov eax, dword [ebp - 0xc]
call fcn.00455e94
ret