joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4631d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x463288
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00463164
test al, al
je 0x46326a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403c8c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x46326a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fe8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00403fe8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403d5c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x463223
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46328f
lea eax, [ebp - 0x2c]
call fcn.00403ba8
lea eax, [ebp - 0xc]
call fcn.00403ba8
ret

Function at 0x463298
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 8
call fcn.00402bd8
lea eax, [ebx + 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.00403fe8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.00462e28
mov byte [ebx], al
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x46343c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4634cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00462df8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403fe8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4634b7
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x54d504]
call fcn.00405c00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x462ca8]
call fcn.0040baa8
call fcn.0040361c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4634d4
lea eax, [ebp - 0x10]
call fcn.00403ba8
ret
Function at 0x4634e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46357b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403fe8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x463555
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x54d8d0]
call fcn.00405c00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x462ca8]
call fcn.0040baa8
call fcn.0040361c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00462e28
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463582
lea eax, [ebp - 0x10]
call fcn.00403ba8
ret

Function at 0x464430
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
test byte [ebx + 0x20], 0x10
jne 0x4644c3
cmp byte [ebx + 0xbb], 0
jne 0x4644c3
mov byte [ebx + 0xbb], 1
cmp byte [ebx + 0xbd], 0
je 0x464481
cmp word [ebx + 0x102], 0
je 0x464481
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x464481
lea edx, [ebx + 0xc0]
mov eax, dword [ebx + 0x104]
call dword [ebx + pe_nt_image_headers32]
mov eax, dword [0x54d5d4]
mov eax, dword [eax]
call fcn.0043ae70
push 6
mov eax, dword [0x54d5d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x54d5d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebx + 0xb8], 0
jne 0x4644c3
mov dl, 1
mov eax, ebx
call fcn.0046453c
pop ebx
pop ebp
ret
Function at 0x464a18
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x464bfa
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbb], 0
je 0x464bfa
mov eax, dword [ebp - 4]
cmp byte [eax + 0x8c], 0
jne 0x464bfa
xor eax, eax
push ebp
push 0x464bf3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x8c], 1
mov byte [ebp - 5], 0
mov byte [ebp - 7], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x122], 0
je 0x464a95
lea ecx, [ebp - 7]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x124]
call dword [ebx + 0x120]
cmp byte [ebp - 7], 0
jne 0x464aa5
call fcn.004036bc
jmp 0x464bfa
mov al, byte [ebp - 7]
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0xbd], 0
je 0x464b05
mov eax, dword [ebp - 4]
cmp word [eax + 0x10a], 0
je 0x464b05
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
call fcn.00403e24
test eax, eax
jle 0x464b05
mov byte [ebp - 6], 0
lea ecx, [ebp - 6]
mov eax, dword [ebp - 4]
lea edx, [eax + 0xc0]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x10c]
call dword [ebx + 0x108]
cmp byte [ebp - 6], 0
jne 0x464b05
call fcn.004036bc
jmp 0x464bfa
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb8], 0
jne 0x464b2a
push 0
push 0
push 0x6d81
mov eax, dword [0x54d5d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_PostMessageA
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_LockWindowUpdate
xor eax, eax
push ebp
push 0x464bd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x54d5d4]
mov eax, dword [eax]
call fcn.0043aeb8
push 9
mov eax, dword [0x54d5d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x431560]
call fcn.004030d4
mov dl, 1
call fcn.004351c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x431560]
call fcn.004030d4
call fcn.00447134
mov dl, 1
call fcn.00456ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464bdb
mov eax, dword [ebp - 4]
mov byte [eax + 0xbb], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0xfa], 0
je 0x464bcc
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
push 0
call sub.user32.dll_LockWindowUpdate
ret
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x465cf8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x465daf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403fe8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x465d3a
call fcn.004036bc
jmp 0x465db6
mov eax, ebx
call fcn.00402714
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00403fe8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x465d63
call fcn.004036bc
jmp 0x465db6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x465dc0
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x465d84
call fcn.004036bc
jmp 0x465db6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465db6
mov eax, dword [ebp - 8]
call fcn.0040272c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46607c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ecx, ecx
push ebp
push 0x4660c1
push dword fs:[ecx]
mov dword fs:[ecx], esp
or edx, 0x4008
push edx
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4660cd
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4660d8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x466128
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x466134
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466280
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
xor eax, eax
push ebp
push 0x46642d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46643c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x466414
xor eax, eax
push ebp
push 0x46640d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.00466234
mov eax, dword [ebp - 0x168]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x168]
call fcn.00466234
mov eax, dword [ebp - 0x168]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00422cec
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00422cec
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00422cec
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00422cec
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x549f38], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466414
cmp dword [ebp - 4], 0
je 0x46640c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466434
lea eax, [ebp - 0x168]
call fcn.00403ba8
ret

Function at 0x466448
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
xor edx, edx
mov dword [ebp - 0x164], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4664e3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00465cec
test al, al
je 0x46648d
cmp dword [0x54f918], 0x40047
jl 0x46648d
cmp byte [0x549f38], 0
jne 0x46648d
call fcn.00466280
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x549f3c]
or eax, 0x4000
push eax
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
lea eax, [ebp - 0x164]
call fcn.00466234
mov eax, dword [ebp - 0x164]
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4664ea
lea eax, [ebp - 0x164]
call fcn.00403ba8
ret
Function at 0x467718
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46776b
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4000
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0x90
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467777
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x467780
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4677d0
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0x4010
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00403fe8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4677dc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f990
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46fa68
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x54f9e0], 0
jne 0x46fa4c
lea eax, [ebp - 4]
mov edx, 0x46fa80
call fcn.00403c40
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fe8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x46fa4c
mov eax, ebx
call fcn.00402714
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46fa45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46fa2f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46fa90
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46fa2f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x54f9e0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fa4c
mov eax, dword [ebp - 0xc]
call fcn.0040272c
ret
mov ebx, dword [0x54f9e0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fa6f
lea eax, [ebp - 4]
call fcn.00403ba8
ret

Function at 0x481cbc
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x54fa08], 0
jne 0x481ce2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x481c40
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x54fa08], eax
pop ebp
ret
Function at 0x482ba4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0044755c
test al, al
je 0x482c01
cmp bl, 7
jne 0x482bdd
push 2
lea eax, [ebp - 2]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [ebp - 2]
sub edi, 0x30
jmp 0x482be2
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
test eax, eax
je 0x482c01
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc0]
mov edx, edi
call fcn.00423544
mov byte [esi + 0x204], bl
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48c8b8
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x48c9c3
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x33c], esi
inc esi
jne 0x48c8fc
lea ecx, [ebp - 0x18]
mov dx, 0x2733
mov eax, edi
call fcn.0048de98
mov dl, 1
mov eax, edi
call fcn.0048a158
mov byte [edi + 0x340], 1
mov byte [edi + 0x1361], 1
lea eax, [ebp - 0x12]
mov edx, 0x48c9dc
call fcn.0040987c
push eax
call sub.wsock32.dll_inet_addr
mov dword [edi + 0x2b8], eax
mov word [edi + 0x2b4], 2
mov ax, word [edi + 0xf0]
push eax
call sub.wsock32.dll_htons
mov word [edi + 0x2b6], ax
mov byte [edi + 0x120], 0
push 0x10
lea eax, [edi + 0x2b4]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_bind
test bl, bl
je 0x48c985
push 8
push 0x466
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x48c99f
push 8
push 0x465
mov eax, dword [edi + 0x344]
push eax
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 1
mov eax, dword [edi + 0x33c]
push eax
call sub.wsock32.dll_listen
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c9ca
lea eax, [ebp - 0x18]
call fcn.00403ba8
ret

Function at 0x48cfa8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x33c]
cmp eax, 0xffffffff
jne 0x48cfcb
or esi, 0xffffffff
jmp 0x48d086
or esi, 0xffffffff
cmp byte [ebx + 0x2eb], 0
je 0x48d077
cmp byte [ebx + 0x301], 0
jne 0x48cfed
cmp byte [ebx + 0x310], 0
jne 0x48d009
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54d61c]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
jmp 0x48d086
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x48d06e
mov edx, dword [ebp - 4]
push edx
push edi
push eax
mov eax, dword [0x54d61c]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x48d069
cmp dword [ebp - 8], 0xfa0
jg 0x48d06e
mov eax, dword [ebx + 0x2ec]
test eax, eax
je 0x48d06e
push esi
push eax
mov eax, dword [0x54d800]
mov eax, dword [eax]
call eax
add esp, 8
test eax, eax
je 0x48d06e
cmp eax, 5
je 0x48d06e
inc dword [ebp - 8]
mov dx, 2
mov eax, ebx
call fcn.0048e48c
cmp esi, 0xffffffff
je 0x48d00e
test esi, esi
jne 0x48d086
or esi, 0xffffffff
jmp 0x48d086
push 0
mov edx, dword [ebp - 4]
push edx
push edi
push eax
call sub.wsock32.dll_recv
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48d090
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x33c]
cmp eax, 0xffffffff
jne 0x48d0b1
or esi, 0xffffffff
jmp 0x48d11b
cmp byte [ebx + 0x2eb], 0
je 0x48d109
xor edi, edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54d368]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jg 0x48d11b
cmp edi, 0x14
jg 0x48d11b
push esi
mov eax, dword [ebx + 0x2ec]
push eax
mov eax, dword [0x54d800]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x48d11b
je 0x48d11b
sub eax, 4
je 0x48d11b
dec eax
je 0x48d11b
inc edi
jmp 0x48d0bc
push 0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
call sub.wsock32.dll_send
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x48dce0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, eax
xor eax, eax
push ebp
push 0x48de70
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x48dd22
cmp byte [esi + 0x1360], 0
je 0x48dd15
mov byte [esi + 0xe5], 1
jmp 0x48dd1c
mov byte [esi + 0xe5], 2
mov byte [esi + 0xe6], dl
test dl, dl
je 0x48dd36
cmp byte [esi + 0x1360], 0
je 0x48dd36
mov byte [esi + 0x2f0], 1
mov byte [esi + 0x1361], 0
mov byte [esi + 0x1360], 0
mov byte [esi + 0x2eb], 0
mov eax, dword [esi + 0x2ec]
test eax, eax
je 0x48dddc
push 3
push eax
mov eax, dword [0x54d714]
mov eax, dword [eax]
call eax
add esp, 8
mov eax, dword [esi + 0x2ec]
push eax
mov eax, dword [0x54d1c8]
mov eax, dword [eax]
call eax
pop ecx
mov eax, dword [esi + 0x2ec]
push eax
mov eax, dword [0x54d1c8]
mov eax, dword [eax]
call eax
pop ecx
mov eax, dword [esi + 0x2ec]
push eax
mov eax, dword [0x54d820]
mov eax, dword [eax]
call eax
pop ecx
xor eax, eax
mov dword [esi + 0x2ec], eax
push 0x3f
push 0x465
mov eax, dword [esi + 0x344]
push eax
mov eax, dword [esi + 0x33c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, esi
call fcn.0048f44c
test eax, eax
jle 0x48dddc
push esi
push 0
push 0x468
mov eax, dword [esi + 0x344]
push eax
call sub.user32.dll_SendMessageA
cmp byte [esi + 0x310], 1
jne 0x48de0d
mov word [ebp - 4], 0
mov word [ebp - 2], 0x64
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
mov eax, dword [esi + 0x33c]
push eax
call sub.wsock32.dll_setsockopt
cmp dword [esi + 0x33c], 0xffffffff
je 0x48de5a
cmp byte [esi + 0x340], 0
je 0x48de5a
mov eax, esi
call fcn.0048cc14
mov eax, esi
call fcn.0048f48c
test al, al
je 0x48de4c
test bl, bl
jne 0x48de5a
test byte [esi + 0x20], 8
jne 0x48de5a
cmp word [esi + 0x56], 0
je 0x48de5a
mov edx, esi
mov eax, dword [esi + 0x58]
call dword [esi + 0x54]
jmp 0x48de5a
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, esi
call fcn.0048de98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48de77
lea eax, [ebp - 8]
call fcn.00403ba8
ret