joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48edf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x51e160], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x48e840
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x48eb30
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.0048e7f0
je 0x48ee62
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x51b020]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004a998e
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x48ef5f
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.004ab87b
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.004aabef
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x48eedd
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x48ef24
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.004ab87b
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.004aabef
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x48ef5b
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x48ef8f
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x48ef8f
add edi, 1
cmp edi, 3
jl 0x48ef26
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x51b020], edx
mov dword [0x51b028], eax
mov dword [fcn.0048e7f0], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x51b020]
xor ecx, esp
mov dword [0x51e160], 1
call fcn.004a998e
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x48ef5b
Function at 0x48f530
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
test esi, esi
push edi
mov edi, ecx
je 0x48f5c7
mov eax, dword [edi + 0x34]
test eax, eax
je 0x48f563
push eax
call fcn.004993dd
add esp, 4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x48f568
sub eax, edx
add eax, 1
push eax
call fcn.004993b2
add esp, 4
test eax, eax
mov dword [edi + 0x34], eax
je 0x48f5c3
mov ecx, esi
mov edx, eax
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x48f590
push esi
lea eax, [esp + 0xc]
push str.Setting_agent_address_as:__s_n
push eax
mov dword [edi + 0x38], 0
call fcn.004aa842
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x48f5d7
push str.No_agent_address_set____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0xffffffcc
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.004a998e
add esp, 0x404
ret 4
Function at 0x4901f0
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
sub esp, 0x214
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.SNMPStartup_n
call edi
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov esi, eax
test esi, esi
je 0x49024b
push esi
lea ecx, [esp + 0x19c]
push str.SNMP_WSAStartup_MAKEWORD_2_2___failed__Error_d_n
push ecx
call fcn.004aa842
add esp, 0xc
lea edx, [esp + 0x198]
push edx
call edi
mov eax, esi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
call fcn.004a998e
add esp, 0x214
ret

Function at 0x490290
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x214
push 0xffffffffffffffff
push 0x4c5b70
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x51c080]
xor eax, ebp
mov dword [ebp + 0x210], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp]
push eax
mov esi, ecx
xor edi, edi
push 0x202
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], edi
call dword [sym.imp.WSOCK32.dll_WSAStartup]
cmp eax, edi
je 0x49032a
push eax
lea ecx, [ebp + 0x190]
push str.SNMP_WSAStartup_MAKEWORD_2_2___failed__Error_d_n
push ecx
call fcn.004aa842
add esp, 0xc
push 0x502140
lea eax, [ebp - 0x18]
lea edx, [ebp + 0x190]
push eax
mov dword [ebp - 0x18], edx
call fcn.004abd6e
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x490325
ret
push str.SNMPManager_Constructor_Called_n
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x210]
xor ecx, ebp
call fcn.004a998e
add ebp, 0x214
mov esp, ebp
pop ebp
ret
Function at 0x4903f0
Capabilities:
Check mutex on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x490402
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc
push ebp
push str.TrapServerFileMappingObject
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebp, eax
test ebp, ebp
jne 0x490424
pop ebp
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc
push ebx
push 0x620
push 0
push 0
push 0xf001f
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x490451
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc
push edi
push str.TS_SNMPSharedMemAccessMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x490484
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop ebp
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4904d8
mov eax, dword [esp + 0x18]
sub eax, 0x2329
je 0x4904ad
sub eax, 1
je 0x4904a9
or esi, 0xffffffff
jmp 0x4904c0
mov edi, ebx
jmp 0x4904b3
mov edi, dword [esp + 0x1c]
mov esi, ebx
mov ecx, 0x188
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
xor esi, esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4904cf
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4904dd
mov esi, 0xffffff9e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call edi
pop edi
pop ebx
pop ebp
mov eax, esi
pop esi
pop ecx
ret 0xc

Function at 0x491290
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
jne 0x49129e
call sym.Setup.exe_public:_int___thiscall_SNMPManager::unregister_void_
mov eax, dword [esi]
test eax, eax
mov dword [esi + 4], 0
je 0x4912ba
push eax
call fcn.004993dd
add esp, 4
mov dword [esi], 0
call dword [sym.imp.WSOCK32.dll_WSACleanup]
push str.SNMPManager_Destructor_Called_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
ret
Function at 0x498a2e
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x7c
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x78], eax
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x498b2d
push str.Attempting_to_open_socket
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x3e8
push 2
push 6
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x14], eax
jne 0x498a72
mov eax, 0xffffffc4
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004a998e
add esp, 0x7c
ret
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x10], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x498aaf
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, 0xffffffc3
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004a998e
add esp, 0x7c
ret
xor eax, eax
mov dword [esp + 8], eax
push 0x900f
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov word [esp + 0x18], ax
mov word [esp + 0xc], 6
call dword [sym.imp.WSOCK32.dll_htons]
cmp dword [0x51e170], 0
mov word [esp + 0x14], ax
jne 0x498b26
mov ecx, dword [esi + 0x14]
push 0xe
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
jne 0x498b26
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
lea edx, [esp + 0x1c]
push str.SNMPManager___IPX_Bind_Error____d_n
push edx
call fcn.004aa842
add esp, 0xc
mov eax, 0xffffffb2
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004a998e
add esp, 0x7c
ret
mov dword [esi + 0x18], 1
mov ecx, dword [esp + 0x7c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004a998e
add esp, 0x7c
ret
Function at 0x498be2
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x238
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x234], eax
mov edx, dword [esp + 0x244]
mov eax, dword [esp + 0x240]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x240]
mov dword [esp + 0x18], edx
xor edx, edx
cmp dword [esi + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
jne 0x498c1a
lea eax, [edx - 0x3e]
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004a998e
add esp, 0x238
ret 0xc
cmp ecx, edx
jne 0x498c3b
mov eax, 0xffffffb6
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004a998e
add esp, 0x238
ret 0xc
mov eax, dword [eax]
push ebx
mov ebx, 1
cmp dword [esi + 0xc], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x14]
push edi
mov edi, dword [esi + 0x10]
mov dword [esp + 0x24], 0xe
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], eax
jne 0x498c84
mov ecx, dword [esi + 8]
imul ecx, ecx, 0x3e8
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
jmp 0x498c8f
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
xor eax, eax
cmp edi, edx
push ebp
jl 0x498d3d
mov ebp, dword [sym.imp.WSOCK32.dll_select]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x134]
push edx
push 0
lea eax, [esp + 0x38]
push eax
push 0
call ebp
cmp eax, 0xffffffff
je 0x498cca
cmp eax, ebx
jne 0x498cca
mov ecx, dword [esp + 0x30]
cmp ecx, dword [esi + 0x14]
je 0x498cd7
sub edi, ebx
test edi, edi
mov eax, 0xffffffd3
jge 0x498ca0
jmp 0x498d3d
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x238]
push eax
mov eax, dword [esi + 0x14]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_recvfrom]
mov edi, eax
cmp edi, 0xffffffff
jne 0x498d06
lea eax, [edi - 0x2e]
jmp 0x498d3d
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x498d35
push 4
lea ecx, [esp + 0x23a]
push ecx
push ebx
mov ecx, esi
call sym.Setup.exe_private:_void___thiscall_OctetString::HtoA_char___char___int_
push 6
lea edx, [esp + 0x23e]
push edx
add ebx, 8
push ebx
mov ecx, esi
call sym.Setup.exe_private:_void___thiscall_OctetString::HtoA_char___char___int_
mov eax, dword [esp + 0x18]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [esp + 0x244]
pop ebp
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.004a998e
add esp, 0x238
ret 0xc
Function at 0x498f9b
Capabilities:
Get socket status
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x244
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [esp + 0x248]
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
mov dword [esp + 0xc], eax
jne 0x498fc5
mov eax, 0xffffffc2
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004a998e
add esp, 0x244
ret 8
test eax, eax
jne 0x498fe6
mov eax, 0xffffffbe
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004a998e
add esp, 0x244
ret 8
mov ecx, dword [esi + 0x14]
push ebp
push 4
lea eax, [esp + 0x18]
push eax
push 0x20
push 0xffff
mov ebp, 1
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x499015
lea eax, [ebp - 0x45]
jmp 0x49915d
push ebx
mov ebx, dword [esi + 0x10]
xor eax, eax
push edi
mov dword [esp + 0x228], eax
push 0x900f
xor edi, edi
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], eax
mov word [esp + 0x238], ax
mov word [esp + 0x22c], 6
call dword [sym.imp.WSOCK32.dll_htons]
mov edx, dword [str.00000000FFFFFFFFFFFFF]
mov ecx, dword [0x4d5858]
mov word [esp + 0x234], ax
mov eax, dword [0x4d5854]
mov dword [esp + 0x238], edx
mov edx, dword [0x4d585c]
mov dword [esp + 0x23c], eax
mov eax, dword [0x4d5860]
mov dword [esp + 0x240], ecx
mov cx, word [0x4d5864]
mov dword [esp + 0x244], edx
push 4
lea edx, [esp + 0x23c]
mov dword [esp + 0x24c], eax
push edx
lea eax, [esp + 0x232]
mov word [esp + 0x254], cx
push eax
mov ecx, esi
call sym.Setup.exe_private:_void___thiscall_OctetString::AtoH_char___char___unsigned_long_int_
push 6
lea ecx, [esp + 0x244]
push ecx
lea edx, [esp + 0x236]
push edx
mov ecx, esi
call sym.Setup.exe_private:_void___thiscall_OctetString::AtoH_char___char___unsigned_long_int_
cmp dword [esi + 0xc], ebp
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x124], ebp
mov dword [esp + 0x128], eax
jne 0x499109
mov eax, dword [esi + 8]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
jmp 0x499114
mov ecx, dword [esi + 8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
test ebx, ebx
jl 0x499159
jmp 0x499120
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
je 0x49914e
cmp eax, ebp
jne 0x49914e
mov edx, dword [esp + 0x24]
cmp edx, dword [esi + 0x14]
je 0x499176
sub ebx, ebp
test ebx, ebx
mov edi, 0xffffffbd
jge 0x499120
mov eax, edi
pop edi
pop ebx
mov ecx, dword [esp + 0x248]
pop ebp
pop esi
xor ecx, esp
call fcn.004a998e
add esp, 0x244
ret 8
mov ecx, dword [esp + 0x25c]
mov edx, dword [esp + 0x18]
push 0x10
lea eax, [esp + 0x22c]
push eax
mov eax, dword [esi + 0x14]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_sendto]
sub eax, 0xffffffff
neg eax
sbb eax, eax
and eax, 0x45
add eax, 0xffffffbb
jmp 0x49915b
Function at 0x4991b0
Capabilities:
Get socket status
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x22c
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [esp + 0x234]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
push edi
mov edi, dword [esp + 0x23c]
mov dword [esp + 0x18], eax
jne 0x4991ea
lea eax, [ebx - 0x3e]
jmp 0x499312
cmp eax, ebx
je 0x49935e
cmp edi, ebx
je 0x49935e
mov ecx, dword [esi + 0x14]
push 4
lea eax, [esp + 0x18]
push eax
push 0x20
push 0xffff
push ecx
mov dword [esp + 0x28], ebx
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x499225
mov eax, 0xffffffb8
jmp 0x499312
xor eax, eax
push ebp
mov ebp, dword [esi + 0x10]
mov dword [esp + 0x228], eax
push 0x900f
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], eax
mov word [esp + 0x238], ax
mov word [esp + 0x22c], 6
call dword [sym.imp.WSOCK32.dll_htons]
push 4
push edi
lea edx, [esp + 0x232]
push edx
mov ecx, esi
mov word [esp + 0x240], ax
call sym.Setup.exe_private:_void___thiscall_OctetString::AtoH_char___char___unsigned_long_int_
push 6
add edi, 8
push edi
lea eax, [esp + 0x236]
push eax
mov ecx, esi
call sym.Setup.exe_private:_void___thiscall_OctetString::AtoH_char___char___unsigned_long_int_
mov eax, dword [esi + 0x14]
mov edi, 1
cmp dword [esi + 0xc], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x124], edi
mov dword [esp + 0x128], eax
jne 0x4992c2
mov ecx, dword [esi + 8]
imul ecx, ecx, 0x3e8
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
jmp 0x4992cd
mov edx, dword [esi + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
test ebp, ebp
jl 0x49930f
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x4992f7
lea ebx, [eax - 0x46]
jmp 0x499309
cmp eax, edi
jne 0x499304
mov eax, dword [esp + 0x24]
cmp eax, dword [esi + 0x14]
je 0x49932c
mov ebx, 0xffffffb7
sub ebp, edi
test ebp, ebp
jge 0x4992d1
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a998e
add esp, 0x22c
ret 0xc
mov edx, dword [esp + 0x248]
mov eax, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x22c]
push ecx
mov ecx, dword [esi + 0x14]
push 0
push edx
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_sendto]
sub eax, 0xffffffff
neg eax
sbb eax, eax
and eax, 0x49
add eax, 0xffffffb7
jmp 0x499311
mov eax, 0xffffffba
jmp 0x499312
Function at 0x4991cc
Capabilities:
Get socket status
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x22c
mov eax, dword [0x51c080]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [esp + 0x234]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
push edi
mov edi, dword [esp + 0x23c]
mov dword [esp + 0x18], eax
jne 0x4991ea
lea eax, [ebx - 0x3e]
jmp 0x499312
cmp eax, ebx
je 0x49935e
cmp edi, ebx
je 0x49935e
mov ecx, dword [esi + 0x14]
push 4
lea eax, [esp + 0x18]
push eax
push 0x20
push 0xffff
push ecx
mov dword [esp + 0x28], ebx
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x499225
mov eax, 0xffffffb8
jmp 0x499312
xor eax, eax
push ebp
mov ebp, dword [esi + 0x10]
mov dword [esp + 0x228], eax
push 0x900f
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], eax
mov word [esp + 0x238], ax
mov word [esp + 0x22c], 6
call dword [sym.imp.WSOCK32.dll_htons]
push 4
push edi
lea edx, [esp + 0x232]
push edx
mov ecx, esi
mov word [esp + 0x240], ax
call sym.Setup.exe_private:_void___thiscall_OctetString::AtoH_char___char___unsigned_long_int_
push 6
add edi, 8
push edi
lea eax, [esp + 0x236]
push eax
mov ecx, esi
call sym.Setup.exe_private:_void___thiscall_OctetString::AtoH_char___char___unsigned_long_int_
mov eax, dword [esi + 0x14]
mov edi, 1
cmp dword [esi + 0xc], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x124], edi
mov dword [esp + 0x128], eax
jne 0x4992c2
mov ecx, dword [esi + 8]
imul ecx, ecx, 0x3e8
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
jmp 0x4992cd
mov edx, dword [esi + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
test ebp, ebp
jl 0x49930f
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x4992f7
lea ebx, [eax - 0x46]
jmp 0x499309
cmp eax, edi
jne 0x499304
mov eax, dword [esp + 0x24]
cmp eax, dword [esi + 0x14]
je 0x49932c
mov ebx, 0xffffffb7
sub ebp, edi
test ebp, ebp
jge 0x4992d1
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a998e
add esp, 0x22c
ret 0xc
mov edx, dword [esp + 0x248]
mov eax, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x22c]
push ecx
mov ecx, dword [esi + 0x14]
push 0
push edx
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_sendto]
sub eax, 0xffffffff
neg eax
sbb eax, eax
and eax, 0x49
add eax, 0xffffffb7
jmp 0x499311
mov eax, 0xffffffba
jmp 0x499312
Function at 0x49af74
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x4c6395
call fcn.004acd3d
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0049a770
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x49afbf
call fcn.0049a770
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x49afd0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x49afdd
or eax, 0xffffffff
jmp 0x49b139
mov ecx, esi
call fcn.0049aa99
mov dword [ebp - 0x14], eax
call fcn.0049dc2b
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x49b05b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x49b05b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x49b05b
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0049970c
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x49b05b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x49b05b
mov ecx, ebx
call fcn.004a0960
test eax, eax
je 0x49b05b
push 0
mov ecx, ebx
call fcn.004a097b
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0049f5fc
push dword [ebp - 0x14]
call fcn.0049db83
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0049ad7c
xor edi, edi
cmp eax, edi
je 0x49b0b8
test byte [esi + 0x3c], 0x10
je 0x49b0a2
push 4
pop edi
mov ecx, esi
call fcn.004a0876
test ax, 0x100
je 0x49b098
push 5
pop edi
push edi
mov ecx, esi
call fcn.0049d726
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x49b0b8
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004a09e2
or dword [ebp - 4], 0xffffffff
jmp 0x49b0e3
cmp dword [ebp - 0x28], edi
je 0x49b0f1
push 1
mov ecx, ebx
call fcn.004a097b
cmp dword [ebp - 0x2c], edi
je 0x49b101
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x49b11a
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x49b11a
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0049aad3
cmp dword [esi + 0x58], edi
je 0x49b136
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.004acda9
ret