joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4829a1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc18
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x4829bc
cmp byte [ebx], 0
jne 0x4829c6
mov eax, 1
jmp 0x482a4d
push 0x3e7
lea edx, [ebp - 0x3e8]
push edx
call fcn.0042e3f0
push esi
lea esi, [ebp - 0x3e8]
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp dword [0x55d2c0], 0
je 0x482a1c
cmp dword [esi + 0x540], 0
je 0x482a1c
lea eax, [ebp - 0x3e8]
push eax
call fcn.00415144
lea edx, [ebp - 0x3e8]
push edx
call fcn.0054c2d0
pop ecx
mov ebx, eax
push 0
push ebx
lea eax, [ebp - 0x3e8]
push eax
push dword [esi + 0x884]
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x482a48
xor eax, eax
jmp 0x482a4d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x487444
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [0x563c9c]
je 0x487471
push 0
push 0x9c7
call fcn.0042c564
push eax
call fcn.00486fc8
jmp 0x487560
mov edx, dword [ebp + 0xc]
shr edx, 0x10
test dx, 0xffff
je 0x487495
push 0
push 0x9c7
call fcn.0042c564
push eax
call fcn.00486fc8
jmp 0x487560
xor ecx, ecx
mov dword [0x563c9c], ecx
push 0
push 2
push 0
mov ax, word [0x561bee]
push eax
mov dx, word [0x561bec]
push edx
call fcn.004f196d
mov ebx, eax
mov dword [0x563c98], ebx
cmp ebx, 0xffffffff
jne 0x4874db
push 0
push 0x9c8
call fcn.0042c564
push eax
call fcn.00486fc8
jmp 0x487560
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0054c150
add esp, 0xc
mov word [ebp - 0x10], 2
push 0x4f
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
cmp esi, 0xffffffff
je 0x487506
mov dword [ebp - 0xc], esi
jmp 0x487515
mov eax, 0x57e758
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
push 0x10
push 0x8023
push dword [0x56cee8]
push dword [0x563c98]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [0x563c98]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x487560
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x487560
push 0
push 0x9c9
call fcn.0042c564
push eax
call fcn.00486fc8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x487568
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x487595
push 0
push 0x9c9
call fcn.0042c564
push eax
call fcn.00486fc8
jmp 0x4876db
cmp byte [0x57e690], 0
je 0x4875f7
push 0x57e6f4
push 0x57e690
push 0
push 0x9ca
call fcn.0042c564
push eax
lea edx, [ebp - 0x104]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [0x55f8a0]
lea ecx, [ebp - 0x104]
push ecx
push dword [0x56cf00]
call fcn.004ee447
push 0x57e690
push 0x563cdd
lea eax, [ebp - 0x104]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x487649
push 0x57e6f4
push 0
push 0x9cb
call fcn.0042c564
push eax
lea edx, [ebp - 0x104]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x55f8a0]
lea ecx, [ebp - 0x104]
push ecx
push dword [0x56cf00]
call fcn.004ee447
push 0x57e6f4
push str.__s_n
lea eax, [ebp - 0x104]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x55f89c]
push dword [0x56cf00]
call fcn.004ee341
push 0x64
push 0x57e690
call fcn.0042e3f0
push 0x64
push 0x57e6f4
call fcn.0042e3f0
push 0x3e7
push 0x57eb58
call fcn.0042e3f0
xor edx, edx
mov dword [0x57ef40], edx
push 0x21
push 0x8024
push dword [0x56cee8]
push dword [0x563c98]
call sub.WSOCK32.dll_WSAAsyncSelect
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054c2d0
pop ecx
mov ebx, eax
push 0
push ebx
lea eax, [ebp - 0x104]
push eax
push dword [0x563c98]
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x4876db
push 0
push 0x9cc
call fcn.0042c564
push eax
call fcn.00486fc8
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4876e2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, 0x57ef40
cmp dword [0x563c94], 0
jne 0x487709
push 0x563ce8
call fcn.00486fc8
jmp 0x4878b3
push 1
push 1
push dword [0x563c98]
push 0x8024
call fcn.00526a8c
test eax, eax
jne 0x4878b3
inc dword [0x563ca0]
cmp dword [0x563ca0], 0x14
jl 0x487757
xor eax, eax
mov dword [0x563ca0], eax
push 0
push 1
push dword [0x563c98]
push 0x8024
call fcn.00526a8c
test eax, eax
jne 0x4878b3
push 0
push 0x103
lea edx, [esp + 8]
push edx
push dword [0x563c98]
call sub.WSOCK32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
jne 0x48779c
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4878b3
push 0
push 0x9cd
call fcn.0042c564
push eax
call fcn.00486fc8
jmp 0x487884
test edi, edi
jle 0x48787a
mov byte [esp + edi], 0
xor ebp, ebp
mov ebx, esp
cmp edi, ebp
jle 0x487725
mov edx, dword [esi]
cmp edx, 0x3b5
jge 0x487838
mov al, byte [ebx]
cmp al, 0xd
je 0x48786b
cmp al, 0xa
jne 0x487800
test edx, edx
jne 0x4877db
mov ecx, dword [esi]
mov byte [ecx + 0x57eb58], 0x20
inc dword [esi]
mov eax, dword [esi]
mov byte [eax + 0x57eb58], 0
xor edx, edx
mov dword [esi], edx
push dword [0x55f8a4]
push 0x57eb58
push dword [0x56cf00]
call fcn.004ee447
jmp 0x48786b
cmp byte [ebx], 9
jne 0x48782a
xor eax, eax
jmp 0x48780c
add eax, 8
cmp eax, dword [esi]
jle 0x487809
sub eax, dword [esi]
xor edx, edx
cmp eax, edx
jle 0x48786b
mov ecx, dword [esi]
mov byte [ecx + 0x57eb58], 0x20
inc dword [esi]
inc edx
cmp eax, edx
jg 0x487818
jmp 0x48786b
mov eax, dword [esi]
mov dl, byte [ebx]
mov byte [eax + 0x57eb58], dl
inc dword [esi]
jmp 0x48786b
cmp dword [esi], 0
jne 0x487848
mov ecx, dword [esi]
mov byte [ecx + 0x57eb58], 0x20
inc dword [esi]
mov eax, dword [esi]
mov byte [eax + 0x57eb58], 0
xor edx, edx
mov dword [esi], edx
push dword [0x55f8a4]
push 0x57eb58
push dword [0x56cf00]
call fcn.004ee447
inc ebp
inc ebx
cmp edi, ebp
jg 0x4877b4
jmp 0x487725
push 0x563cec
call fcn.00486fc8
push dword [0x55f89c]
push dword [0x56cf00]
call fcn.004ee341
push dword [0x55f8a0]
push 0
push 0x9ce
call fcn.0042c564
push eax
push dword [0x56cf00]
call fcn.004ee447
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x487cf8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
or eax, 0xffffffff
mov dword [0x563d04], eax
mov dword [0x563d00], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x563d00], eax
cmp eax, 0xffffffff
jne 0x487d22
push 0
call fcn.00487c5c
ret
push 0x4f
push dword [0x563d00]
call fcn.004f18ad
test eax, eax
jne 0x487d3b
push 0
call fcn.00487c5c
ret
push 5
push dword [0x563d00]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x487d54
push 0
call fcn.00487c5c
ret
push 8
push 0x802e
push dword [0x56cee8]
push dword [0x563d00]
call sub.WSOCK32.dll_WSAAsyncSelect
ret
Function at 0x48823a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, 0x57f0ac
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x488406
cmp ax, 0x20
je 0x488406
mov eax, dword [0x563d04]
cmp eax, 0xffffffff
je 0x488406
cmp dword [0x563d00], 0xffffffff
je 0x488406
push 1
push 2
push eax
push 0x8030
call fcn.00526a8c
test eax, eax
jne 0x48840d
inc dword [0x563d08]
cmp dword [0x563d08], 0x14
jl 0x4882c7
xor ecx, ecx
mov dword [0x563d08], ecx
push 0
push 2
push dword [0x563d04]
push 0x8030
call fcn.00526a8c
test eax, eax
jne 0x48840d
cmp byte [ebx], 0
jne 0x4883a0
push dword [0x563cfc]
push 0x3e7
push ebx
call fcn.0054f860
add esp, 0xc
test eax, eax
je 0x488406
push ebx
call fcn.004acccf
test eax, eax
jne 0x488406
push ebx
call fcn.00487e12
test eax, eax
je 0x4883f6
push 0xa
push ebx
call fcn.0054c230
add esp, 8
test eax, eax
jne 0x488325
push 0x563d4d
push ebx
call fcn.0054c1f4
add esp, 8
push 0x563d50
push ebx
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x4883a0
push dword [0x563cfc]
call fcn.0054ff9c
pop ecx
mov edi, eax
mov esi, 1
jmp 0x48836c
push ebx
call fcn.004acccf
test eax, eax
jne 0x488384
push 0x563d53
push ebx
call fcn.0054c494
add esp, 8
test eax, eax
je 0x48836c
xor esi, esi
jmp 0x488384
push dword [0x563cfc]
push 0x3e7
push ebx
call fcn.0054f860
add esp, 0xc
test eax, eax
jne 0x48834c
push 0
push edi
push dword [0x563cfc]
call fcn.0054ff28
add esp, 0xc
test esi, esi
jne 0x4883f6
mov byte [ebx], 0xa
mov byte [ebx + 1], 0
push ebx
call fcn.0054c2d0
pop ecx
mov edi, eax
push 0
push ebx
call fcn.0054c2d0
pop ecx
push eax
push ebx
push dword [0x563d04]
call sub.WSOCK32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x4883d4
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x48840d
jmp 0x488406
cmp edi, esi
jle 0x4883f6
mov eax, ebx
add eax, esi
push eax
call fcn.0054c2d0
pop ecx
inc eax
push eax
add esi, ebx
push esi
push ebx
call fcn.0054c104
add esp, 0xc
jmp 0x488294
push 0x3e7
push ebx
call fcn.0042e3f0
jmp 0x488294
push 2
call fcn.00487c5c
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x488e7f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x488eb4
mov ebx, dword [0x563d58]
jmp 0x488e9f
mov ebx, dword [ebx + 0x80]
test ebx, ebx
je 0x488ea9
cmp dword [ebx + 0x6c], 0
jne 0x488e99
test ebx, ebx
jne 0x488eb4
xor eax, eax
jmp 0x488f96
cmp byte [esi], 0
je 0x488ec4
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x488ed6
push 1
push dword [ebx + 0x70]
push ebx
call fcn.004889b8
xor eax, eax
jmp 0x488f96
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x74], 0xb4
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0054c150
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [0x563d5c]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0
push 2
push 0
mov ax, word [0x561bee]
push eax
mov dx, word [0x561bec]
push edx
call fcn.004f196d
mov esi, eax
mov dword [ebx + 0x7c], esi
cmp esi, 0xffffffff
jne 0x488f47
push 2
push dword [ebx + 0x70]
push ebx
call fcn.004889b8
xor eax, eax
jmp 0x488f96
push dword [ebx + 0x7c]
call fcn.00525bcd
push 0x10
push 0x8031
push dword [0x56cee8]
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x488f91
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x488f91
push 3
push dword [ebx + 0x70]
push ebx
call fcn.004889b8
xor eax, eax
jmp 0x488f96
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48c027
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc18
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x5642d8
push ebx
call fcn.0048be97
test eax, eax
jne 0x48c04c
xor eax, eax
jmp 0x48c29e
push dword [ebx + 0x3b0]
call fcn.00412773
test eax, eax
jne 0x48c062
xor eax, eax
jmp 0x48c29e
mov dword [0x562150], ebx
push 0
push 0x46ca2a
push 0xfa
push dword [0x56cee8]
call fcn.0046b0f0
mov esi, eax
xor eax, eax
mov dword [0x562150], eax
push ebx
call fcn.0048be97
test eax, eax
jne 0x48c099
xor eax, eax
jmp 0x48c29e
push dword [ebx + 0x3b0]
call fcn.00412773
test eax, eax
jne 0x48c0b7
push 0
push ebx
call fcn.0048bdab
xor eax, eax
jmp 0x48c29e
test esi, esi
jg 0x48c105
cmp dword [ebx + 0x374], 0
je 0x48c0f6
push edi
lea edx, [ebp - 0x3e8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 8
push 0
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.0054c2d0
pop ecx
push eax
lea eax, [ebp - 0x3e8]
push eax
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_send
push 0
push ebx
call fcn.0048bdab
xor eax, eax
jmp 0x48c29e
cmp esi, 2
jne 0x48c29c
cmp dword [ebx + 0x374], 0
je 0x48c1b2
lea edx, [edi + 0xf]
push edx
lea ecx, [ebp - 0x3e8]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 8
push 0
lea eax, [ebp - 0x3e8]
push eax
call fcn.0054c2d0
pop ecx
push eax
lea edx, [ebp - 0x3e8]
push edx
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_send
lea ecx, [ebx + 0x68]
push ecx
lea eax, [ebx + 4]
push eax
lea edx, [edi + 0x1e]
push edx
push 0x57dbf8
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [ebx + 0x3b0]
push 2
push 0x57dbf8
call fcn.004ca888
push 0x57dbf8
lea ecx, [edi + 0x28]
push ecx
lea eax, [ebp - 0x3e8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [ebx + 0x3b0]
push eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3e8]
push edx
push dword [eax]
call fcn.004b099c
jmp 0x48c212
lea ecx, [ebx + 0x68]
push ecx
lea eax, [ebx + 4]
push eax
lea edx, [edi + 0x3a]
push edx
push 0x57dbf8
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [ebx + 0x3b0]
push 2
push 0x57dbf8
call fcn.004ca888
push 0x57dbf8
lea ecx, [edi + 0x41]
push ecx
lea eax, [ebp - 0x3e8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [ebx + 0x3b0]
push eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3e8]
push edx
push dword [eax]
call fcn.004b099c
push 0
push ebx
call fcn.0048bdab
mov ebx, dword [0x5642cc]
test ebx, ebx
je 0x48c298
cmp dword [ebx + 0x374], 0
je 0x48c24a
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x52]
push ecx
lea eax, [ebp - 0x3e8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x48c265
lea edx, [ebx + 0x68]
push edx
lea ecx, [ebx + 4]
push ecx
lea eax, [edi + 0x5c]
push eax
lea edx, [ebp - 0x3e8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push 0
lea ecx, [ebp - 0x3e8]
push ecx
push 0x57dbf8
call fcn.0051d2f8
test eax, eax
je 0x48c28e
push 0
push ebx
call fcn.0048bdab
mov ebx, dword [0x5642cc]
jmp 0x48c220
mov ebx, dword [ebx + 0x3b4]
test ebx, ebx
jne 0x48c224
xor eax, eax
jmp 0x48c29e
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48cd73
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0048be97
test eax, eax
jne 0x48cd8f
xor eax, eax
jmp 0x48cff9
push dword [ebx + 0x3b0]
call fcn.00412773
test eax, eax
jne 0x48cdb2
push 0x5643d5
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48cff9
mov dword [ebx + 0x33c], 2
xor edx, edx
mov dword [ebx + 0x3a4], edx
cmp dword [ebx + 0x340], 0
je 0x48cec4
cmp word [ebx + 0x34c], 0
jne 0x48cec4
cmp dword [0x563d64], 0
je 0x48ce29
push 0
push 0xb5c
call fcn.0042c564
push eax
push 1
push 1
push 1
push 1
push ebx
call fcn.00517489
push dword [ebx + 0x3b0]
push dword [ebx + 0x340]
push 1
push 0
add ebx, 0xcc
push ebx
call fcn.00488cd0
mov eax, 1
jmp 0x48cff9
push 1
push 0
lea edx, [ebx + 0x34c]
push edx
mov cx, word [0x561bee]
push ecx
mov ax, word [0x561bec]
push eax
call fcn.004f196d
mov esi, eax
mov dword [ebx + 0x3a8], esi
cmp esi, 0xffffffff
jne 0x48ce71
push 0
push 0xb5d
call fcn.0042c564
push eax
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48cff9
push 8
push 0x8011
push dword [0x56cee8]
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_WSAAsyncSelect
mov eax, dword [ebx + 0x3b0]
push eax
push dword [ebx + 0x340]
push dword [ebx + 0x35c]
mov dx, word [ebx + 0x34c]
push edx
push dword [eax + 0x510]
lea ecx, [ebx + 0x234]
push ecx
add ebx, 4
push ebx
call fcn.00502cf2
mov eax, 1
jmp 0x48cff9
lea edx, [ebx + 0xcc]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x48cef4
push 0
push 0xb5e
call fcn.0042c564
push eax
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48cff9
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x22], 4
mov word [ebp - 0x24], 2
lea esi, [ebp - 0x2c]
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0054c150
add esp, 0xc
mov word [ebp - 0x1c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x18]
push eax
call fcn.0054c0e0
add esp, 0xc
mov dx, word [ebx + 0x34c]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x1a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
push 0
push 2
push 0
mov cx, word [0x561bee]
push ecx
mov ax, word [0x561bec]
push eax
call fcn.004f196d
mov esi, eax
mov dword [ebx + 0x3a8], esi
cmp esi, 0xffffffff
jne 0x48cf9a
push 0
push 0xb5d
call fcn.0042c564
push eax
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48cff9
push dword [ebx + 0x3a8]
call fcn.00525bcd
push 0x10
push 0x800f
push dword [0x56cee8]
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x1c]
push edx
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x48cff7
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x48cff7
push 0
push 0xb5f
call fcn.0042c564
push eax
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48cff9
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48d63b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x48d644
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x48d665
xor eax, eax
jmp 0x48d836
xor edx, edx
mov dword [ebx + 0x3a4], edx
push 1
push 1
push dword [ebx + 0x3a8]
push 0x8012
call fcn.00526a8c
test eax, eax
je 0x48d68c
xor eax, eax
jmp 0x48d836
inc dword [ebx + 0x3ac]
cmp dword [ebx + 0x3ac], 0x14
jl 0x48d6c2
xor edx, edx
mov dword [ebx + 0x3ac], edx
push 0
push 1
push dword [ebx + 0x3a8]
push 0x8012
call fcn.00526a8c
test eax, eax
je 0x48d6c2
xor eax, eax
jmp 0x48d836
push 0
push 0x2000
lea edx, [ebp - 0x2000]
push edx
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp dword [ebx + 0x33c], 4
je 0x48d6ed
xor eax, eax
jmp 0x48d836
cmp esi, 0xffffffff
jne 0x48d721
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x48d705
xor eax, eax
jmp 0x48d836
push 0
push 0xb67
call fcn.0042c564
push eax
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48d836
test esi, esi
jg 0x48d739
push 0x56440a
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48d836
mov edi, esi
add dword [ebx + 0x350], edi
add dword [ebx + 0x368], esi
cmp dword [ebx + 0x360], 0
jbe 0x48d762
push 2
push 0
push dword [ebx + 0x338]
call fcn.00550328
add esp, 0xc
push edi
lea eax, [ebp - 0x2000]
push eax
push dword [ebx + 0x338]
call fcn.00551d70
add esp, 0xc
cmp esi, eax
je 0x48d798
push 0
push 0xb65
call fcn.0042c564
push eax
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48d836
push dword [ebx + 0x350]
call sub.WSOCK32.dll_htonl
mov dword [ebx + 0x354], eax
push ebx
call fcn.0048d936
push ebx
call fcn.0048d83f
test eax, eax
jne 0x48d7bd
xor eax, eax
jmp 0x48d836
push ebx
call fcn.0048be97
test eax, eax
jne 0x48d7cb
xor eax, eax
jmp 0x48d836
mov eax, dword [ebx + 0x35c]
test eax, eax
jbe 0x48d7f4
cmp eax, dword [ebx + 0x350]
ja 0x48d7f4
mov dword [ebx + 0x350], eax
push 0x56440e
push 0
push ebx
call fcn.0048daba
xor eax, eax
jmp 0x48d836
cmp dword [0x5642d4], 0
je 0x48d68c
cmp dword [ebx + 0x368], 0x7d000
jl 0x48d68c
push dword [ebx + 0x338]
call fcn.0054f728
pop ecx
cmp eax, 0xffffffff
je 0x48d829
push eax
call fcn.0054f720
pop ecx
xor edx, edx
mov dword [ebx + 0x368], edx
jmp 0x48d68c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48e253
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push 3
call sub.USER32.dll_GetAsyncKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x48e2b1
push 0
push 0xaf3
call fcn.0042c564
mov edi, eax
mov esi, 0x57e17c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.0042c4bf
xor eax, eax
jmp 0x48e425
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x48e2cf
push 0
push 0
mov ecx, dword [ebp + 8]
push dword [ecx]
push 0
call fcn.00479c10
jmp 0x48e425
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x48e34f
mov eax, dword [esi]
cmp byte [eax], 0x25
jne 0x48e2f0
push dword [ebp + 0x20]
push edi
push eax
call fcn.0051bd3b
test eax, eax
jne 0x48e317
mov esi, dword [esi + 0x40]
jmp 0x48e2d2
mov edx, dword [esi]
push esi
push edi
mov esi, edi
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x20
push edi
call fcn.0054c230
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x48e32b
mov byte [ebx], 0
mov eax, dword [ebp + 8]
push dword [eax + 4]
push edi
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x48e348
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi + 0x2c]
mov dword [edx], ecx
jmp 0x48e34f
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x48e2d6
test esi, esi
je 0x48e420
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x48e36e
push dword [ebp + 0x10]
call fcn.004c6e81
mov eax, dword [esi + 0x2c]
push dword [eax + 0x24]
lea edx, [ebp - 4]
push edx
push edi
mov ecx, dword [esi + 0x2c]
push dword [ecx]
call fcn.004e4e9d
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
cmp dword [ebp - 4], 0
jne 0x48e397
xor eax, eax
jmp 0x48e425
test ebx, ebx
jne 0x48e3a5
mov eax, 1
jmp 0x48e425
mov edi, ebx
test edi, edi
je 0x48e3fc
mov ebx, dword [edi]
jmp 0x48e3b0
inc ebx
cmp byte [ebx], 0x20
je 0x48e3af
cmp byte [ebx], 0x3a
jne 0x48e3f5
inc ebx
jmp 0x48e3be
inc ebx
cmp byte [ebx], 0x20
je 0x48e3bd
cmp byte [ebx], 0
je 0x48e3f5
push 0x20
push ebx
call fcn.0054c230
add esp, 8
test eax, eax
je 0x48e3da
mov byte [eax], 0
push ebx
push dword [esi]
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x48e3f5
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, 1
jmp 0x48e425
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x48e3ab
mov edx, dword [ebp + 8]
push dword [edx + 4]
push 0
push 0xaf4
call fcn.0042c564
push eax
push 0x57e17c
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor eax, eax
jmp 0x48e425
mov eax, 4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x1c
Function at 0x48e482
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc18
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x3e8]
jmp 0x48e49f
mov byte [eax], dl
inc ebx
inc eax
inc esi
mov dl, byte [ebx]
test dl, dl
jne 0x48e49a
mov byte [eax], 0
lea ebx, [ebp - 0x3e8]
test esi, esi
ja 0x48e4b6
xor eax, eax
jmp 0x48e4d2
push esi
push ebx
call sub.USER32.dll_CharLowerBuffA
xor eax, eax
jmp 0x48e4cc
and edx, 0xff
xor eax, edx
add eax, eax
inc ebx
mov dl, byte [ebx]
test dl, dl
jne 0x48e4c1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x496cb4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x564810
cmp dword [0x5647f4], 0
jne 0x496cd3
push 0
call fcn.00496c2a
jmp 0x496d87
cmp dword [0x5647fc], 0
je 0x496cf3
push 0
call fcn.0041292a
test eax, eax
jne 0x496cf3
push 0
call fcn.00496c2a
jmp 0x496d87
push 0
push dword [ebp + 8]
push 0x57fb38
call fcn.004d84ed
test eax, eax
jne 0x496d16
xor eax, eax
mov dword [0x5647f4], eax
push 0
call fcn.00496c2a
jmp 0x496d87
cmp dword [esi], 0xffffffff
jne 0x496d87
mov dword [0x564814], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [esi], ebx
cmp ebx, 0xffffffff
jne 0x496d42
push 0
call fcn.00496c2a
jmp 0x496d87
mov ax, word [0x564804]
push eax
push dword [esi]
call fcn.004f18ad
test eax, eax
jne 0x496d5d
push 0
call fcn.00496c2a
jmp 0x496d87
push 5
push dword [esi]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x496d73
push 0
call fcn.00496c2a
jmp 0x496d87
push 8
push 0x802a
push dword [0x56cee8]
push dword [esi]
call sub.WSOCK32.dll_WSAAsyncSelect
pop esi
pop ebx
pop ebp
ret 4