joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47aef0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
lea ecx, [ebp - 0x110]
call fcn.00484080
test eax, eax
je 0x47b019
mov ecx, 0x518188
lea eax, [ebp - 0x110]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47af44
test dl, dl
je 0x47af40
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47af44
add eax, 2
add ecx, 2
test dl, dl
jne 0x47af24
xor eax, eax
jmp 0x47af49
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47af6e
cmp dword [0x5674b8], eax
jne 0x47af6e
push 0x101
lea eax, [ebp - 0x110]
push str.Default
push eax
call fcn.004daa40
add esp, 0xc
mov ecx, 0x518188
lea eax, [ebp - 0x110]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47afa0
test dl, dl
je 0x47af9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47afa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x47af80
xor eax, eax
jmp 0x47afa5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47afd6
push str.d:_saasultravncwinvncwinvnc_vncproperties.cpp_:__DBG___Force_USER_SYSTEM_2_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
lea eax, [ebp - 0x110]
push str.SYSTEM
push 0x101
push eax
call fcn.004d0170
add esp, 0xc
add edi, 8
push edi
push 0
push str.DebugMode
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
call fcn.00471030
push edi
push 0
push str.DebugLevel
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x558c60], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push str.d:_saasultravncwinvncwinvnc_vncproperties.cpp_:__DBG___NO_current_user_n
push 9
push 0x558c50
call fcn.0041c840
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x47fd80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6608
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x55800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 8]
mov byte [ebp - 0xd], 0
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x18
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x130]
mov esi, dword [eax]
cmp esi, eax
je 0x47fe9e
nop dword [eax]
movzx eax, word [esi + 8]
mov edx, eax
mov ecx, eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x48]
cmp eax, vtable.vncServer.0
jne 0x47febc
cmp edx, 0x7f
ja 0x47fe09
movsx eax, cx
mov ecx, dword [edi + eax*4 + 0x138]
jmp 0x47fe0b
xor ecx, ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0x88]
cmp eax, vtable.vncClient.0
jne 0x47fec8
mov eax, dword [ecx + 0x268]
cmp eax, 0x11
je 0x47fe44
cmp eax, 0x10
je 0x47fe44
cmp eax, 7
je 0x47fe44
cmp eax, 6
je 0x47fe44
cmp eax, 0x13
je 0x47fe44
cmp eax, 0x12
je 0x47fe44
jmp 0x47fe8a
movzx eax, word [esi + 8]
mov edx, eax
mov ecx, eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x48]
cmp eax, vtable.vncServer.0
jne 0x47fed3
cmp edx, 0x7f
ja 0x47fe69
movsx eax, cx
mov eax, dword [edi + eax*4 + 0x138]
jmp 0x47fe6b
xor eax, eax
mov edx, dword [eax]
cmp edx, vtable.vncClient.0
jne 0x47feda
mov ebx, dword [eax + 0x1b4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x47fe9a
mov esi, dword [esi]
cmp esi, dword [edi + 0x130]
jne 0x47fde0
jmp 0x47fe9e
mov byte [ebp - 0xd], 1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, edi
call ebx
mov ecx, eax
jmp 0x47fe0b
call edx
test al, al
je 0x47fe8a
jmp 0x47fe44
push ecx
mov ecx, edi
call ebx
jmp 0x47fe6b
mov ecx, eax
call dword [edx + 0x84]
mov ebx, eax
jmp 0x47fe7b
Function at 0x481f10
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x478
mov eax, dword [0x55800c]
xor eax, esp
mov dword [esp + 0x474], eax
mov eax, dword [ebp + 8]
push esi
mov dword [esp + 0x34], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x3c], eax
lea eax, [esi + 0x33c]
push edi
push eax
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x80]
test eax, eax
jne 0x4820a3
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x481f91
push str.d:_saasultravncwinvncwinvnc_vncserver.cpp_:_Failed_rootdc__n
push eax
push 0x558c50
call fcn.0041c840
xor esi, esi
add esp, 0xc
mov dword [esp + 0x10], esi
xor cl, cl
jmp 0x4820ce
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push eax
call esi
movzx edi, ax
push 0xa
push dword [esp + 0x10]
mov ax, di
mov dword [esp + 0x38], eax
mov word [esp + 0x18], ax
call esi
movzx eax, ax
push eax
push edi
mov edi, dword [esp + 0x14]
push edi
mov word [esp + 0x1e], ax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x481fe7
xor esi, esi
mov byte [esp + 8], al
push edi
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x4820ca
push 0x430
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.004cddb0
add esp, 0xc
mov dword [esp + 0x4c], 0x28
xor eax, eax
mov word [esp + 0x5a], ax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
mov dword [esp + 0x34], esi
test esi, esi
jne 0x482025
mov dword [esp + 0x10], esi
mov byte [esp + 8], al
jmp 0x48208e
push 0
lea eax, [esp + 0x50]
push eax
push 0
push 1
push 0
push dword [esp + 0x20]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x482079
push 0
lea eax, [esp + 0x50]
push eax
push 0
push 1
push 0
push dword [esp + 0x20]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x482079
cmp byte [esp + 0x5a], 0x18
mov edx, 0x20
movzx ecx, byte [esp + 0x5a]
mov esi, dword [esp + 0x30]
cmove ecx, edx
mov dword [esp + 8], ecx
jmp 0x482084
xor esi, esi
mov byte [esp + 8], 0
mov dword [esp + 0x10], esi
push dword [esp + 0x34]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x4820ca
movups xmm0, xmmword [eax + 0xe084]
movups xmmword [esp + 0x10], xmm0
mov si, word [esp + 0x10]
movq xmm0, qword [eax + 0xe094]
mov al, byte [esp + 0x14]
movq qword [esp + 0x20], xmm0
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x38]
push dword [esp + 0x44]
movzx eax, si
mov dword [edx], eax
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
shr eax, 0x10
mov dword [edx], eax
movzx eax, cl
mov ecx, dword [esp + 0x44]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
xor ecx, esp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4835e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x614], 0
je 0x483648
cmp byte [0x563186], 0
jne 0x483648
push str.d:_saasultravncwinvncwinvnc_vncserver.cpp_:_AutoConnectRetry__:_started_n
push 9
push 0x558c50
call fcn.0041c840
mov eax, dword [esi + 0x5c]
add esp, 0xc
test eax, eax
je 0x48362a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x483648
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x5634a0]
push 0x4835c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x5c], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x483650
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x55800c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov esi, ecx
cmp dword [esi + 0x614], 0
je 0x483830
lea eax, [esi + 0x620]
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x483680
sub ecx, edx
je 0x483830
cmp byte [0x563186], al
jne 0x483830
push str.d:_saasultravncwinvncwinvnc_vncserver.cpp_:_Attempting_AutoReconnect...._n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
push 0x23a4
call fcn.004cbf3d
add esp, 4
mov dword [esp + 0xc], eax
mov ecx, eax
call fcn.004859b0
mov dword [esi + 0x64], eax
test eax, eax
je 0x483668
mov ecx, eax
call fcn.00485b10
mov eax, dword [esi + 0x61c]
xorps xmm0, xmm0
mov edi, dword [esi + 0x64]
mov dword [esp + 0xc], eax
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
mov word [esp + 0x10], ax
lea eax, [esi + 0x620]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x48372a
lea eax, [esi + 0x620]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x48374d
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x48374d
mov eax, dword [eax]
mov dword [esp + 0x14], eax
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push 0x10
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4837bb
push str.d:_saasultravncwinvncwinvnc_vncserver.cpp_:_connect_failed__waitin_5_sec_to_retry...._n
push 9
push 0x558c50
call fcn.0041c840
mov ecx, dword [esi + 0x64]
add esp, 0xc
test ecx, ecx
je 0x48376e
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x614], 0
mov dword [esi + 0x64], 0
je 0x483830
lea eax, [esi + 0x620]
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x483790
sub eax, edx
je 0x483668
cmp byte [0x563186], cl
jne 0x483668
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x483668
mov ecx, edi
call fcn.00485de0
lea edi, [esi + 0x71f]
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4837d0
sub ecx, edx
mov ecx, dword [esi + 0x64]
je 0x483810
push 0xfa
push edi
call fcn.00485fd0
mov ecx, dword [esi + 0x64]
push 0
call fcn.00485eb0
push 1
push dword [esi + 0x61c]
lea edx, [esi + 0x620]
push edx
push edi
push 0
push 0
push 1
push 1
push dword [esi + 0x64]
jmp 0x48382a
push 1
push dword [esi + 0x61c]
lea edx, [esi + 0x620]
push edx
push 0
push 0
push 0
push 1
push 1
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push str.d:_saasultravncwinvncwinvnc_vncserver.cpp_:_leaving_reconnectThread...._n
push 9
push 0x558c50
call fcn.0041c840
mov ecx, dword [esp + 0x38]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x483e70
Capabilities:
Enumerate processes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c0]
call fcn.004268c0
push 0x518188
lea eax, [ebp - 0x90]
push 0x81
push eax
call fcn.004d0170
add esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
push 0x100
lea eax, [ebp - 0x90]
push eax
push 0x518188
push str.alternate_shell
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x2c8], ebx
mov dword [0x5634a4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x483f18
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push edi
call esi
push str.ProcessIdToSessionId
push edi
mov ebx, eax
call esi
mov dword [0x5634a4], eax
test ebx, ebx
je 0x483f18
call ebx
mov ebx, eax
jmp 0x483f1a
xor ebx, ebx
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x483f56
cmp dword [0x5634a4], 0
je 0x483f56
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 0xffffffff
push ecx
push eax
call dword [0x5634a4]
mov ebx, dword [ebp - 0x2c4]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x483f8a
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1b8], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x483fb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x483f95
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x194]
push str.explorer.exe
push eax
call fcn.004dadd3
add esp, 8
test eax, eax
je 0x483ff6
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x483fd1
sub ecx, edx
je 0x484038
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004dadd3
add esp, 8
test eax, eax
jne 0x484038
mov eax, dword [0x5634a4]
mov dword [ebp - 0x2c4], 0
test eax, eax
je 0x48402c
lea ecx, [ebp - 0x2c4]
push ecx
push dword [ebp - 0x1b0]
call eax
test eax, eax
je 0x484038
cmp dword [ebp - 0x2c4], ebx
jne 0x484038
mov ebx, dword [ebp - 0x1b0]
jmp 0x484054
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x483fb0
mov ebx, dword [ebp - 0x2c8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x484066
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x484c90
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx + 0x42c], 0
je 0x484ce9
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x484ce0
cmp dword [ebp - 4], 4
jne 0x484ce0
cmp dword [ebp - 8], 4
jne 0x484ce0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ecx + 0x430]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x484d10
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x42c], 0
je 0x484da0
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0
push edi
push dword [ebp + 8]
mov dword [ebp - 8], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x484d96
cmp dword [ebp - 4], 3
jne 0x484d96
push 0x100
mov dword [ebp - 8], 0x100
call fcn.004cbf7b
mov esi, eax
add esp, 4
test esi, esi
je 0x484d96
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x484d8d
cmp dword [ebp - 4], 3
je 0x484dcf
push esi
call fcn.004cbf38
add esp, 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x96
call fcn.004cbf7b
add esp, 4
lea ecx, [edi + 0x430]
mov esi, eax
push ecx
push 0x96
push esi
push 0x518188
push dword [ebp + 0xc]
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x485940
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x198]
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x485980
mov dword [esi], 0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 0x198]
mov ecx, dword [ebp - 4]
mov word [0x58a320], ax
xor ecx, ebp
mov dword [esi], 0xffffffff
mov eax, esi
pop esi
call fcn.004cbf27
mov esp, ebp
pop ebp
ret

Function at 0x485b10
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 1
cmp dword [esi + 8], 0xffffffff
je 0x485b6e
push str.d:_saasultravncwinvncwinvnc_vsocket.cpp_:_closing_socket_n
push 0xa
push 0x558c50
call fcn.0041c840
add esp, 0xc
push 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esi + 0x14]
mov dword [esi + 8], 0xffffffff
test ecx, ecx
je 0x485b6e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
lea ecx, [ebp - 4]
mov dword [esi + 8], eax
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x485b9c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00485de0
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x485c10
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, 2
mov esi, ecx
movups xmmword [ebp - 0x14], xmm0
push edi
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x485c5f
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x485c7f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x485c7f
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x485c93
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.00485de0
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 8
Function at 0x485cb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
mov esi, ecx
push eax
push 0x1001
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x8000
push eax
push 0x1001
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_accept]
push 0x23a4
mov esi, eax
call fcn.004cbf3d
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, eax
call fcn.004859b0
mov edi, eax
test edi, edi
je 0x485d3b
mov ecx, edi
mov dword [edi + 8], esi
call fcn.00485de0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x485db0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x485dd9
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x485dd7
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x485dd7
mov eax, dword [eax]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x485eb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x58a320], 2
push esi
mov esi, ecx
jb 0x485f09
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x485f09
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x485f09
or eax, 0xffffffff
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x485f10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x58a320], 2
push esi
mov esi, ecx
jae 0x485f26
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x485f1f
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
pop esi
sbb eax, eax
pop ebp
ret 4

Function at 0x485f70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x58a320], 2
push esi
mov esi, ecx
jae 0x485f86
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x485f7f
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
pop esi
sbb eax, eax
pop ebp
ret 4
Function at 0x4860d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, eax
mov edx, dword [esi + 0x239c]
add eax, edx
cmp eax, dword [esi + 0x23a0]
jb 0x486190
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x239c]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x23a0]
sub eax, ecx
push eax
lea eax, [esi + 0x74]
add eax, ecx
push ebx
push eax
call fcn.004cd830
mov ecx, dword [esi + 8]
lea edx, [esi + 0x74]
add esp, 8
push dword [esi + 0x23a0]
call fcn.00486790
add esp, 8
test al, al
je 0x4861b2
mov ecx, dword [esi + 0x23a0]
xor edx, edx
mov edi, dword [esi + 0x239c]
mov eax, ecx
sub eax, edi
mov dword [esi + 0x239c], 0
sub edi, ecx
add ebx, eax
add edi, dword [ebp + 0xc]
cmp edi, ecx
jb 0x486190
nop
push ecx
push ecx
mov ecx, dword [esi + 8]
mov edx, ebx
call fcn.00486790
add esp, 8
test al, al
je 0x4861b2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x23a0]
add ebx, ecx
sub edi, ecx
mov dword [esi + 0xc], eax
cmp edi, ecx
jae 0x486160
mov edx, dword [esi + 0x239c]
push edi
lea ecx, [esi + 0x74]
add ecx, edx
push ebx
push ecx
call fcn.004cd830
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x239c], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8