joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4488c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x44896f
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov ecx, 0x54a8dc
mov dword [ebp - 4], ebx
call fcn.00456e70
dec eax
mov dword [ebp + 8], eax
js 0x4489b1
push eax
mov ecx, 0x54a8dc
call fcn.00449d90
cmp dword [ebp - 4], 0
mov edi, eax
je 0x448958
mov ecx, edi
call fcn.004431e0
cmp dword [esi], eax
je 0x44892b
mov ecx, edi
call fcn.004431e0
cmp ebx, eax
jne 0x44894b
push esi
mov ecx, edi
call fcn.00448860
test al, al
jne 0x448966
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.00446780
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
test ebx, ebx
jne 0x448915
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
js 0x4489b1
mov ebx, dword [ebp - 4]
jmp 0x448902
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x54a8dc
xor edi, edi
call fcn.00456e70
test eax, eax
jle 0x4489b1
nop
mov ecx, 0x54a8dc
call fcn.00456e70
push edi
mov ecx, 0x54a8dc
call fcn.00449d90
mov ebx, eax
mov ecx, ebx
call fcn.004431e0
cmp dword [esi], eax
je 0x4489ba
mov ecx, 0x54a8dc
inc edi
call fcn.00456e70
cmp edi, eax
jl 0x448980
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, ebx
call fcn.00448860
test al, al
jne 0x448966
cmp dword [esi + 8], 0xe5
jne 0x4489d9
push dword [esi]
call sub.IMM32.dll_ImmGetVirtualKey
mov dword [esi + 8], eax
lea eax, [ebp - 8]
mov ecx, ebx
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.00446780
pop edi
test al, al
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b2c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44b305
cmp byte [ebp + 8], 0
je 0x44b2f9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x451b00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5056db
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x5447a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push eax
mov dword [edi + 0x10], esi
call fcn.00451130
mov ecx, esi
call fcn.00486720
mov ecx, dword [edi + 0x10]
mov esi, eax
or esi, 0x40000080
call fcn.00472420
test al, 1
je 0x451b62
or esi, 1
jmp 0x451b69
test al, 2
je 0x451b69
or esi, 2
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.00451d40
test al, al
je 0x451b7a
or esi, 0x20
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov ecx, ebx
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ebx]
push esi
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.004431e0
push eax
mov ecx, edi
call fcn.0044add0
mov ecx, dword [edi + 0x10]
call fcn.0044e380
cmp eax, 0xffffffff
je 0x451bc9
mov ecx, dword [edi + 0x10]
push eax
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00442b70
test eax, eax
jne 0x451bda
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00442a90
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
push 0
call fcn.00451700
push eax
push 0xc5
push dword [edi + 4]
call esi
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.00451d40
test al, al
je 0x451c24
push 0
mov ecx, ebx
call fcn.00451740
movzx eax, ax
push eax
push 0xcc
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00405f40
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.00449c80
push 0
push 0
push 0xb9
push dword [edi + 4]
call esi
push 0
push 3
push 0xd3
mov ecx, edi
call fcn.0044b220
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [edi + 0x10]
push 0
call fcn.00451d50
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push 0xcf
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0x10]
call fcn.00451d30
push dword [edi + 4]
test al, al
je 0x451ced
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
mov ecx, 1
cmove eax, ecx
push eax
push 0
jmp 0x451cf5
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
push eax
push 0xb1
push dword [edi + 4]
call esi
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 4
Function at 0x451d60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5447a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00454170
mov ecx, dword [esi + 0x6e0]
test ecx, ecx
je 0x451df1
lea eax, [ebp - 0x14]
push eax
call fcn.00451130
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x451dc7
mov ecx, dword [esi + 0x6e0]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6e0]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0xc

Function at 0x451e10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5447a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x451e9b
cmp dword [esi + 0x10], 0
je 0x451e9b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004d01d0
mov ebx, esp
test ebx, ebx
je 0x451e9b
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.00449d20
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.004476a0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00443970
test al, al
je 0x451e9b
mov ecx, dword [esi + 0x10]
call fcn.00454040
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4529d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5447a0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.00456610
mov ecx, dword [esi + 0x6e0]
test ecx, ecx
je 0x452a69
lea eax, [ebp - 0x14]
push eax
call fcn.00451130
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x452a3f
mov ecx, dword [esi + 0x6e0]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6e0]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0x14
Function at 0x460d00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x694], 0
je 0x460d6f
cmp dword [ebp + 8], 0x100
jne 0x460d5f
cmp word [ebp + 0xc], 0xd
jne 0x460d5f
cmp byte [esi + 0x69a], 0
je 0x460d3e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x460d5f
cmp byte [esi + 0x69b], 0
jne 0x460d5f
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x460d58
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.004476a0
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x694]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x46df90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x46dfb7
cmp eax, edi
jge 0x46dfaf
push esi
call fcn.00469e00
add esp, 4
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x46dfe0
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x46dfc3
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x46dffc
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x46dfed
xor dl, dl
jmp 0x46dff2
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x46dfe3
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x46e031
pop edi
pop esi
mov dword [ebp + 8], str.zlib_corrupt
pop ebp
jmp fcn.00469d10
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46e049
pop edi
pop esi
mov dword [ebp + 8], str.read_past_buffer
pop ebp
jmp fcn.00469d10
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x46e067
push edi
push ecx
push esi
call fcn.00471210
add esp, 0xc
test eax, eax
jne 0x46e067
pop edi
pop esi
pop ebp
ret
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004cfa40
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x485650
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5056db
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x5447a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [eax + 0x6f0], 0
cmp dword [edi + 4], 0
jne 0x4856fd
lea eax, [ebp - 0xa4]
push eax
call fcn.004851a0
mov ecx, dword [edi + 0x10]
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.004431e0
push eax
mov ecx, edi
call fcn.0044add0
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.0044e380
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.00442d10
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0044a5a0
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00449c80
test bl, bl
je 0x485741
mov eax, dword [edi + 0x10]
add eax, 0x6e0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, 0x6e0
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 4

Function at 0x485790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5447a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00454170
mov ecx, dword [esi + 0x6f8]
test ecx, ecx
je 0x485821
lea eax, [ebp - 0x14]
push eax
call fcn.004851a0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4857f7
mov ecx, dword [esi + 0x6f8]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6f8]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x485930
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5447a0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.00456610
mov ecx, dword [esi + 0x6f8]
test ecx, ecx
je 0x4859c9
lea eax, [ebp - 0x14]
push eax
call fcn.004851a0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x48599f
mov ecx, dword [esi + 0x6f8]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6f8]
push 0
call fcn.00456e70
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c60e4
mov esp, ebp
pop ebp
ret 0x14

Function at 0x489510
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.00443200
mov edi, eax
add esp, 8
test edi, edi
jne 0x4895b4
push eax
push 0x80
push 3
push eax
push 1
push bind
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4895a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x4895a9
push eax
mov dword [ebp + 8], edi
call fcn.004c52c3
add esp, 4
mov edi, eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp dword [ebp + 8], eax
je 0x4895a5
push edi
call fcn.004ccc12
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x4895b7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, ebx
call fcn.004895e0
push edi
mov esi, eax
call fcn.004ccc12
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x489f10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5447a0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x489f65
mov eax, dword [esp]
cmp al, 2
jne 0x489f5f
shr eax, 8
cmp al, 2
jne 0x489f5f
call fcn.0048f560
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004c60e4
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.004c60e4
add esp, 0x194
ret
Function at 0x48ff80
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x48ff9c
cmp dword [esi + 0x6c], 0
je 0x48ff9c
push 2
push 3
push esi
call fcn.004a5c90
add esp, 0xc
push dword [esp + 0xc]
call fcn.0049ef30
add esp, 4
test esi, esi
je 0x48ffbd
cmp dword [esi + 0x6c], 0
je 0x48ffbd
push 3
push esi
call fcn.004a5cd0
add esp, 8
pop esi
ret

Function at 0x490700
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x3c0], 2
je fcn.004906b0
mov al, 1
ret
Function at 0x4999b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x5447a0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
mov edi, dword [esp + 0x114]
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x11c]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.0049bf30
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4999f5
sub esi, ecx
mov ecx, dword [edi + 0x140]
test ecx, ecx
je 0x499a29
cmp byte [edi + 0x46b0], al
jne 0x499a29
lea edx, [esp + 8]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x499a14
mov byte [edi + 0x46b0], 1
cmp byte [edi + 0x370], 0
je 0x499a63
mov byte [esp + esi + 8], 0xa
inc esi
cmp esi, 0x102
jae 0x499abb
mov eax, dword [edi + 0x1b0]
mov byte [esp + esi + 8], 0
test eax, eax
je 0x499a7a
push dword [edi + 0x13c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004c60e4
add esp, 0x108
ret
push dword [edi + 0x138]
push 1
push 2
push 0x513b58
call fcn.004cd1ca
push dword [edi + 0x138]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.004cd1ca
mov ecx, dword [esp + 0x12c]
add esp, 0x20
pop edi
pop esi
xor ecx, esp
call fcn.004c60e4
add esp, 0x108
ret
call fcn.004ce75c
int3

Function at 0x499ad0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x5447a0]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x499b99
cmp byte [edi + 0x370], 0
je 0x499b99
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.0049bf30
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x499b30
mov eax, dword [edi + 0x1b0]
sub esi, ecx
test eax, eax
je 0x499b6e
push dword [edi + 0x13c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004c60e4
add esp, 0x808
ret
push dword [edi + 0x138]
push 1
push 2
push 0x513b58
call fcn.004cd1ca
push dword [edi + 0x138]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.004cd1ca
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.004c60e4
add esp, 0x808
ret
Function at 0x499e00
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x198]
call fcn.0049a230
add esp, 8
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [ebp], 0
cmp ebx, 0xffffffff
jne 0x499e86
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x499e5e
pop edi
pop esi
mov dword [ebp], 0x51
xor eax, eax
pop ebp
pop ebx
ret
push esi
push edi
call fcn.0048a640
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.004999b0
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x46b4], esi
mov eax, ebx
mov dword [ebp], 0x37
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x49a230
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
shl eax, 4
mov ebp, dword [ebx + ecx*4 + 0x198]
lea esi, [ebx + 0x1bc]
add esi, eax
mov eax, dword [ebx + 0x3b8]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x49a2e8
cmp dword [ebx + ecx*4 + 0x1ac], 0x499d60
jne 0x49a2e8
cmp dword [esi], 0
je 0x49a27c
test edi, edi
je 0x49a2e8
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.00499300
add esp, 0x14
cmp eax, 0xffffffff
je 0x49a2e8
test al, 1
je 0x49a2e8
cmp dword [esi], 0
jne 0x49a2d1
mov eax, dword [ebx]
mov eax, dword [eax + 0x32c]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x5442f8]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x49a2d1
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x49a2e8
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x49a2f0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x1b0]
test eax, eax
je 0x49a319
push dword [esi + 0x13c]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push esi
call eax
add esp, 0x14
pop esi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x49a352
push dword [esi + 0x138]
lea eax, [eax + eax*2]
push 1
add eax, 0x513b58
push 2
push eax
call fcn.004cd1ca
push dword [esi + 0x138]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.004cd1ca
add esp, 0x20
xor eax, eax
pop esi
ret

Function at 0x49a430
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1dc], 0
je 0x49a44d
push eax
call fcn.004274b0
add esp, 4
test eax, eax
jne 0x49a46f
xor al, al
ret
mov eax, dword [eax + 0x198]
cmp eax, 0xffffffff
je 0x49a44a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x49a46f
xor al, al
ret
mov al, 1
ret
Function at 0x49ada0
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [esp + 0x20]
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x49ade8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0048a640
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00499ad0
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00499ad0
add esp, 8
pop edi
pop esi
ret