joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443fe4
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.004321f9
pop ecx
test al, al
jne 0x444082
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, 0x100
je 0x444017
push esi
call fcn.004449fe
or eax, edx
pop ecx
jne 0x444087
test bl, 1
jne 0x444025
push edi
push esi
call fcn.004431b5
pop ecx
pop ecx
test bl, 2
jne 0x4440f5
test bl, bl
js 0x44408e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4441b0
test ebx, 0x800
je 0x444060
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x4441b0
cmp eax, 3
je 0x4441b0
test bl, 0x10
je 0x444087
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x444087
cmp eax, 3
je 0x444087
push esi
or ebx, 2
call fcn.004321f9
pop ecx
test al, al
je 0x444004
call fcn.0045888e
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea ecx, [ebp - 0x10]
call fcn.00428af1
push closesocket
push esi
lea ecx, [ebp - 0x10]
call fcn.0042fc81
push edi
lea ecx, [ebp - 0x10]
call fcn.0042470d
push edi
lea eax, [ebp - 0x3c]
push 0x1e
push eax
call fcn.0042a315
add esp, 0xc
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x10], edi
mov eax, 0x49bb64
cmovne eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, 0x454
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
lea ecx, [ebp - 0x10]
neg ebx
sbb bl, bl
inc bl
jmp 0x4441ec
call fcn.0045760b
test al, al
je 0x4441c5
mov eax, dword [0x4df804]
test eax, eax
je 0x444119
push 4
push edi
push esi
call eax
test eax, eax
jne 0x4441b0
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00458b2c
mov edi, 0x49bb60
mov dword [esp], str.wininit.exe
mov ecx, edi
cmp dword [eax], 0
cmovne ecx, dword [eax]
lea eax, [ebp - 0x10]
push ecx
push eax
call fcn.00444e23
mov ecx, edi
cmp dword [eax], 0
cmovne ecx, dword [eax]
push ecx
call fcn.00444249
add esp, 0x10
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.00426428
lea ecx, [ebp - 0x1c]
call fcn.00426428
test bl, bl
je 0x4441b7
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0044611a
push 0
push 0x49be48
lea eax, [ebp - 0x10]
push 0
push eax
push eax
call fcn.004595fe
cmp dword [ebp - 0x10], 0
cmovne edi, dword [ebp - 0x10]
push edi
push 0x4a6b48
call fcn.0044874c
add esp, 0x24
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.00426428
test bl, bl
je 0x4441b7
mov al, 1
jmp 0x444089
push dword [ebp - 4]
call fcn.00458880
pop ecx
jmp 0x444087
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0044611a
mov ecx, 0x49bb60
cmp dword [eax], edi
cmovne ecx, dword [eax]
push ecx
push 0x4a6b48
call fcn.0044874c
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00426428
mov al, bl
jmp 0x444089
Function at 0x4480c9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
cmp byte [esi + 0x6b], 0
jne 0x4480f1
push closesocket
push str.Read_access_denied
lea ecx, [esi + 0x44]
call fcn.0042f72b
xor al, al
jmp 0x44818e
cmp byte [esi + 0x68], 0
push ebx
push edi
je 0x44810e
push dword [ebp + 0xc]
lea ecx, [esi + 0x2c]
mov eax, dword [ecx]
push dword [ebp + 8]
mov eax, dword [eax]
call eax
test al, al
jne 0x448169
jmp 0x448178
xor edi, edi
cmp dword [esi + 0xc], edi
jne 0x448121
push closesocket
push str.File_not_open
jmp 0x448182
call fcn.00447e2c
push edi
mov ebx, eax
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x448164
lea eax, [ebp - 0x14]
push eax
call fcn.00458617
pop ecx
push eax
lea ecx, [esi + 0x44]
call fcn.00408887
lea ecx, [ebp - 0x14]
call fcn.00426428
jmp 0x44818a
cmp edi, dword [ebp - 4]
jne 0x44816d
mov al, 1
jmp 0x44818c
push dword [ebp - 8]
mov ecx, esi
push ebx
call fcn.00447f65
push closesocket
push str.Read_past_end_of_file
lea ecx, [esi + 0x44]
call fcn.0042f72b
xor al, al
pop edi
pop ebx
pop esi
leave
ret 8

Function at 0x4485e0
Capabilities:
Clear file content

Disassembly:
cmp byte [ecx + 0x6c], 0
je 0x44860c
cmp byte [ecx + 0x68], 0
je 0x4485f7
add ecx, 0x2c
call fcn.0042536d
mov al, 1
ret
cmp dword [ecx + 0xc], 0
je 0x44860c
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
ret
xor al, al
ret
Function at 0x448897
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
je 0x4488c2
jns 0x4488cb
push closesocket
push str.Illegal_write_size
lea ecx, [esi + 0x40]
call fcn.0042f72b
call fcn.0045888e
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
cmp byte [esi + 0x68], 0
jne 0x4488ef
push closesocket
push str.Write_access_denied
lea ecx, [esi + 0x40]
call fcn.0042f72b
push 5
call fcn.00458880
pop ecx
xor al, al
jmp 0x4488c4
cmp byte [esi + 0x64], 0
je 0x448906
lea ecx, [esi + 0x2c]
mov eax, dword [ecx]
push edi
push dword [ebp + 8]
call dword [eax]
mov byte [esi + 0x65], 1
jmp 0x4488c2
cmp dword [esi + 8], 0
jne 0x448922
push closesocket
push str.File_not_open
lea ecx, [esi + 0x40]
call fcn.0042f72b
push 6
jmp 0x4488e5
call fcn.00458877
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], 0x100000
push eax
call fcn.004018e2
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp + 8]
jmp 0x44897b
cmp ebx, dword [ebp - 0xc]
jne 0x4489c1
sub edi, ebx
mov dword [ebp + 0xc], edi
test edi, edi
jle 0x4489aa
add dword [ebp - 4], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004018e2
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp - 4]
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x448950
lea eax, [ebp - 0x18]
push eax
call fcn.00458617
pop ecx
push eax
lea ecx, [esi + 0x40]
call fcn.00425696
lea ecx, [ebp - 0x18]
call fcn.00426428
jmp 0x4488eb
cmp byte [esi + 0x66], 0
je 0x4488c2
lea ecx, [esi - 4]
call fcn.00447458
jmp 0x4488c2
push closesocket
push str.Not_all_data_could_be_written
lea ecx, [esi + 0x40]
call fcn.0042f72b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4488eb
push 0x1722
jmp 0x4488e5
Function at 0x448ea3
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov eax, 0x49a165
call fcn.0046b790
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
cmp dword [edi], ebx
je 0x448ec7
xor eax, eax
jmp 0x448f8f
mov ecx, dword [0x4e1158]
mov eax, dword fs:[0x2c]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x4df818]
cmp eax, dword [esi + 4]
jg 0x448f9e
mov eax, dword [0x4df820]
cmp eax, dword [esi + 4]
jg 0x448fd2
mov dword [ebp - 4], ebx
mov esi, dword [0x4df814]
test esi, esi
jne 0x448f34
mov esi, 0x4df814
mov ecx, esi
call fcn.00402daf
push esi
push 0x4a7284
push 1
push ebx
push 0x4a7274
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, dword [0x4df814]
test esi, esi
jne 0x448f34
push 2
pop eax
jmp 0x448f8f
mov eax, dword [0x4df81c]
test eax, eax
jne 0x448f64
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
mov ecx, 0x4df81c
call fcn.00402daf
push 0x4df81c
push esi
call edi
mov eax, dword [0x4df81c]
test eax, eax
jne 0x448f61
push 3
jmp 0x448f31
mov edi, dword [ebp - 0x14]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
cmp dword [edi], ebx
jne 0x448f73
push 4
jmp 0x448f31
or dword [ebp - 4], 0xffffffff
jmp 0x448f8d
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
push 0x4df818
call fcn.0046b989
pop ecx
cmp dword [0x4df818], 0xffffffff
jne 0x448ee7
push 0x49a736
call fcn.0046b77a
mov dword [esp], 0x4df818
call fcn.0046b93f
pop ecx
jmp 0x448ee7
mov esi, 0x4df820
push esi
call fcn.0046b989
pop ecx
cmp dword [0x4df820], 0xffffffff
jne 0x448ef8
push 0x49a746
call fcn.0046b77a
push esi
call fcn.0046b93f
pop ecx
pop ecx
jmp 0x448ef8
Function at 0x457416
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [0x4dfc80], 0
push esi
mov esi, 0x4dfc88
jne 0x45753b
push ebx
xor ebx, ebx
mov byte [0x4dfc80], 1
push ebx
push 0x13c
push esi
call fcn.0042a315
add esp, 0xc
mov dword [0x4dfc88], 0x11c
call fcn.0045762f
mov dword [0x4dfdc0], eax
mov eax, dword [0x4dfc48]
test eax, eax
je 0x45746c
push esi
call eax
test eax, eax
je 0x45747b
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45753a
push edi
push 6
pop edi
cmp dword [0x4dfc8c], edi
jb 0x4574c9
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.GetProductInfo
call fcn.0043407d
push eax
call fcn.00434095
add esp, 0xc
test al, al
je 0x4574c9
movzx eax, word [0x4dfd9e]
push 0x4dfda4
push eax
movzx eax, word [0x4dfd9c]
push eax
push dword [0x4dfc90]
push dword [0x4dfc8c]
call dword [ebp - 4]
cmp dword [0x4dfc8c], 5
jb 0x457539
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.GetNativeSystemInfo
call fcn.0043407d
push eax
call fcn.00434095
add esp, 0xc
test al, al
je 0x457539
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
mov eax, dword [ebp - 0x24]
mov dword [0x4dfda8], eax
mov eax, dword [ebp - 0x20]
mov dword [0x4dfdac], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x4dfdb0], eax
mov eax, dword [ebp - 0x18]
mov dword [0x4dfdb4], eax
mov eax, dword [ebp - 0x14]
mov dword [0x4dfdb8], eax
cmp word [ebp - 0x28], di
je 0x457532
cmp word [ebp - 0x28], 9
mov byte [0x4dfdbc], bl
jne 0x457539
mov byte [0x4dfdbc], 1
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret
Function at 0x458bb4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x224
mov ecx, dword [0x4e1158]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4dfc7c]
push edi
mov edi, 0x4dfc70
cmp eax, dword [ecx + 4]
jg 0x458ccd
cmp dword [0x4dfc74], 0
jg 0x458cb5
xor eax, eax
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x224]
mov ecx, edi
push eax
call fcn.0042f840
mov eax, dword [0x4dfc70]
mov esi, 0x49bb64
test eax, eax
mov ecx, esi
cmovne ecx, eax
push ecx
call fcn.004420e2
pop ecx
test al, al
jne 0x458cac
lea eax, [ebp - 0x18]
push eax
call fcn.00458b6f
mov ecx, esi
mov dword [esp], str.temp
cmp dword [eax], 0
cmovne ecx, dword [eax]
lea eax, [ebp - 0xc]
push ecx
push eax
call fcn.00444edd
add esp, 0xc
mov ecx, edi
push eax
call fcn.00425696
lea ecx, [ebp - 0xc]
call fcn.00426428
lea ecx, [ebp - 0x18]
call fcn.00426428
mov eax, dword [0x4dfc70]
mov ecx, esi
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004420e2
pop ecx
test al, al
jne 0x458cac
push closesocket
push str.c:_temp
mov ecx, edi
call fcn.0042fc81
mov eax, dword [0x4dfc70]
test eax, eax
cmovne esi, eax
push esi
call fcn.00441d6e
pop ecx
push 0x5c
mov ecx, edi
call fcn.00426f88
mov ecx, dword [ebp + 8]
call fcn.00428af1
mov ecx, dword [ebp + 8]
push edi
call fcn.0042f70d
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret
mov esi, 0x4dfc7c
push esi
call fcn.0046b989
cmp dword [0x4dfc7c], 0xffffffff
pop ecx
jne 0x458be4
mov ecx, edi
call fcn.00428af1
push 0x49a7a6
call fcn.0046b77a
push esi
call fcn.0046b93f
pop ecx
pop ecx
jmp 0x458be4
Function at 0x459ec4
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
jne 0x459ee4
push 0x2736
call fcn.0045bd3a
xor al, al
jmp 0x45a049
cmp dword [esi + 0x20], 0xffffffff
jne 0x459ef1
push 0x2726
jmp 0x459ed8
push ebx
push edi
call fcn.0045b1ac
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x459f16
mov ecx, dword [esi + 0xc]
shr ecx, 2
test cl, 1
jne 0x459f23
call fcn.0045a625
mov edi, eax
test edi, edi
je 0x459f23
xor eax, eax
cmp dword [edi], ebx
cmovne eax, edi
mov edi, eax
test edi, edi
jne 0x459f30
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.0045a9cf
jmp 0x459f93
cmp dword [edi + 4], ebx
lea eax, [esi + 0x1c]
push eax
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
mov ecx, 0x49bb60
cmovne ecx, dword [edi + 4]
push eax
push ecx
call fcn.00437d4f
mov ebx, eax
push ebx
call fcn.00438625
add esp, 0x14
test al, al
je 0x459f81
push ebx
call fcn.0043849d
push eax
push ebx
lea eax, [esi + 0x44]
push str.Failed_to_resolve_the_proxy_server__code__d:__s
push eax
call fcn.004284ae
add esp, 0x14
mov ecx, esi
push 0xfffffffffffffffe
call fcn.0045bd3a
jmp 0x459fce
push dword [edi + 0x1c]
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045a97a
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
sete bl
test eax, eax
je 0x459fd2
test edi, edi
je 0x459fd2
push closesocket
push str.Failed_to_connect_to_the_proxy_server.
lea ecx, [esi + 0x44]
call fcn.0042f72b
push 0xfffffffffffffffe
mov ecx, esi
call fcn.0045bd3a
and dword [esi + 0x10], 0xfffffffc
xor al, al
jmp 0x45a047
test bl, bl
je 0x45a018
test edi, edi
je 0x45a018
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x18]
or dword [esi + 0x10], 3
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00469b8e
push eax
lea ecx, [edi + 0x10]
call fcn.00408887
lea ecx, [ebp - 0x10]
call fcn.00426428
push edi
mov ecx, esi
call fcn.0045abf6
test al, al
jne 0x45a018
push 0xfffffffffffffffe
mov ecx, esi
call fcn.0045bd3a
xor bl, bl
mov ecx, dword [esi + 0x10]
mov eax, ecx
and eax, 0xfffffffe
or ecx, 1
test bl, bl
cmove ecx, eax
mov eax, ecx
or ecx, 2
and eax, 0xfffffffd
test bl, bl
cmove ecx, eax
mov dword [esi + 0x10], ecx
jne 0x45a045
test edi, edi
jne 0x45a045
mov ecx, esi
call fcn.0045bd28
mov al, bl
pop edi
pop ebx
pop esi
leave
ret
Function at 0x45a3eb
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push 1
push dword [ebp + 8]
call fcn.00469c65
test al, al
je 0x45a40c
mov al, 1
jmp 0x45a4ef
push ebx
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
call fcn.00430e83
pop ecx
test al, al
je 0x45a430
push 0x2726
call fcn.0045c360
pop ecx
xor al, al
jmp 0x45a4ee
lea ecx, [ebp - 0xc]
call fcn.00428af1
push closesocket
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0042f72b
lea ecx, [ebp - 0xc]
call fcn.00424f51
cmp dword [0x4dc8e0], ebx
je 0x45a46d
lea eax, [ebp - 0xc]
push eax
call fcn.0045a5ad
pop ecx
test al, al
je 0x45a46d
push 0x2afc
jmp 0x45a4b2
call fcn.0045c357
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x45a496
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2afc
jne 0x45a4e4
lea eax, [ebp - 0xc]
push eax
call fcn.0045a4f2
jmp 0x45a4b7
cmp word [eax + 8], 2
jne 0x45a4a4
cmp word [eax + 0xa], 4
je 0x45a4ba
call sub.WS2_32.dll_WSAGetLastError
test eax, eax
jne 0x45a4e4
push 0x273e
call fcn.0045c360
pop ecx
jmp 0x45a4e4
mov eax, dword [eax + 0xc]
mov ecx, esi
mov edx, dword [eax]
movzx eax, byte [edx + 3]
push eax
movzx eax, byte [edx + 2]
push eax
movzx eax, byte [edx + 1]
push eax
movzx eax, byte [edx]
push eax
call fcn.00469c23
mov ecx, esi
call fcn.00439206
xor al, 1
mov bl, al
lea ecx, [ebp - 0xc]
call fcn.00426428
mov al, bl
pop ebx
pop esi
leave
ret

Function at 0x45a64f
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [0x4dfdfc]
mov ecx, 0x49bb60
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x45a66d
push 3
pop eax
ret
cmp word [eax + 8], 2
je 0x45a678
push 4
pop eax
ret
cmp word [eax + 0xa], 4
je 0x45a683
push 5
pop eax
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
mov ecx, 0x4dfe08
push eax
call fcn.00469c23
xor eax, eax
ret
Function at 0x45a7f6
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4dc8f8]
sub esp, 0x1a0
cmp eax, 6
jne 0x45a934
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x45a832
xor eax, eax
mov dword [0x4dc8f8], 1
inc eax
leave
ret
push ebx
push esi
push edi
push 0x45a936
call fcn.0046b77a
pop ecx
push 0x63
mov esi, 0x4dfdfc
push 0x64
mov ecx, esi
call fcn.00423af0
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
mov ecx, esi
call fcn.004296c6
push 1
xor edi, edi
mov dword [ebp - 0x10], 0x49be28
push str.Ws2_32.dll
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00434277
mov ebx, 0x4dfdcc
test al, al
je 0x45a8bd
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push str.GetHostNameW
lea ecx, [ebp - 0x10]
call fcn.0043420b
test al, al
je 0x45a8bd
mov esi, dword [ebp - 4]
mov ecx, ebx
push 0x63
push 0xc8
call fcn.00423af0
push eax
call esi
mov ecx, ebx
call fcn.004296e1
mov esi, 0x4dfdfc
cmp dword [0x4dfdd0], edi
jg 0x45a8d0
push edi
push ebx
push esi
call fcn.004593b8
add esp, 0xc
mov eax, dword [0x4dfdfc]
mov ecx, 0x49bb60
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x45a913
push dword [eax]
mov esi, 0x4dfdf0
mov ecx, esi
call fcn.0042f7db
mov ecx, esi
call fcn.00431718
mov ecx, esi
call fcn.00431700
push 1
push 0x2e
push 0x20
mov ecx, esi
call fcn.0042df4d
call fcn.0045a64f
mov esi, eax
mov dword [ebp - 0x10], 0x49be28
lea ecx, [ebp - 0x10]
mov dword [0x4dc8f8], esi
call fcn.00433fff
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45b1c9
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x45b3cd
and dword [ebp - 4], 0
mov ebx, dword [ebp + 0x10]
test bl, 4
je 0x45b1fa
mov dword [ebp - 4], edi
test bl, 8
jne 0x45b1fa
mov ecx, edi
call fcn.00426428
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, 0xfffff
ja 0x45b3cd
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x45b222
test byte [esi + 0x10], 1
jne 0x45b222
push 0x2749
jmp 0x45b3d2
and dword [esi + 0x14], 0
and dword [ebp - 0xc], 0
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
mov ecx, esi
mov al, bl
and al, 1
mov byte [ebp + 0xb], al
mov eax, ebx
shr eax, 1
and eax, 0xffffff01
mov dword [ebp - 0x20], eax
call fcn.0045b434
mov dword [ebp - 0x14], eax
mov eax, ebx
shr eax, 3
and eax, 2
mov dword [ebp + 0x10], 0xa
mov ecx, eax
or ecx, 1
and bl, 0x20
mov ebx, dword [ebp - 0xc]
cmove ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, esi
call fcn.0045b3e2
mov dword [ebp - 0xc], eax
test eax, eax
jg 0x45b2ec
js 0x45b3c5
cmp byte [ebp + 0xb], 0
jne 0x45b3c5
push dword [ebp - 0x10]
call fcn.00458a23
pop ecx
cmp eax, dword [esi + 0x30]
jae 0x45b3b9
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x45b2b2
test byte [esi + 0x10], 1
je 0x45b3a5
mov ecx, esi
call fcn.0045a60a
test al, al
jne 0x45b3b2
push dword [ebp + 0x10]
call fcn.00458897
add dword [ebp + 0x10], 5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], 0x3c
push eax
call fcn.004018bc
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp + 0x10], eax
jmp 0x45b26f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042326a
mov ecx, eax
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp + 0x10], ecx
test eax, eax
jne 0x45b310
mov eax, edi
jmp 0x45b323
push ecx
mov ecx, eax
call fcn.004286d6
test eax, eax
je 0x45b3c9
mov ecx, dword [ebp + 0x10]
push 0
push 0
push dword [ebp - 0x18]
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x45b344
mov ecx, esi
call fcn.0045bd28
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x45b36f
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00402d9d
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
sub ecx, eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.00426858
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
jle 0x45b3c5
add ebx, eax
cmp byte [ebp - 0x20], 0
jne 0x45b383
cmp eax, dword [ebp - 0xc]
jge 0x45b3c5
mov edx, dword [ebp + 0xc]
sub edx, eax
mov dword [ebp + 0xc], edx
test edx, edx
jle 0x45b3c5
mov dword [ebp + 0x10], 0xa
test ecx, ecx
jne 0x45b26f
add edi, eax
jmp 0x45b26f
cmp dword [esi + 0x14], 0
jne 0x45b3c5
push 0x2749
jmp 0x45b3be
push 0x2746
jmp 0x45b3be
push 0x274c
mov ecx, esi
call fcn.0045bd3a
mov eax, ebx
jmp 0x45b3db
push 8
jmp 0x45b3be
push 0x2726
mov ecx, esi
call fcn.0045bd3a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45b3e2
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x45b407
test byte [esi + 0x10], 1
jne 0x45b407
push 0x2749
call fcn.0045bd3a
or eax, 0xffffffff
jmp 0x45b431
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x45b42e
mov ecx, esi
call fcn.0045bd28
and dword [esi + 0x10], 0xfffffffe
jmp 0x45b402
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x45baa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
je 0x45bc15
mov edi, dword [ebp + 0xc]
cmp edi, 0x7fffffff
jne 0x45bacd
push ebx
call fcn.004311f0
mov edi, eax
pop ecx
mov dword [ebp + 0xc], edi
test edi, edi
jle 0x45bc15
mov ecx, dword [esi + 0xc]
shr ecx, 1
test cl, 1
jne 0x45baf2
mov eax, dword [esi + 0x10]
shr eax, 1
test al, 1
jne 0x45baf2
push 0x2749
jmp 0x45bc1a
mov ecx, esi
call fcn.0045bc2a
mov ecx, dword [esi + 0xc]
shr ecx, 1
mov dword [ebp - 8], eax
test cl, 1
je 0x45bb11
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0045a9cf
mov byte [ebp - 1], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004018e2
pop ecx
pop ecx
mov ecx, dword [esi + 0xc]
shr ecx, 1
test cl, 1
je 0x45bb43
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_sendto]
jmp 0x45bb50
push 0
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x45bbbb
mov ecx, esi
call fcn.0045bd28
cmp dword [esi + 0x14], 0x2733
jne 0x45bb79
mov ecx, esi
call fcn.0045a974
test al, al
jne 0x45bbce
push 0xa
call fcn.00458897
pop ecx
jmp 0x45bb15
cmp dword [esi + 0x14], 0x2747
jne 0x45bbce
cmp byte [ebp - 1], 0
jne 0x45bbce
mov eax, 0x1000
cmp dword [ebp - 8], eax
jle 0x45bbce
push eax
mov ecx, esi
mov byte [ebp - 1], 1
mov dword [ebp - 8], eax
call fcn.0045bc52
push 0x2747
mov ecx, esi
mov bl, al
call fcn.0045bd3a
test bl, bl
je 0x45bbce
mov ebx, dword [ebp + 8]
jmp 0x45bb15
sub edi, eax
mov dword [ebp + 0xc], edi
test edi, edi
jle 0x45bc11
add ebx, eax
mov dword [ebp + 8], ebx
jmp 0x45bb15
mov eax, dword [esi + 0x14]
cmp eax, 0x2746
jg 0x45bbf6
cmp eax, 0x2744
jge 0x45bc08
sub eax, 0x271e
je 0x45bbf0
sub eax, 0x15
je 0x45bc11
sub eax, 0xf
je 0x45bc08
and dword [esi + 0x10], 0xfffffffd
jmp 0x45bc21
sub eax, 0x274a
je 0x45bbf0
dec eax
sub eax, 1
je 0x45bc08
sub eax, 5
jne 0x45bbf0
mov ecx, esi
call fcn.00459e89
jmp 0x45bc21
mov al, 1
jmp 0x45bc23
push 0x2726
mov ecx, esi
call fcn.0045bd3a
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8