joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497cb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
push edi
jmp 0x497cca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x497cd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497cc0
mov eax, 1
add ebx, ebx
jne 0x497ce3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x497cf4
jne 0x497d13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497d13
dec eax
add ebx, ebx
jne 0x497d00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x497cd8
add ebx, ebx
jne 0x497d0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x497d65
xor ecx, ecx
sub eax, 3
jb 0x497d2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x497d9a
sar eax, 1
mov ebp, eax
jmp 0x497d36
add ebx, ebx
jne 0x497d36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497d04
inc ecx
add ebx, ebx
jne 0x497d44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497d04
add ebx, ebx
jne 0x497d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x497d46
jne 0x497d62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x497d46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x497d84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x497d76
jmp 0x497cc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x497d84
add edi, ecx
jmp 0x497cc6
pop esi
mov edi, esi
mov ecx, 0x2cc1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x497da2
cmp byte [edi], 0x11
jne 0x497da2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x497da7
lea edi, [esi + 0x94000]
mov eax, dword [edi]
or eax, eax
je 0x497e1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9c254]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9c36c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x497dd4
mov ecx, edi
jns 0x497e03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9c370]
or eax, eax
je 0x497e19
mov dword [ebx], eax
add ebx, 4
jmp 0x497df1
call dword [esi + 0x9c380]
mov ebp, dword [esi + 0x9c374]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x497e53
sub esp, 0xffffff80
jmp 0x454d5d

Function at 0x5f4d19
Capabilities:
Encode data using xor

Disassembly:
push 1
pop ecx
cmp dword [esp + 8], ecx
jl 0x5f4d39
mov eax, dword [esp + 4]
mov edx, ecx
and edx, 3
mov dl, byte [esp + edx + 0xc]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, dword [esp + 8]
jle 0x5f4d26
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x402e10
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
sub esp, 0x1c
push esi
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
lea ecx, [esp + 8]
push eax
push str.YXW_AdPopWin_
push str._s_d
push ecx
call fcn.00439807
add esp, 0x10
lea edx, [esp + 8]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x402e7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402e7e
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x404290
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x463838]
cmp eax, 0x1c00
jle 0x4042c7
lea eax, [esp]
push 0
push eax
push 0x461838
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
push eax
push 0x461838
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov dword [0x463838], eax
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea edx, [eax + 0x461838]
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
add dword [0x463838], eax
pop ecx
ret

Function at 0x4042f0
Capabilities:
Create process memory minidump
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d768
push 0x439988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp esi, edi
jne 0x404382
mov dword [ebp - 4], edi
push str.raising_exception_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push edi
push edi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.KERNEL32.dll_RaiseException]
push str.writing_minidump_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
push edi
push edi
lea edx, [ebp - 0x24]
push edx
push 0x100
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4043d0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
lea eax, [esp + 0x2c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x34]
mov eax, 0x40000000
xor edx, edx
mov esi, 0
div edi
mov ebp, esi
mov dword [esp + 0x10], 1
mov ebx, eax
shl ebx, 2
je 0x40446b
mov edx, esi
lea ecx, [esp + 0x14]
imul edx, edi
push 0x1c
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40445c
mov eax, dword [esp + 0x20]
test eax, eax
jbe 0x40445c
xor edx, edx
div edi
add esi, eax
mov eax, dword [esp + 0x24]
cmp eax, 0x1000
jne 0x404467
mov eax, dword [esp + 0x18]
cmp eax, ebp
jbe 0x404467
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x58]
push ecx
push eax
push edx
mov ebp, eax
call fcn.00404480
add esp, 0xc
test al, al
je 0x404467
inc dword [esp + 0x10]
jmp 0x404467
mov eax, 0x10000
xor edx, edx
div edi
add esi, eax
cmp esi, ebx
jb 0x404405
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x404840
Capabilities:
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
sub esp, 0x3f0
lea eax, [esp + 4]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
lea eax, [esp + 0xcc]
push edx
push eax
call fcn.004047b0
mov esi, dword [esp + 0x40c]
add esp, 0xc
lea ecx, [esp + 0xc8]
push ecx
push str.Error_occurred_at__s._r_n
push esi
call fcn.00404290
add esp, 0xc
lea edx, [esp + 0x1f4]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x1f4]
push 0x206
push edx
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
ja 0x4048c8
lea eax, [esp + 0x1f4]
push str.Unknown
push eax
call ebx
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x12c]
lea edx, [esp + 0x12c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0xc6
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x404906
lea eax, [esp + 0x12c]
push str.Unknown
push eax
call ebx
lea ecx, [esp + 0x12c]
lea edx, [esp + 0x1f4]
push ecx
push edx
push str._s__run_by__s._r_n
push esi
call fcn.00404290
lea eax, [esp + 0x70]
lea ecx, [esp + 0x48]
push eax
lea edx, [esp + 0xa8]
push ecx
push edx
call fcn.00406910
add esp, 0x1c
lea eax, [esp + 0x60]
lea ecx, [esp + 0x94]
push eax
push ecx
push str.Operating_system:___s___s_._r_n
push esi
call fcn.00404290
add esp, 0x10
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
push eax
push ecx
push str._d_processor_s___type__d._r_n
push esi
call fcn.00404290
add esp, 0x10
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x20
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x1c]
push eax
push str._d___memory_in_use._r_n
push esi
call fcn.00404290
mov ecx, dword [esp + 0x2c]
add esp, 0xc
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str._d_MBytes_physical_memory._r_n
push esi
call fcn.00404290
mov edx, dword [esp + 0x30]
add esp, 0xc
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_physical_memory_free._r_n
push esi
call fcn.00404290
mov eax, dword [esp + 0x34]
add esp, 0xc
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_paging_file._r_n
push esi
call fcn.00404290
mov ecx, dword [esp + 0x38]
add esp, 0xc
add ecx, 0xfffff
shr ecx, 0x14
push ecx
push str._d_MBytes_paging_file_free._r_n
push esi
call fcn.00404290
mov edx, dword [esp + 0x3c]
add esp, 0xc
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_user_address_space._r_n
push esi
call fcn.00404290
mov eax, dword [esp + 0x40]
add esp, 0xc
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space_free._r_n
push esi
call fcn.00404290
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x3f0
ret
Function at 0x404a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc0
mov edx, dword [esp + 0xc4]
mov dword [esp], 0x40010005
mov dword [esp + 4], str.a_Control_C
mov dword [esp + 8], 0x40010008
mov dword [esp + 0xc], str.a_Control_Break
mov dword [esp + 0x10], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], str.a_Datatype_Misalignment
mov dword [esp + 0x18], reloc.WS2_32.dll_closesocket
mov dword [esp + 0x1c], str.a_Breakpoint
mov dword [esp + 0x20], 0xc0000005
mov dword [esp + 0x24], str.an_Access_Violation
mov dword [esp + 0x28], 0xc0000006
mov dword [esp + 0x2c], str.an_In_Page_Error
mov dword [esp + 0x30], 0xc0000017
mov dword [esp + 0x34], str.a_No_Memory
mov dword [esp + 0x38], 0xc000001d
mov dword [esp + 0x3c], str.an_Illegal_Instruction
mov dword [esp + 0x40], 0xc0000025
mov dword [esp + 0x44], str.a_Noncontinuable_Exception
mov dword [esp + 0x48], 0xc0000026
mov dword [esp + 0x4c], str.an_Invalid_Disposition
mov dword [esp + 0x50], 0xc000008c
mov dword [esp + 0x54], str.a_Array_Bounds_Exceeded
mov dword [esp + 0x58], 0xc000008d
mov dword [esp + 0x5c], str.a_Float_Denormal_Operand
mov dword [esp + 0x60], 0xc000008e
mov dword [esp + 0x64], str.a_Float_Divide_by_Zero
mov dword [esp + 0x68], 0xc000008f
mov dword [esp + 0x6c], str.a_Float_Inexact_Result
mov dword [esp + 0x70], 0xc0000090
mov dword [esp + 0x74], str.a_Float_Invalid_Operation
mov dword [esp + 0x78], 0xc0000091
mov dword [esp + 0x7c], str.a_Float_Overflow
mov dword [esp + 0x80], 0xc0000092
mov dword [esp + 0x84], str.a_Float_Stack_Check
mov dword [esp + 0x88], 0xc0000093
mov dword [esp + 0x8c], str.a_Float_Underflow
mov dword [esp + 0x90], 0xc0000094
mov dword [esp + 0x94], str.an_Integer_Divide_by_Zero
mov dword [esp + 0x98], 0xc0000095
mov dword [esp + 0x9c], str.an_Integer_Overflow
mov dword [esp + 0xa0], 0xc0000096
mov dword [esp + 0xa4], str.a_Privileged_Instruction
mov dword [esp + 0xa8], 0xc00000fd
mov dword [esp + 0xac], str.a_Stack_Overflow
mov dword [esp + 0xb0], 0xc0000142
mov dword [esp + 0xb4], str.a_DLL_Initialization_Failed
mov dword [esp + 0xb8], 0xe06d7363
mov dword [esp + 0xbc], str.a_Microsoft_C_Exception
xor eax, eax
lea ecx, [esp]
cmp edx, dword [ecx]
je 0x404c2c
inc eax
add ecx, 8
cmp eax, 0x18
jb 0x404c13
mov eax, str.an_Unknown_exception_type
add esp, 0xc0
ret
mov eax, dword [esp + eax*8 + 4]
add esp, 0xc0
ret
Function at 0x408080
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d878
push 0x439988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
push edi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4080c0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
mov byte [ebp - 0x224], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
mov dword [ebp - 0x238], ebx
test ebx, ebx
je 0x408151
push 0
push 0x84000100
mov edi, str.Accept:___r_n_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Accept:___r_n_r_n
push str.http:__iframe.ip138.com_ic.asp
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
mov dword [ebp - 0x234], esi
test esi, esi
je 0x408151
lea eax, [ebp - 0x24]
push eax
push 0x1ff
lea ecx, [ebp - 0x224]
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 4], 0xffffffff
call fcn.00408194
push 0x457d80
lea edx, [ebp - 0x224]
push edx
call fcn.0043a430
add esp, 8
mov esi, eax
test esi, esi
jne 0x4081ab
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x457d80
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add esi, ecx
push 0x457d7c
push esi
call fcn.0043a430
add esp, 8
sub eax, esi
cmp eax, 0x2f
jle 0x4081d6
mov eax, 0x2f
push eax
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.0043a240
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4089a0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x38
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, ecx
push eax
lea ebp, [esi + 0x28]
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x408ab6
push edi
lea edi, [ebx + 1]
push edi
call fcn.0043a903
mov edx, eax
mov ecx, edi
mov dword [esi], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
push eax
push ebx
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
je 0x408ab6
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00408cb0
test eax, eax
je 0x408ab6
mov eax, dword [esp + 0x18]
mov ecx, eax
mov word [esi + 0xa], ax
mov eax, dword [esp + 0x1c]
shr ecx, 0x10
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x20]
mov word [esi + 8], cx
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x24]
shr edx, 0x10
shr ecx, 0x10
mov word [esi + 0xc], dx
mov word [esi + 0x10], cx
mov ecx, dword [esp + 0x30]
mov edx, eax
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x2c]
shr edx, 0x10
mov dword [esi + 0x1c], ecx
lea ecx, [esi + 0x230]
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x38]
push ecx
push str.CompanyName
mov ecx, esi
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
call fcn.00408d00
lea edx, [esi + 0x640]
mov ecx, esi
push edx
push str.FileDescription
call fcn.00408d00
lea eax, [esi + 0x438]
mov ecx, esi
push eax
push str.ProductName
call fcn.00408d00
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x38
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x38
ret
Function at 0x40f660
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x7c
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0x24]
push 0x64
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x40f80d
mov esi, dword [esp + 0x8c]
lea edx, [esp + 0xc]
push ebp
push edx
push 1
push 0x4571f8
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebx + 0x24]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov al, byte [ebx + 0x64]
test al, al
je 0x40f7b6
mov eax, dword [ebx + 0x68]
test eax, eax
mov eax, dword [esp + 0x24]
je 0x40f6da
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x14]
push str.Arial
push 0
push 0
push 0
push 0
sub eax, ebp
push 1
push 0
push 0
cdq
push 0
push 0x2bc
sub eax, edx
push 0
push 0
push 0
sar eax, 1
push 0x10
mov dword [esp + 0x54], eax
call dword [sym.imp.GDI32.dll_CreateFontA]
xor ebp, ebp
test eax, eax
je 0x40f721
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, eax
push 0xffffff
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov cl, byte [ebx + 0x65]
xor edx, edx
test cl, cl
setne dl
or edx, 4
lea eax, [esp + 0x18]
push edx
push eax
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
push 0xffffffffffffffff
lea edx, [esp + 0x1c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
push 0x734207
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov cl, byte [ebx + 0x65]
xor eax, eax
test cl, cl
setne al
or al, 4
lea ecx, [esp + 0x18]
push eax
push ecx
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
test ebp, ebp
je 0x40f7b6
push ebp
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [ebx + 0x68]
pop ebp
test ebx, ebx
je 0x40f80d
mov eax, dword [esp + 0x20]
cmp eax, 0x24
jl 0x40f7ec
add eax, 0xffffffe0
push 3
cdq
push 0
sub eax, edx
push 0
push 0x20
sar eax, 1
push 0x20
push ebx
push eax
push eax
push esi
call dword [sym.imp.USER32.dll_DrawIconEx]
pop edi
pop esi
pop ebx
add esp, 0x7c
ret 8
cmp eax, 0x14
jl 0x40f80d
add eax, 0xfffffff0
push 3
cdq
push 0
sub eax, edx
push 0
push 0x10
sar eax, 1
push 0x10
push ebx
push eax
push eax
push esi
call dword [sym.imp.USER32.dll_DrawIconEx]
pop edi
pop esi
pop ebx
add esp, 0x7c
ret 8
Function at 0x415ef0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x415f12
mov ecx, esi
call fcn.00415f40
xor al, al
pop esi
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x415f31
mov ecx, esi
call fcn.00415f40
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x415f70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edx, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x410], bl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
push 0x400
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [edx + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x41600d
mov eax, dword [ebp + 8]
mov dl, byte [eax]
cmp dl, byte [ebp - 0x410]
jne 0x41600d
mov cl, byte [eax + 1]
cmp cl, byte [ebp - 0x40f]
jne 0x41600d
mov dl, byte [eax + 2]
cmp dl, byte [ebp - 0x40e]
jne 0x41600d
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419fb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], 0
je 0x41a18a
test byte [esp + 0x2c], 0x10
je 0x41a0a0
push 0x45712c
push ebx
call fcn.00439c09
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41a18a
push 2
push 0
push ebx
call fcn.0043bc78
push ebx
call fcn.0043baf5
push 0
push 0
push ebx
mov edi, eax
call fcn.0043bc78
push edi
call fcn.0043a903
mov esi, eax
add esp, 0x20
test esi, esi
je 0x41a08d
push ebx
push edi
push 1
push esi
call fcn.0043b21c
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp eax, 2
jne 0x41a045
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
push edi
push esi
call fcn.0041a4c0
jmp 0x41a07d
cmp eax, 3
jne 0x41a062
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
push edi
push esi
call fcn.0041a1a0
jmp 0x41a07d
cmp eax, 1
jne 0x41a084
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
push edi
push esi
call fcn.0041a6d0
add esp, 0x14
mov dword [esp + 0x10], eax
push esi
call fcn.00419740
add esp, 4
push ebx
call fcn.00439b1f
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x41a0b1
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0x4584e0
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x41a0f4
push str.DATA
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x41a0f4
push str.IMAGES
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x41a0f4
push 2
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
je 0x41a18a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x41a18a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x20]
cmp ecx, 2
jne 0x41a13a
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push ecx
push edi
push eax
call fcn.0041a4c0
jmp 0x41a172
cmp ecx, 3
jne 0x41a157
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push edi
push eax
call fcn.0041a1a0
jmp 0x41a172
cmp ecx, 1
jne 0x41a179
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push ecx
push edi
push eax
call fcn.0041a6d0
add esp, 0x14
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret