joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ec0
Capabilities:
Read .ini file

Disassembly:
sub esp, 8
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x467980
push 0x64
push 0x466a30
push str.Properties
push str.PROPERTIES
push 0x44d518
mov dword [esi + 0x2762], eax
call ebx
mov ecx, dword [esi + 0x2762]
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push 0x466a30
push 0x800
push 0
push ecx
call edi
push 0x467980
push 0x64
push 0x466a30
push str.TCPIP_Over_Radio_SetUp
push 0x44d538
push 0x44d540
call ebx
mov edx, dword [esi + 0x2762]
push 0x466a30
push 0x2000
push 0
push edx
call edi
push 0x467980
push 0x64
push 0x466a30
push str.Startup_Programs
push 0x44d55c
push 0x44d560
call ebx
mov eax, dword [esi + 0x2762]
push 0x466a30
push 0x4000
push 0
push eax
call edi
push 0x467980
push 0x64
push 0x466a30
push str.Setup_Interfaces
push str.WSOCIF
push 0x44d584
call ebx
mov ecx, dword [esi + 0x2762]
push 0x466a30
push 0x8000
push 0
push ecx
call edi
mov edx, dword [esi + 0x2762]
push 0x44d58c
push 0
push 0x800
push edx
call edi
push 0x467980
push 0x64
push 0x466a30
push str.SoundCard_Tuning_Aid
push str.SCTUNE
push 0x44d5b0
call ebx
mov eax, dword [esi + 0x328]
push 0x466a30
push 0x1389
test eax, eax
je 0x407004
mov eax, dword [esi + 0x2762]
push 0
push eax
jmp 0x40700d
mov ecx, dword [esi + 0x2762]
push 1
push ecx
call edi
push 0x467980
push 0x64
push 0x466a30
push 0x44d5b8
push 0x44d5c8
push 0x44d5d4
call ebx
mov edx, dword [esi + 0x2762]
push 0x466a30
push 0x400
push 0
push edx
call edi
push 0x467980
push 0x64
push 0x466a30
push str.LinkAX25_Status
push str.AXSTATUS
push 0x44d5fc
call ebx
mov eax, dword [esi + 0x2762]
push 0x466a30
push 0x200
push 0
push eax
call edi
push 0x467980
push 0x64
push 0x466a30
push str.About
push str.ABOUT
push 0x44d614
call ebx
mov ecx, dword [esi + 0x2762]
push 0x466a30
push 0x80
push 0
push ecx
call edi
push 0x467980
push 0xff
push 0x466a30
push 0x44d61c
push str.HELP
push 0x44d62c
call ebx
mov edx, dword [esi + 0x2762]
push 0x466a30
push 0x1000
push 0
push edx
call edi
mov eax, dword [esi + 0x2762]
push 0x44d634
push 0
push 0x800
push eax
call edi
push 0x467980
push 0xff
push 0x466a30
push str.Launch_IBrowser
push 0x44d64c
push 0x44d654
call ebx
mov ecx, dword [esi + 0x2762]
push 0x466a30
push 0x1388
push 0
push ecx
call edi
mov edx, dword [esi + 0x2762]
push 0x44d65c
push 0
push 0x800
push edx
call edi
push 0x467980
push 0xff
push 0x466a30
push str.Exit
push str.EXIT
push str.MENU
call ebx
mov eax, dword [esi + 0x2762]
push 0x466a30
push 0x10
push 0
push eax
call edi
mov ecx, dword [esi + 0x32c]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [esi + 0x32c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
push edx
mov edx, dword [esi + 0x2762]
push eax
push ecx
push 0x2100
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov edi, eax
mov eax, dword [esi + 0x2762]
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
push edi
mov ecx, esi
call fcn.00406700
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4071c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x444dcf
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x4668f8
push 0x7d1
push 0x44d6f8
push 0x44d700
mov esi, ecx
call edi
push 0x4668f8
push 0xa
push 0x44d708
push 0x44d710
mov ebx, eax
call edi
cmp ebx, dword [0x467a98]
jne 0x407222
cmp eax, dword [0x467a9c]
je 0x4072c7
mov eax, dword [0x467978]
mov ecx, dword [esi + 0x32c]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0040bf80
lea ecx, [esp + 0xc]
mov dword [esp + 0x8c], 0
call fcn.00412bf0
cmp eax, 2
jne 0x407265
mov edx, dword [esi + 0x32c]
push 0
push 0
push eax
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4072c7
mov eax, dword [0x467a98]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x24]
push 0x44d718
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0xc
push 0x4668f8
lea edx, [esp + 0x24]
push edx
push str.MAJOR
push 0x44d724
call edi
mov eax, dword [0x467a9c]
push eax
lea ecx, [esp + 0x24]
push 0x44d72c
push ecx
call esi
add esp, 0xc
push 0x4668f8
lea edx, [esp + 0x24]
push edx
push str.MINOR
push str.VERSION
call edi
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x84
ret
Function at 0x40a910
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x444edb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
or ebx, 0xffffffff
push 0x10
mov edi, ecx
mov dword [esp + 0x14], ebx
call fcn.004394a2
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x40a967
movzx ecx, byte [edi + 0xde]
imul ecx, ecx, 7
add ecx, 0x10
push ecx
mov ecx, eax
call fcn.004246e0
mov esi, eax
jmp 0x40a969
xor esi, esi
test esi, esi
mov dword [esp + 0x20], ebx
jne 0x40a977
push esi
call fcn.00439b8d
mov cl, byte [edi + 0x1b]
mov al, cl
and al, 0xf
cmp al, 1
mov byte [esp + 0xf], cl
je 0x40a98e
cmp al, 5
je 0x40a98e
cmp al, 9
jne 0x40a99a
mov dl, byte [edi + 0x19]
shl dl, 5
or cl, dl
mov byte [esp + 0xf], cl
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dl, byte [edi + 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [esi + 8]
inc ecx
push 7
lea eax, [edi + 0x11]
mov dword [esi + 8], ecx
push eax
mov ecx, esi
call fcn.00424750
push 7
lea ecx, [edi + 0xa]
push ecx
mov ecx, esi
call fcn.00424750
mov al, byte [edi + 0xde]
test al, al
je 0x40a9fa
xor ebx, ebx
test al, al
jbe 0x40a9fa
push ebp
lea ebp, [edi + 0xdf]
mov edi, edi
push 7
push ebp
mov ecx, esi
call fcn.00424750
movzx edx, byte [edi + 0xde]
inc ebx
add ebp, 0xa
cmp ebx, edx
jl 0x40a9e0
pop ebp
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
lea eax, [eax + ecx - 1]
mov cl, byte [eax]
or cl, 1
push 1
lea edx, [esp + 0x13]
mov byte [eax], cl
push edx
mov ecx, esi
call fcn.00424750
xor eax, eax
mov ax, word [edi + 0x1b]
and eax, 0x100
test ax, ax
mov eax, dword [esi + 0xc]
je 0x40aa52
or byte [eax + 7], 0x80
mov eax, dword [esi + 0xc]
mov bl, byte [eax + 0xe]
lea ecx, [edi + 0x139]
or bl, 0x60
push ecx
mov byte [eax + 0xe], bl
mov dword [esp + 0x14], 0
push str.AX25_COMMAND__s
jmp 0x40aa6e
or byte [eax + 0xe], 0x80
mov eax, dword [esi + 0xc]
mov cl, byte [eax + 7]
lea edx, [edi + 0x139]
or cl, 0x60
push edx
mov byte [eax + 7], cl
push str.AX25_RESPONSE__s
call fcn.00436550
mov eax, dword [esi + 0xc]
mov cl, byte [eax + 7]
and cl, 0xfe
add esp, 8
mov byte [eax + 7], cl
mov ecx, dword [edi + 0x150]
push esi
call fcn.00424a50
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40aab0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x444ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov al, byte [edi + 0x14f]
lea esi, [edi + 0x61]
mov ecx, esi
mov byte [esp + 0xb], al
call fcn.004248e0
mov ecx, eax
test ecx, ecx
mov dword [esp + 0xc], ecx
jne 0x40aafe
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [edi + 0xa6]
cmp ecx, eax
jle 0x40ab0c
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
test eax, eax
push ebp
mov ebp, dword [esi]
mov dword [esp + 0x1c], ebx
jle 0x40ac87
test ebp, ebp
je 0x40ac87
push 0x10
call fcn.004394a2
add esp, 4
mov dword [esp + 0x18], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x28], esi
je 0x40ab5d
movzx ecx, byte [edi + 0xde]
mov edx, dword [ebp + 8]
imul ecx, ecx, 7
lea ecx, [ecx + edx + 0x43]
push ecx
mov ecx, eax
call fcn.004246e0
mov esi, eax
test esi, esi
mov dword [esp + 0x28], 0xffffffff
je 0x40ac9f
mov edx, dword [esi + 8]
mov cl, byte [edi + 0x18]
mov eax, dword [esi + 0xc]
mov byte [edx + eax], cl
mov eax, dword [esi + 8]
push 7
lea edx, [edi + 0x11]
inc eax
push edx
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00424750
push 7
lea eax, [edi + 0xa]
push eax
mov ecx, esi
call fcn.00424750
mov al, byte [edi + 0xde]
test al, al
je 0x40abdd
xor ebx, ebx
test al, al
jbe 0x40abd9
lea ecx, [edi + 0xdf]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
push 7
push edx
mov ecx, esi
call fcn.00424750
mov edx, dword [esp + 0x18]
movzx eax, byte [edi + 0xde]
inc ebx
add edx, 0xa
cmp ebx, eax
mov dword [esp + 0x18], edx
jl 0x40abb4
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
lea eax, [ecx + edx - 1]
or byte [eax], 1
mov al, byte [edi + 0x1a]
mov cl, byte [edi + 0x19]
add al, bl
shl al, 1
shl cl, 5
and al, 0xe
or al, cl
mov ecx, dword [edi + 0x9a]
test ecx, ecx
mov byte [esp + 0x12], al
jne 0x40ac18
mov edx, dword [esp + 0x14]
dec edx
cmp ebx, edx
jne 0x40ac18
or al, 0x10
mov byte [esp + 0x12], al
push 1
lea eax, [esp + 0x16]
push eax
mov ecx, esi
call fcn.00424750
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
test al, al
je 0x40ac33
mov byte [esp + 0x13], al
push 1
lea edx, [esp + 0x17]
push edx
mov ecx, esi
call fcn.00424750
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
dec eax
inc ecx
push eax
push ecx
mov ecx, esi
call fcn.00424750
mov eax, dword [esi + 0xc]
or byte [eax + 7], 0x80
mov eax, dword [esi + 0xc]
and byte [eax + 7], 0xfe
mov eax, dword [esi + 0xc]
or byte [eax + 0xe], 0x60
mov ecx, dword [edi + 0x150]
push esi
call fcn.00424a50
mov eax, dword [esp + 0x14]
mov ebp, dword [ebp]
inc ebx
cmp ebx, eax
mov dword [esp + 0x1c], ebx
jl 0x40ab22
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
pop ebp
pop ebx
pop edi
dec eax
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
push 0
call fcn.00439b8d
int3
Function at 0x40b870
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x444f05
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 1], 4
push edi
jae 0x40b89d
mov dword [esi + 0x21], 1
jmp 0x40b9f2
mov al, byte [esi + 0xde]
mov edi, dword [esp + 0x20]
mov ecx, dword [edi + 0xc]
movzx eax, al
imul eax, eax, 7
mov bl, byte [eax + ecx + 0xf]
mov byte [esp + 0x20], bl
mov edx, dword [esp + 0x20]
push edx
mov ecx, esi
call fcn.0040acb0
mov cl, byte [esi + 0xde]
mov edx, dword [edi + 0xc]
movzx eax, cl
imul eax, eax, 7
mov al, byte [eax + edx + 0x10]
mov dl, bl
shr dl, 1
mov byte [esi + 0x14f], al
mov al, byte [esi + 0x19]
and dl, 7
cmp al, dl
jne 0x40b9d1
movzx cx, cl
inc al
and al, 7
mov byte [esi + 0x19], al
xor eax, eax
mov ax, word [edi + 8]
push 0x10
imul ecx, ecx, 7
sub ax, cx
sub eax, 0x11
movzx ebp, ax
add dword [esi + 0x89], ebp
call fcn.004394a2
add esp, 4
mov dword [esp + 0x20], eax
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x18], ecx
je 0x40b93b
lea edx, [ebp + 0xa]
push edx
mov ecx, eax
call fcn.004246e0
mov dword [esp + 0x20], eax
jmp 0x40b941
mov dword [esp + 0x20], ecx
mov eax, ecx
test eax, eax
mov dword [esp + 0x18], 0xffffffff
jne 0x40b953
push eax
call fcn.00439b8d
movzx ecx, byte [esi + 0xde]
mov edx, dword [edi + 0xc]
imul ecx, ecx, 7
lea ecx, [ecx + edx + 0x11]
push ebp
push ecx
mov ecx, eax
call fcn.00424750
mov edx, dword [esp + 0x20]
push edx
lea ecx, [esi + 0x3d]
call fcn.00424890
movzx eax, bl
push eax
push 1
mov ecx, esi
call fcn.0040ad30
mov edi, eax
cmp edi, 0xffffffff
je 0x40b9f2
movzx edx, byte [esi + 1]
mov ecx, edi
shl ecx, 4
add ecx, edx
shl ecx, 3
mov edx, dword [ecx + 0x44f0a0]
cmp edx, 0xffffffff
mov al, byte [ecx + 0x44f0a4]
mov byte [esi + 1], al
je 0x40b9f2
xor eax, eax
test bl, 0x10
mov dword [esi + 0x21], eax
mov word [esi + 0x1b], dx
mov dword [esi + 0x1d], 1
je 0x40b9d8
or edx, 0x10
mov dword [esi + 0x2d], eax
mov word [esi + 0x1b], dx
jmp 0x40b9e1
mov edi, 0x1a
jmp 0x40b98e
mov ecx, dword [esi + 0x147]
mov dword [esi + 0x2d], ecx
cmp edi, 0x1a
jne 0x40b9f2
mov edx, dword [esi + 0xd2]
mov dword [esi + 0x92], edx
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x40ba10
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x444f30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x3d]
mov dword [esp + 0xc], esi
call fcn.00424950
xor ebx, ebx
lea ecx, [esi + 0x61]
mov dword [esp + 0x7c], ebx
call fcn.00424950
lea eax, [esi + 0x154]
push eax
mov dword [esp + 0x80], 1
mov byte [esi + 0xde], bl
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x88]
mov cl, byte [esp + 0x8c]
push edx
lea edi, [esi + 0x139]
push edi
mov byte [esp + 0x84], 2
mov dword [esi + 0x150], eax
mov byte [esi + 0x14f], cl
mov dword [esi + 0x96], ebx
mov dword [esi + 0x9a], ebx
mov byte [esi + 0xde], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 0xa]
push eax
push edi
call fcn.00435c70
mov ecx, dword [esp + 0x98]
mov edx, dword [esi + 0x150]
mov dword [esi + 0x9e], ecx
add esp, 8
mov byte [esi], 2
mov al, byte [edx + 0x14bb]
push esi
mov ecx, esi
mov byte [esi + 0x18], al
call fcn.0040b3d0
mov eax, dword [esi + 0x150]
mov ecx, dword [eax + 0x14f3]
mov dword [esi + 0xa2], ecx
mov edx, dword [eax + 0x14cf]
mov dword [esi + 0xa6], edx
mov eax, dword [eax + 0x14df]
mov dword [esi + 0xae], eax
mov ecx, dword [esi + 0x150]
mov edx, dword [ecx + 0x14df]
mov dword [esi + 0xb2], edx
mov eax, dword [esi + 0x150]
mov ecx, dword [eax + 0x14df]
mov dword [esi + 0xb6], ecx
mov edx, dword [esi + 0x150]
mov eax, dword [edx + 0x14df]
mov dword [esi + 0xba], eax
mov ecx, dword [esi + 0x150]
mov edx, dword [ecx + 0x14df]
mov dword [esi + 0xbe], edx
mov eax, dword [esi + 0x150]
mov ecx, dword [eax + 0x14df]
mov dword [esi + 0xc2], ecx
mov edx, dword [esi + 0x150]
mov eax, dword [edx + 0x14df]
mov dword [esi + 0xc6], eax
mov ecx, dword [esi + 0x150]
mov edx, dword [ecx + 0x14df]
mov dword [esi + 0xca], edx
mov eax, dword [esi + 0x150]
mov ecx, dword [eax + 0x14e3]
cmp dword [esi + 0xa2], ebx
mov dword [esi + 0x147], ecx
mov dword [esi + 0xaa], ebx
je 0x40bbb1
mov ecx, esi
call fcn.0040af20
mov edx, dword [esi + 0x150]
mov eax, dword [edx + 0x14f7]
cmp eax, 4
ja case.default.0x40bbc2
jmp dword [eax*4 + 0x40bc60]
push 0x4668f8
push 0x64
push 0x44eb38
push 0x44eb44
jmp 0x40bc26
push 0x4668f8
push 0x64
push 0x44eb4c
push 0x44eb58
jmp 0x40bc26
push 0x4668f8
push 0x46
push 0x44eb60
push 0x44eb6c
jmp 0x40bc26
push 0x4668f8
push 0x46
push 0x44eb74
push 0x44eb80
jmp 0x40bc26
push 0x4668f8
push 0x46
push 0x44eb88
push 0x44eb94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esi + 0xd2], eax
push edi
lea eax, [esp + 0x14]
push str.AX24_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x80]
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x74
ret 0x10
Function at 0x40c740
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x7d0
push esi
push edi
push 0x4514f8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 8]
push str._html__head_
push eax
mov dword [esi + 0xbec], 0
call edi
add esp, 8
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00423810
lea edx, [esp + 8]
push str._SCRIPT_LANGUAGE_JavaScript__
push edx
call edi
add esp, 8
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00423810
lea ecx, [esp + 8]
push str.function_Scroll___window.scrollTo_0_100000000___
push ecx
call edi
add esp, 8
push eax
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00423810
lea eax, [esp + 8]
push str.__SCRIPT_
push eax
call edi
add esp, 8
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00423810
lea edx, [esp + 8]
push str._title_Monitor__title___head__body_
push edx
call edi
add esp, 8
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00423810
pop edi
mov byte [esi + 0x15], 1
pop esi
add esp, 0x7d0
ret

Function at 0x40cc30
Capabilities:
Access peb ldr_data
Create tcp socket
Create udp socket
Get ntdll base address
Print debug messages
Read .ini file
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x444fb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00412b10
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x2c], 0
mov dword [esi], 0x446524
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x451c78
mov byte [esp + 0x2c], 1
call fcn.00436550
mov eax, dword [esp + 0x34]
add esp, 4
push 0x4668f8
push 0x50
push 0x451c90
push 0x451c98
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 1
push 2
mov edi, eax
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x30], eax
jne 0x40ccc7
push 0x451ca0
call ebp
push edi
mov word [esp + 0x14], 2
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 0x30]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x40ccfe
push 0x451cb4
call ebp
mov eax, dword [esi + 0x30]
push 0x3e8
push eax
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x40cd18
push 0x451cc0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x40cd36
push 0x451cd4
call ebp
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
push 8
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
je 0x40cd51
push 0x451ce4
call ebp
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x40d0d0
Capabilities:
Get common file path
Identify system language via api

Disassembly:
sub esp, 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edi, ax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea ecx, [esp + 0xc]
push ecx
push str._s_d.lng
push 0x467980
call esi
push edi
lea edx, [esp + 0x1c]
push 0x451d0c
push edx
call esi
add esp, 0x1c
push 0x4668f8
lea eax, [esp + 0xc]
push eax
push 0x451d10
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 8]
push str.AGWPE_d.hlp
push ecx
call esi
lea edx, [esp + 0x10]
push 0
push edx
call fcn.00444bc6
add esp, 0x10
test eax, eax
jne 0x40d16f
lea eax, [esp + 8]
push eax
push 0x451d34
push 0x466620
call esi
add esp, 0xc
pop edi
pop esi
add esp, 0x104
ret
push str.agwpe.hlp
push 0x466620
call esi
add esp, 8
pop edi
pop esi
add esp, 0x104
ret

Function at 0x40d190
Capabilities:
Read .ini file

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0x467980
push 0xff
push 0x466a30
push eax
push ecx
push edx
mov byte [esp + 0x18], 0xa
mov byte [esp + 0x19], 0xd
mov byte [esp + 0x1a], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp]
push eax
push 0x451d44
push 0x466a30
call fcn.00411690
add esp, 0x10
ret

Function at 0x40ec70
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x64
push esi
push 0x4668f8
push 0x63
mov esi, ecx
lea ecx, [esp + 0xc]
push ecx
push str.8000
push 0x452000
push 0x452008
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi]
lea edx, [esp + 4]
push edx
push 0x3eb
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x4668f8
push 1
push 0x45201c
push 0x452024
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x40ece4
mov ecx, dword [esi]
push 1
push 0x3ea
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, esi
pop esi
add esp, 0x64
ret 4
mov edx, dword [esi]
push 0
push 0x3ea
push edx
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, esi
pop esi
add esp, 0x64
ret 4
Function at 0x40ed90
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x64
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x4668f8
push 0x63
mov esi, ecx
lea ecx, [esp + 0x14]
push ecx
push 0x452098
push 0x45209c
push 0x4520a4
mov dword [esi], eax
call edi
mov eax, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea edx, [esp + 0xc]
push edx
push 0x3e9
push eax
call ebx
push 0x4668f8
push 0x63
lea ecx, [esp + 0x14]
push ecx
push 0x4520ac
push 0x4520b4
push 0x4520bc
call edi
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push 0x3ec
push eax
call ebx
push 0x4668f8
push 0x63
lea ecx, [esp + 0x14]
push ecx
push 0x4520c4
push 0x4520d0
push 0x4520dc
call edi
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push 0x3ed
push eax
call ebx
push 0x4668f8
push 0
push 0x4520e4
push 0x4520ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x40ee64
mov ecx, dword [esi]
push 1
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x64
ret 4
mov edx, dword [esi]
push 0
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_CheckDlgButton]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x64
ret 4

Function at 0x40ef60
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [ecx]
sub esp, 0x254
push ebx
push esi
push 0x3fe
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1009
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4521a4
push 0x4521a8
call fcn.0043a547
mov esi, eax
add esp, 8
test esi, esi
je 0x40f0ae
push edi
push esi
mov dword [esp + 0x10], 0
call fcn.0043a4aa
push esi
push 0x1fe
lea ecx, [esp + 0x6c]
push 1
push ecx
mov edi, eax
call fcn.0043a2fc
add esp, 0x14
test eax, eax
je 0x40f09b
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea esp, [esp]
lea edx, [esp + 0x64]
push edx
push 0x4521b0
push 0x466688
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0
push 0x1007
push ebx
mov dword [esp + 0x24], 5
mov dword [esp + 0x38], 0x466688
mov dword [esp + 0x44], edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x40f033
push str.INSERT_FAILED_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0x163]
push ecx
push 0x4521c4
push 0x466688
call ebp
mov edi, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
push edi
push 0x102e
push ebx
mov dword [esp + 0x54], 1
mov dword [esp + 0x60], 0x466688
call dword [sym.imp.USER32.dll_SendMessageA]
inc edi
push esi
mov dword [esp + 0x14], edi
call fcn.0043a4aa
push esi
push 0x1fe
mov edi, eax
lea eax, [esp + 0x70]
push 1
push eax
call fcn.0043a2fc
add esp, 0x14
test eax, eax
jne 0x40efe0
pop ebp
push esi
call fcn.0043a1c2
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x254
ret
push 0x4521c8
push str.Sec.dat
call fcn.0043a547
push eax
call fcn.0043a1c2
add esp, 0xc
pop esi
pop ebx
add esp, 0x254
ret