joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bda8a
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x606ca8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x5bdaa2
call fcn.00498a40
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x5bdab3
mov ecx, SysReAllocStringLen
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x5bdb08
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x5bdaee
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x5bdc34
cmp dword [esp + 0x18], ebx
jne 0x5bdb08
cmp dword [esp + 0x14], ebx
je 0x5bdc34
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x5bdb19
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.005e0c5c
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x5bdb5f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x5bdb5f
call fcn.00484440
test eax, eax
je 0x5bdb5f
push str.Global_
lea ecx, [esp + 0x14]
call fcn.005e1070
push ebx
lea ecx, [esp + 0x14]
call fcn.005e12ff
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
je 0x5bdc0e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x5bdb9b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x5bdc0e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x5bdbe9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x5bdbec
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x5bdbe4
mov dword [esi + 0x10], ebx
jmp 0x5bdbec
mov dword [esi + 0x10], ecx
jmp 0x5bdbec
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.005e0ee7
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.005e0ee7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5c14a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x5c1586
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x5c1513
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x5c156a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x5c1526
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x5c1556
mov ebx, 0x3d
jmp 0x5c1564
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x5c14ba
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x5e24b6
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x5e24e6
push edi
call ebx
push eax
call fcn.005e292c
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x5e2510
test byte [ebp - 4], 1
je 0x5e2510
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x5e2510
push edi
call ebx
push eax
call fcn.005e292c
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x5e25b6
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.005e2403
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x5e2542
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.005e2403
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x5e2558
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.005e2403
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5e2582
push 0
call ebx
push eax
call fcn.005e292c
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x5e25a0
push eax
call ebx
push eax
call fcn.005e292c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x5e25b4
push eax
call ebx
push eax
call fcn.005e292c
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x5e25dd
test byte [ebp - 4], 1
jne 0x5e25dd
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x5e25dd
push edi
call ebx
push eax
call fcn.005e292c
pop edi
pop ebx
leave
ret 8

Function at 0x5e4369
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5e43a1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005e138e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005e1366
jmp 0x5e43ad
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x401340
Capabilities:
Get common file path
Get disk information
Set current directory

Disassembly:
sub esp, 0x260
push 0
call fcn.00403530
add esp, 4
mov eax, 0x44ac1b
mov ecx, 0x14
mov byte [eax], 0
add eax, 0xc4
dec ecx
jne 0x40135a
cmp eax, 0x44da0b
jl 0x401355
push ebx
push esi
lea eax, [esp + 0x164]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [0x4200b8]
xor eax, eax
mov dword [esp + 0xc], ecx
mov ecx, 0x3e
lea edi, [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebx, 0x43
lea edx, [esp + 0xc]
mov byte [esp + 0xc], bl
push edx
call esi
cmp eax, 3
jne 0x401401
mov al, byte [0x430cfc]
test al, al
jne 0x4013ed
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10c]
push eax
push 0x4200a0
push ecx
call fcn.004154c8
lea edx, [esp + 0x118]
push edx
call fcn.00401fb0
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
call fcn.004010c0
add esp, 4
inc ebx
cmp ebx, 0x5a
jle 0x4013ad
lea edx, [esp + 0x168]
push edx
call edi
push 0x4f
call fcn.00403530
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x260
ret

Function at 0x401470
Capabilities:
Terminate process

Disassembly:
sub esp, 0x200
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
mov edi, dword [esp + 0x210]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x214]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401430
call fcn.004084e0
push 1
call fcn.004021c0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x401500
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x100
lea eax, [esp + 0x10c]
lea edx, [esp]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
push 1
call fcn.004021c0
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
add esp, 4
push 0
push 0x4200cc
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x6808c8]
test eax, eax
jne 0x40155b
push 0x42ca50
call fcn.00413ce0
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402050
Capabilities:
Connect socket
Get hostname
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
sub esp, 0xe4
lea eax, [esp + 0x24]
push 0xbf
push eax
mov dword [esp + 0x10], 0
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
je 0x40208b
lea ecx, [esp + 0x24]
push ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x40208b
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov dword [esp + 8], eax
jmp 0x40208f
mov eax, dword [esp + 8]
test eax, eax
push esi
jne 0x4020fa
push eax
push 2
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x4020f6
push 7
mov dword [esp + 8], 0x10
mov word [esp + 0x1c], 2
call sub.WS2_32.dll_htons
push str.128.127.50.1
mov word [esp + 0x1e], ax
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x4020f0
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push esi
call sub.WS2_32.dll_getsockname
push esi
call sub.WS2_32.dll_closesocket
mov eax, dword [esp + 0xc]
pop esi
add esp, 0xe4
ret

Function at 0x402470
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x42047c]
sub esp, 0x54
test eax, eax
je 0x4025d8
mov dword [0x42047c], 0
call fcn.00402250
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
call fcn.00401570
add esp, 8
test eax, eax
jle 0x402560
mov ecx, dword [esp]
mov dword [esp + 8], 0x4207f0
cmp ecx, 0x600
mov dword [esp + 0xc], 0x4207d4
mov dword [esp + 0x10], 0x4207ac
mov dword [esp + 0x14], 0x420784
mov dword [esp + 0x18], 0x420760
mov dword [esp + 0x1c], 0x420730
mov dword [esp + 0x20], 0x420708
mov dword [esp + 0x24], 0x4206dc
mov dword [esp + 0x28], 0x4206b8
mov dword [esp + 0x2c], 0x420688
mov dword [esp + 0x30], 0x420660
mov dword [esp + 0x34], 0x42063c
mov dword [esp + 0x38], 0x420614
mov dword [esp + 0x3c], 0x4205f0
mov dword [esp + 0x40], 0x4205c0
mov dword [esp + 0x44], 0x420590
mov dword [esp + 0x48], 0x42056c
mov dword [esp + 0x4c], 0x420540
mov dword [esp + 0x50], 0x42051c
jae 0x402560
mov edx, dword [esp + eax*4 + 8]
mov eax, dword [0x430c20]
push edx
push eax
call fcn.00401500
add esp, 8
mov ecx, dword [0x430c20]
push esi
mov esi, dword [esp + 0x5c]
push esi
push ecx
call fcn.00412ab0
add esp, 8
test eax, eax
jne 0x40258d
mov edx, dword [0x430c20]
push 0x4204e8
push edx
call fcn.00401500
add esp, 8
mov eax, dword [0x430c20]
push esi
push eax
call fcn.004135b0
add esp, 8
test eax, eax
pop esi
jne 0x4025b5
mov ecx, dword [0x430c20]
push 0x4204b4
push ecx
call fcn.00401500
add esp, 8
call fcn.00401a40
cmp eax, 0xffffffff
jne 0x4025d3
mov edx, dword [0x430c20]
push 0x4204a4
push edx
call fcn.00401500
add esp, 8
call fcn.0040a790
push 0xf8
push 0x163
call fcn.00403270
push 0x4f
mov dword [0x430d00], 1
call fcn.00403530
push 1
push 0
call fcn.004072e0
call fcn.004084e0
push 1
call fcn.004021c0
add esp, 0x18
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402f00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e270
push 0x41579c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [0x430818], esi
push str.PLAYLOBBY
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x430c44], eax
test eax, eax
jne 0x402f5a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402f7c
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push esi
call fcn.00403060
add esp, 0xc
test eax, eax
jne 0x402fb2
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [0x430c20]
push edx
call fcn.00412c60
push 0
push 0
call fcn.00412cf0
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
push 0x430c28
call esi
test eax, eax
je 0x403008
cmp dword [0x430c2c], 0x12
je 0x403037
push 0x430c28
call edi
push 0x430c28
call ebx
jmp 0x402fdc
mov eax, dword [0x430c1c]
test eax, eax
je 0x40301f
mov eax, dword [ebp + 8]
push eax
call fcn.00402470
add esp, 4
jmp 0x402fdc
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x402fdc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x430c30]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403060
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
push edi
mov dword [0x680980], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0041c8b6
mov esi, eax
push str._WINDOW
push esi
call fcn.00415880
add esp, 0xc
test eax, eax
je 0x403098
mov dword [0x680980], 1
push 0x420ca4
push esi
call fcn.00415880
add esp, 8
test eax, eax
je 0x4030b4
mov dword [0x6808c8], 1
push str._ONE
push esi
call fcn.00415880
add esp, 8
test eax, eax
je 0x4030cc
mov byte [0x420480], bl
push str._FULLPATH
push esi
call fcn.00415880
add esp, 8
test eax, eax
je 0x4030e5
mov byte [0x430cfc], 1
push str._NOSCROLL
push esi
call fcn.00415880
add esp, 8
test eax, eax
je 0x4030fd
mov byte [0x420481], bl
push str._ATWOOD
push esi
call fcn.00415880
add esp, 8
test eax, eax
je 0x403116
mov byte [0x430cfd], 1
mov esi, dword [esp + 0x40]
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x66
push esi
mov dword [esp + 0x14], 0x30
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x402620
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call edi
push 0x66
push esi
mov dword [esp + 0x2c], eax
call edi
push 0x7f00
push ebx
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xc]
mov edi, 0x4200cc
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x403198
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
cmp dword [0x680980], ebx
je 0x403202
mov ecx, dword [0x422630]
mov edx, dword [0x422624]
push ebp
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
push ebx
push ecx
push edx
push 1
call esi
mov edx, dword [0x422630]
push 8
sub eax, edx
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
call esi
sub ebp, eax
push ebp
push ebx
call esi
mov edx, dword [0x422624]
push 7
sub eax, edx
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
call esi
sub ebp, eax
push ebp
push 0x81880000
push edi
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x430c20], eax
pop ebp
jmp 0x40322b
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
push ebx
push 1
call esi
push eax
push ebx
call esi
push eax
push ebx
push ebx
push closesocket
push edi
push edi
push 8
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x430c20], eax
cmp eax, ebx
jne 0x403238
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
mov ecx, dword [esp + 0x48]
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x430c20]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x430c20]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x30
ret
Function at 0x4084e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push str.QUIT_n
call fcn.004086c0
mov eax, dword [0x430738]
add esp, 4
push eax
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
mov ecx, dword [0x430c20]
push ecx
call fcn.00412cc0
add esp, 4
call fcn.0040e770
mov eax, dword [0x430d38]
test eax, eax
je 0x408530
push str.SHUTDOWN_MOUSEBUFFER
push 0x26
push 0x422034
push eax
call fcn.00415390
add esp, 0x10
mov eax, dword [0x6808fc]
test eax, eax
je 0x408546
push 0x6808fc
call fcn.0040c130
add esp, 4
mov eax, dword [0x6808f8]
test eax, eax
je 0x40855c
push 0x6808f8
call fcn.0040c130
add esp, 4
call fcn.00402170
mov eax, dword [0x680904]
test eax, eax
je 0x408577
push 0x680904
call fcn.0040bf00
add esp, 4
mov eax, dword [0x680910]
test eax, eax
je 0x40858d
push 0x680910
call fcn.0040bf00
add esp, 4
mov eax, dword [0x68090c]
test eax, eax
je 0x4085a3
push 0x68090c
call fcn.0040c690
add esp, 4
mov eax, dword [0x6808f4]
test eax, eax
je 0x4085c1
push str.LOBBY_BACK
push 0x34
push 0x422034
push eax
call fcn.00415390
add esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push str.CONFIG.DAT
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x40860e
lea edx, [esp + 0x10]
push 0
push edx
push 0x124
push 0x44a840
push esi
call ebx
push esi
call ebp
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push str.FRIEND.DAT
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x40864d
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [0x680918]
mov ecx, eax
shl ecx, 4
add ecx, eax
push ecx
push 0x44da10
push esi
call ebx
push esi
call ebp
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push str.FILENAME.REC
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x408684
lea edx, [esp + 0x10]
push 0
push edx
push 0x2df0
push 0x44ac10
push esi
call ebx
push esi
call ebp
call fcn.00413790
call fcn.00412c00
mov eax, dword [0x6808c8]
test eax, eax
jne 0x4086ba
xor esi, esi
push esi
push 0x42ca50
call fcn.00414720
add esp, 8
inc esi
cmp esi, 5
jle 0x408699
push 0x42ca50
call fcn.00413ce0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4086c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x430738]
cmp eax, 0xffffffff
jne 0x4086cd
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
push edi
push esi
push eax
push str.SendTo_socket__d_:_s
call fcn.004159fe
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x430738]
push 0
not ecx
dec ecx
push ecx
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
ret
Function at 0x40ab10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x5c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
mov edi, 0x44a97c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x420090
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x6c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x70]
cmp esi, ebx
jne 0x40abb1
lea eax, [esp + 0xc]
push eax
push str.ReadPalette_Out_of_Memory_:
call fcn.00401470
add esp, 8
push ebx
push 0x80
push 3
push ebx
push ebx
lea ecx, [esp + 0x20]
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40abe4
lea edx, [esp + 0xc]
push edx
push str.ReadPalette_Open_error_:
call fcn.00401470
add esp, 8
lea eax, [esp + 0x6c]
push ebx
push eax
push 0x300
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x6c], 0x300
je 0x40ac13
lea ecx, [esp + 0xc]
push ecx
push str.ReadPalette_Read_error_:
call fcn.00401470
add esp, 8
xor eax, eax
mov cl, byte [eax + esi]
shr cl, 2
mov byte [eax + esi], cl
inc eax
cmp eax, 0x300
jl 0x40ac15
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x43081d
lea ecx, [esi + 2]
mov dl, byte [ecx - 2]
add eax, 4
shl dl, 2
mov byte [eax - 5], dl
mov dl, byte [ecx - 1]
shl dl, 2
mov byte [eax - 4], dl
mov dl, byte [ecx]
shl dl, 2
mov byte [eax - 3], dl
mov byte [eax - 2], bl
add ecx, 3
cmp eax, 0x430c1d
jl 0x40ac35
pop edi
pop esi
pop ebx
add esp, 0x5c
ret