joyce8/EMBER2024-capa huggingface dataset:
Function at 0x26fcae0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x170f000]
push edi
or ebp, 0xffffffff
jmp 0x26fcb02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x26fcb09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x26fcaf8
mov eax, 1
add ebx, ebx
jne 0x26fcb1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x26fcb2c
jne 0x26fcb4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x26fcb4b
dec eax
add ebx, ebx
jne 0x26fcb38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x26fcb10
add ebx, ebx
jne 0x26fcb47
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x26fcb9d
xor ecx, ecx
sub eax, 3
jb 0x26fcb63
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x26fcbd2
sar eax, 1
mov ebp, eax
jmp 0x26fcb6e
add ebx, ebx
jne 0x26fcb6e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x26fcb3c
inc ecx
add ebx, ebx
jne 0x26fcb7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x26fcb3c
add ebx, ebx
jne 0x26fcb89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x26fcb7e
jne 0x26fcb9a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x26fcb7e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x26fcbbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x26fcbae
jmp 0x26fcafe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x26fcbbc
add edi, ecx
jmp 0x26fcafe
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x26fcbda
cmp byte [edi], 0x13
jne 0x26fcbda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x26fcbdf
lea edi, [esi + 0x22f9000]
mov eax, dword [edi]
or eax, eax
je 0x26fcc57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23232d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x232339c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x26fcc0c
mov ecx, edi
jns 0x26fcc3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23233a4]
or eax, eax
je 0x26fcc51
mov dword [ebx], eax
add ebx, 4
jmp 0x26fcc29
call dword [esi + 0x23233a0]
mov ebp, dword [esi + 0x23233a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x26fcc8b
sub esp, 0xffffff80
jmp 0x46f1ee
Function at 0x11ab3df
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 0xc]
jae 0x1a0cab0
rcr bx, cl
shrd cx, si, 5
sbb cx, bx
bts bx, 2
mov ebx, eax
pushal
sbb di, 0xd234
mov edi, eax
rcr cl, 1
sar ecx, 0x1a
and cx, 0x357a
mov ecx, 0x104
pushal
stc
xor al, al
pushfd
stc
call fcn.00ea7ebc
daa
loope 0x11ab470
arpl word [eax + ecx*4 + 0x47], cx
sub edx, esi
and bh, byte [ecx + 0x143b926c]
sub byte [esi + 0x3d], bh
cmpsb byte [esi], byte es:[edi]
xlatb
xor eax, 0xd06a3d14
rcl byte [eax - 0x6f], 0xae
invalid
pop ebx
insd dword es:[edi], dx
inc ebx
invalid
jo 0x11ab4cf
retf
sub byte [ebp + 0x5f], bh
push ds
mov ch, 0x2d
inc esi
push 0xffffffffffffff83
cmpsd dword [esi], dword es:[edi]
jbe 0x11ab44a
inc ebx
pop edx
xlatb
jp 0x11ab46b
or eax, 0x740a794f
xor dh, byte [edx + 0x101788e6]
or ch, bh
imul esp, dword [eax], 0xafa1bfdf
lodsb al, byte [esi]
cmp dword [edi], esp
in eax, 0x37
inc eax
jns 0x11ab511
test byte cs:[edi - 0x59], bl
cmpsd dword [esi], dword es:[edi]
sahf
out 0x18, al
add dword [ebx], ebp
insd dword es:[edi], dx
adc esi, edx
sbb ebx, dword [esi - 0x13]
fst qword [ebp + 0xe0fbfbc]
push cs
int 0xad
dec eax
test al, 0xbb
jmp 0x11ab47f
and al, 0xd6
invalid
and al, 8
lea esp, [esp + 0x28]
jb 0x1a0cab0
pushal
jmp fcn.011a832c
dec ebx
into
invalid
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebp + 0x4c2db95], cl
inc eax
push edi
and ecx, dword [eax - 7]
add dword [edx], esi
in eax, dx
jo 0x11ab4c4
mov ecx, 0x845b532b
rcr byte [ebp + 0x615924ee], cl
pop ecx
mov bh, 0xa0
iretd
jo 0x11ab49f
push ebp
push 0xffffffffffffffd8
xchg edi, eax
jns 0x11ab553
mov al, 0x8c
cli
adc ebx, esp
popfd
pop esp
fsub dword [ebp - 0x25]
sbb eax, 0x7c521ae6
js 0x11ab4dd
jb 0x11ab4ec
mov ebp, 0x2d77749b
mov bh, 0x52
push 0xffffffffffffffda
dec ebx
aad 0xbd
sbb byte [ecx - 0x4b4f8487], 0xd9
int3
cli
int3
Function at 0x1a0becf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esi + 0x78]
bt ax, 5
stc
jmp 0x11a7888
adc cl, 0x8c
ror ch, cl
call fcn.01192ae6
mov cl, 0xde
fcmovnb st(0), st(2)
and byte [ebx + esi], cl
aaa
test eax, 0x85472a60
mov ah, 0xdb
mov al, byte [0x4709ffd2]
jbe 0xeaccb9
mov edx, 0xa58ca9e8
retf
jmp 0xaf022d38
test edx, edx
pushal
lea esp, [esp + 0x20]
je 0x1a0caa5
bt ecx, 0x13
add edx, eax
movzx cx, bl
btr cx, dx
inc cx
or ch, 0x43
mov ecx, dword [esi + 0x7c]
push eax
cmp ebp, eax
add ecx, edx
stc
mov dword [ebp - 0x10], ecx
movzx ecx, cl
mov ecx, dword [ebp + 0xc]
mov dword [esp], eax
cmp ecx, 0xffff
pushal
pushfd
mov byte [esp + 8], ah
lea esp, [esp + 0x28]
jbe 0x1a0d1fc
shld ebx, ebx, cl
dec edi
shl di, cl
mov edi, dword [edx + 0x24]
shl bx, 0xd
rcr cx, cl
sar bh, cl
add ebx, ebp
add edi, eax
shrd bx, dx, cl
dec cl
btc bx, 0xb
mov ebx, dword [edx + 0x20]
movsx cx, dl
clc
add ebx, eax
jno 0xeacc51
sal ch, 6
bt bp, 3
mov dword [ebp - 8], 0
ror cl, cl
mov ecx, dword [edx + 0x18]
lea esp, [esp + 0x30]
je 0x1a0caa5
or esi, ebp
shrd si, bp, cl
mov esi, dword [eax + 0x3c]
test dh, ah
sbb dh, bh
shrd dx, dx, 2
add esi, eax
bswap dx
jmp 0xea4a6d
test cl, ch
test cl, 0x71
pushfd
sub ecx, dword [edx + 0x10]
cmc
test bl, al
cmp ecx, dword [edx + 0x14]
call fcn.01a0e8f0
and dword [eax], ebx
jbe 0x1a0d292
jg 0x1a0d28c
sahf
and byte [0x7ec35c74], 0x1e
push ebx
inc ebx
jo 0x1a0d289
and dl, 0x42
outsb dx, byte [esi]
cwde
int3
dec edx
pushfd
adc dword [ebx - 0x559dad27], esp
mov dword [0xaa6252d9], eax
invalid
mov bl, 0xc4
in al, dx
or edi, dword [edi]
cli
ljmp 0x9260
Function at 0x1019da8
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1021d58
call fcn.0101a374
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10290c0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1019b63
cmp eax, esi
jne 0x1019b56
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1019b66
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1019b3d
xor esi, esi
inc esi
mov eax, dword [0x10290bc]
cmp eax, esi
jne 0x1019b79
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1019ba8
mov eax, dword [0x10290bc]
test eax, eax
jne 0x1019ba2
mov dword [0x10290bc], esi
push 0x10016b8
push 0x10016ac
call fcn.01019a9f
pop ecx
pop ecx
test eax, eax
je 0x1019ba8
jmp 0x1019ccc
mov dword [0x1028d8c], esi
mov eax, dword [0x10290bc]
cmp eax, esi
jne 0x1019bcc
push 0x10016a8
push 0x1001558
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10290bc], 2
cmp dword [ebp - 0x20], ebx
jne 0x1019bd9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10290cc], ebx
je 0x1019bfa
push 0x10290cc
call fcn.0101a2e9
pop ecx
test eax, eax
je 0x1019bfa
push ebx
push 2
push ebx
call dword [0x10290cc]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1019ccc
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1019c64
cmp cx, bx
je 0x1019c1f
cmp dword [ebp - 0x1c], ebx
jne 0x1019c64
movzx ecx, word [eax]
cmp cx, bx
je 0x1019c34
cmp cx, 0x20
ja 0x1019c34
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1019c1f
test byte [ebp - 0x40], 1
je 0x1019c40
movzx ecx, word [ebp - 0x3c]
jmp 0x1019c43
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1028d88], eax
cmp dword [0x1028d7c], ebx
jne 0x1019ca9
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1019c75
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1019c09
cmp dword [0x1028d8c], ebx
jne 0x1019cb7
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1028d88]
jmp 0x1019cd8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0101a3b9
ret
call fcn.0101a4c1
jmp 0x1019b00

Function at 0xcab390
Capabilities:
Encode data using xor

Disassembly:
jmp 0xcab39a
pushal
call 0xcab3a0
pop ebp
sub ebp, 0x10
sub ebp, 0x8ab390
jmp 0xcab3b6
mov eax, 0x8ab390
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e2
mov edx, 0x666f50d6
xor byte [eax], dl
inc eax
dec ecx
jne 0xcab3cd
jmp 0xcab3e0
pop ebp
sbb ebx, dword [ebp + 0x5f]
ljmp 0x2e17
Function at 0x4b1bc1
Capabilities:
Terminate process

Disassembly:
jmp fcn.005aa340
jmp 0x595520
cmp ecx, dword [0x656e58]
jne 0x59552a
repz ret
jmp 0x4ad869

Function at 0x4d40fb
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a39e
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x244
mov eax, dword [0x656e58]
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.004ab064
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4d401d
call fcn.004afe4d
cmp eax, 1
jne 0x4d401d
lea ecx, [ebp - 0x14]
push ecx
push str.SoftwareClasses_
lea edx, [ebp - 0x238]
push edx
call fcn.004b3d68
add esp, 0xc
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004b2346
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.004af4de
mov dword [ebp + 8], SysReAllocStringLen
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.004ab465
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4d413d
push 0x104
lea ecx, [ebp - 0x230]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4d410b
mov byte [ebp - 4], 2
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x240]
call fcn.004b2512
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004b4399
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x1c], eax
xor ecx, ecx
cmp dword [ebp - 0x1c], 0
setne cl
mov byte [ebp - 0x239], cl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x240]
call fcn.004af4de
movzx edx, byte [ebp - 0x239]
test edx, edx
je 0x4d40d4
mov byte [ebp - 4], 0
jmp 0x4d410b
jmp 0x4d40fb
mov dword [ebp - 4], 0
jmp 0x4d4106
jmp 0x4d4041
cmp dword [ebp - 0x1c], 0x103
je 0x4d411d
cmp dword [ebp - 0x1c], 0x3f2
jne 0x4d4133
lea ecx, [ebp - 0x14]
call fcn.004ab465
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x244], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004af4de
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004b1bc1
mov esp, ebp
pop ebp
ret 8
Function at 0x565360
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f208
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x656e58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x5653b2
mov ecx, dword [ebp - 0x14]
or ecx, 0x1000000
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.004b0848
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40
mov edx, dword [ebp - 0x18]
shl edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004b131a
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004ae656
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
je 0x5653c8
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004ab064
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004af4de
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x588df0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004ab221
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.004acb30
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x588e7b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x588e52
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004b131a
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x588e6f
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.004b4123
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.004ae656
jmp 0x588eac
mov ecx, dword [ebp + 0x10]
call fcn.004ab465
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x588eac
mov ecx, dword [ebp + 0x10]
call fcn.004ab465
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.004b2355
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b1f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
sub esp, 0xd4
lea ecx, [ebp - 0xdc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041439f
push dword [ebp - 8]
push 0x3f8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 8]
call fcn.004375e9
push 0x5ab
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
call fcn.0040c45a
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40b271
cmp byte [ebp + 0x10], 0xff
je 0x40b271
push 5
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0x10]
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x40b28f
push 0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x492e2c
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0x10], 0
jne 0x40b2c3
push 0x565
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5ad
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
call fcn.0040b460
push dword [eax*4 + 0x48bc04]
push 0x3ff
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 0x12], 0xff
jne 0x40b2fe
push 0x48b284
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x40b317
mov ecx, dword [ebp - 8]
call fcn.0040d85e
push 0
push eax
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.00461fc8
lea edx, [ebp - 0x70]
push edx
push 0x401
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.0040df60
lea edx, [ebp - 0x70]
push edx
push 0x5af
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
call fcn.0041b4f7
mov dword [ebp - 0xc], eax
jmp 0x40b36b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 0x50
jae 0x40b3cf
push dword [ebp - 4]
call fcn.0040687c
add esp, 4
cmp al, 0xff
je 0x40b368
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + 0x11]
cmp al, 0x1a
jae 0x40b39f
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b782
call fcn.0041c60f
jmp 0x40b3b3
mov al, byte [ecx + 0x14]
cmp al, 3
je 0x40b368
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00420e83
push eax
mov eax, dword [ebp - 4]
add eax, 0x5c0
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40b368
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404010
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x430710]
test eax, eax
jbe 0x40409a
push 0x430714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x43070c]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [esp], eax
je 0x404060
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
nop
mov eax, dword [eax + 0x10]
push 0
push eax
call esi
lea ecx, [esp + 4]
call fcn.00409210
mov eax, dword [esp + 4]
mov ecx, dword [0x43070c]
cmp eax, ecx
jne 0x404040
pop esi
mov ecx, dword [ecx + 4]
push ecx
mov ecx, 0x430708
call fcn.00403560
mov eax, dword [0x43070c]
mov dword [eax + 4], eax
mov eax, dword [0x43070c]
mov dword [0x430710], 0
mov dword [eax], eax
mov eax, dword [0x43070c]
push 0x430714
mov dword [eax + 8], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ecx
ret
Function at 0x4048a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x4306a0]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x40490e
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, dword [esp + 0x20]
jmp 0x4048e0
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4048e0
mov ecx, dword [esp + 6]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [esp + 0x24]
mov word [edx], ax
mov eax, 1
mov ecx, dword [esp + 0x14]
call fcn.00421871
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
call fcn.00421871
add esp, 0x18
ret
Function at 0x404f70
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x404fba
push str.set_so_rcvbufgetsockopt_SO_RCVBUF__fail
call fcn.0040b4c0
add esp, 4
pop esi
add esp, 8
ret
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
cmp ecx, eax
jge 0x405001
push 4
lea edx, [esp + 8]
push edx
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x405010
push str.set_so_rcvbufsetsockopt_SO_RCVBUF__fail
call fcn.0040b4c0
add esp, 4
pop esi
add esp, 8
ret
push eax
push ecx
push str.set_so_rcvbufSO_RCVBUF__already_set__optval:_d__newval:_d.
call fcn.0040b4c0
add esp, 0xc
pop esi
add esp, 8
ret

Function at 0x405020
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x40506a
push str.set_so_sndbufgetsockopt_SO_SNDBUF__fail
call fcn.0040b4c0
add esp, 4
pop esi
add esp, 8
ret
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
cmp ecx, eax
jge 0x4050b1
push 4
lea edx, [esp + 8]
push edx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4050c0
push str.set_so_sndbufsetsockopt_SO_SNDBUF__fail
call fcn.0040b4c0
add esp, 4
pop esi
add esp, 8
ret
push eax
push ecx
push str.set_so_sndbufSO_SNDBUF__already_set__optval:_d__newval:_d.
call fcn.0040b4c0
add esp, 0xc
pop esi
add esp, 8
ret

Function at 0x4050d0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 1
push 6
push esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x40510f
push str.set_tcp_nodelaygetsockopt_TCP_NODELAY__fail
call fcn.0040b4c0
add esp, 4
cmp dword [esp + 4], 1
jne 0x405125
push 1
push str.set_tcp_nodelayTCP_NODELAY__already_set__optval:_d.
call fcn.0040b4c0
add esp, 8
push 4
lea edx, [esp + 8]
push edx
push 1
push 6
push esi
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
pop esi
jne 0x405152
push str.set_tcp_nodelaysetsockopt_TCP_NODELAY__fail
call fcn.0040b4c0
add esp, 4
add esp, 8
ret
Function at 0x405780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4227e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0xc], bl
mov dword [esp + 8], esi
mov byte [esp + 0xc], bl
mov dword [esp + 0x18], ebx
lea ecx, [esp + 8]
call fcn.00405200
mov dword [esp + 0x18], 1
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x20]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [esi + 0x28]
push eax
push ecx
push str._sm_allocNum_dm_container.size___dm_times_pop_dm_times_push_d
call fcn.0040b4c0
add esp, 0x18
mov dword [esp + 0x18], 0xffffffff
cmp byte [esp + 0xc], bl
je 0x4057fc
mov ecx, dword [esp + 8]
mov byte [esp + 0xc], bl
call fcn.00404850
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4