joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a270
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x43a28c
cmp dword [esi + 4], 0
je 0x43a2b9
test byte [ebx + 0x45], 1
jne 0x43a2ab
mov eax, ebx
call fcn.004391a8
test eax, eax
jne 0x43a2ab
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43a3c9
mov edx, esi
mov eax, ebx
call fcn.00439ee8
jmp 0x43a3c9
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43a3c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043c240
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043710c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043a270
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043c240
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a3c9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44336c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x443444
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x487430], 0
jne 0x443428
lea eax, [ebp - 4]
mov edx, 0x44345c
call fcn.0045c744
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0045caf0
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x443428
mov eax, ebx
call fcn.0045b500
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x443421
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x44340b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x44346c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x44340b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x487430], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443428
mov eax, dword [ebp - 0xc]
call fcn.0045b518
ret
mov ebx, dword [0x487430]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44344b
lea eax, [ebp - 4]
call fcn.0045c6ac
ret

Function at 0x449418
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x487454], 0
jne 0x44943b
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x44939c
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x487454], eax
ret

Function at 0x457110
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x457149
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0045c794
jmp 0x457152
mov eax, ebx
mov edx, esi
call fcn.0045c700
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45715c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x45717d
mov al, byte [esp]
jmp 0x45717f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x45b744
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x45b773
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0045c794
jmp 0x45b791
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0045b6cc
mov edi, eax
test ebx, ebx
je 0x45b791
cmp dword [esi], 0
je 0x45b791
dec ebx
jmp 0x45b77a
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x45bab4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x483124]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x45bb4c
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x45bb2c
xor eax, eax
push ebp
push 0x45bb25
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x45bb68
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bb2c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x483124]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x483124], ax
mov esp, ebp
pop ebp
ret
Function at 0x45dbdc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x45dd98
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x45dc3d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x45ddb4
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x45dcaf
xor eax, eax
push ebp
push 0x45dca8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0045da34
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x45dc91
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x45ddd4
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dcaf
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x45dd90
cmp byte [ebp - 0xd], 0
jne 0x45dcf1
cmp byte [ebp - 0x12], 0
je 0x45dd90
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x45dd0a
dec ebx
cmp byte [ebx], 0x2e
je 0x45dd19
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x45dd09
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x45dd90
inc ebx
cmp byte [ebp - 0x12], 0
je 0x45dd46
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x45dd90
cmp byte [ebp - 0xd], 0
je 0x45dd90
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x45dd90
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e184
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x45e26c
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x487ac8], 1
jae 0x45e25e
xor eax, eax
mov dword [0x4876d4], eax
xor eax, eax
mov dword [0x4876dc], eax
xor eax, eax
mov dword [0x4876e0], eax
mov byte [0x4876e6], 2
mov byte [0x4876e7], 2
mov byte [0x4876e8], 3
mov word [0x487a90], 0
mov word [0x487aa0], 1
mov word [0x487ab0], 0xa
mov dword [0x487ab8], 0x80020004
mov dword [0x487a84], 0x45d370
mov dword [0x487a88], 0x45d368
mov dword [0x487a8c], 0x45d370
call fcn.0045ba84
test al, al
je 0x45e21d
call fcn.0045bab4
call fcn.0045bb78
mov eax, 0x4876ec
mov edx, 0x45e278
call fcn.00459256
mov eax, 0x4878b8
mov edx, 0x45e278
call fcn.00459256
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4876cc], eax
call fcn.0045a1bc
mov dword [0x4876c8], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4876c0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e273
ret

Function at 0x45fee4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x45ff00
call fcn.00461384
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x45ff1c
test bl, 1
je 0x45ff1c
call fcn.00464e3c
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x460100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00460f20
test byte [ebp + 0xd], 0xc0
jne 0x460124
mov eax, dword [0x483ef4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x460131
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x46015e
je 0x460170
sub ecx, 0x100
je 0x46017e
sub ecx, 0x100
je 0x460185
sub ecx, 0x100
je 0x460177
jmp 0x46018c
sub ecx, 0x600
je 0x460185
sub ecx, 0x100
je 0x460170
jmp 0x46018c
mov edi, 1
jmp 0x460191
mov edi, 2
jmp 0x460191
mov edi, 4
jmp 0x460191
mov edi, 5
jmp 0x460191
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4601b8
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x48396c]
test al, 0x80
je 0x4601b1
mov ebx, 0x80
jmp 0x4601ca
mov ebx, 1
jmp 0x4601ca
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4601ca
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4601dc
je 0x4601e5
dec eax
je 0x4601ee
jmp 0x4601f7
mov dword [ebp - 4], 0x80000000
jmp 0x460206
mov dword [ebp - 4], 0x40000000
jmp 0x460206
mov dword [ebp - 4], 0xc0000000
jmp 0x460206
push 1
call fcn.00461318
pop ecx
mov ebx, eax
jmp 0x4602f2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x460222
sub eax, 0x10
je 0x460229
sub eax, 0x10
je 0x460232
sub eax, 0x10
je 0x46023b
jmp 0x46023b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x460242
mov dword [ebp - 8], 1
jmp 0x460242
mov dword [ebp - 8], 2
jmp 0x460242
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4602ab
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4602a0
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x4602a0
add ebx, 0xffffffb2
push ebx
call fcn.00461318
pop ecx
mov ebx, eax
jmp 0x4602f2
mov edi, esi
push edi
call fcn.00460064
pop ecx
test eax, eax
je 0x4602bf
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4602cb
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00461040
add esp, 8
mov ebx, eax
inc eax
jne 0x4602f2
push 4
call fcn.00461318
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00460f54
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464dd4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x464e36
call fcn.00464d84
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0045eddc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0045eddc
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x464eb4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x484d94], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x464f8e
cmp dword [0x484d90], 0
jne 0x464f8e
cmp dword [0x484f74], 0
je 0x464f48
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00464c84
add esp, 8
mov ebx, eax
test eax, eax
jne 0x464f2e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00464c84
add esp, 8
mov ebx, eax
test eax, eax
jne 0x464f2e
lea ebx, [ebp - 0x84]
jmp 0x464f2f
inc ebx
call fcn.00464e70
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x464fc9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x484d98
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0045eddc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x484d9b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x464fc9
cmp dword [0x484d90], 0
je 0x464fa8
cmp dword [0x484d90], 0xffffffff
je 0x464fc9
push esi
call dword [0x484d90]
pop ecx
mov eax, dword [0x484d94]
test eax, eax
je 0x464fc9
cmp dword [0x484d94], 0xffffffff
je 0x464fc9
cmp byte [eax], 0
je 0x464fc9
push esi
push eax
call fcn.00464dd4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465760
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4883d0], 0
jne 0x4657e1
cmp dword [0x4883f0], 0
jne 0x465790
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4883f0], eax
test eax, eax
jne 0x465790
push str.GetEnvironmentStrings_failed
call fcn.00464fe0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4883f0]
jmp 0x4657a4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0045eddc
pop ecx
mov edi, eax
test eax, eax
jne 0x46579c
lea edi, [ebp + 1]
push edi
call fcn.0045e7a0
pop ecx
mov ebx, eax
mov dword [0x4883d4], ebx
test ebx, ebx
jne 0x4657ce
xor eax, eax
jmp 0x4658a4
push edi
mov edx, dword [0x4883f0]
push edx
push ebx
call fcn.0045ec10
add esp, 0xc
jmp 0x465801
xor esi, esi
mov ebx, dword [0x4883d0]
jmp 0x4657fb
push eax
call fcn.0045eddc
pop ecx
test eax, eax
jne 0x4657f7
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4657eb
lea ebx, [esi + 4]
push 4
mov dword [0x4883d8], ebx
inc ebx
push ebx
call fcn.0045e27c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x465824
xor eax, eax
jmp 0x4658a4
cmp dword [0x4883d0], 0
jne 0x465855
xor esi, esi
mov ebx, dword [0x4883d4]
mov eax, dword [esp]
mov ebp, eax
jmp 0x465846
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0045eddc
pop ecx
mov edi, eax
test eax, eax
jne 0x46583c
jmp 0x465886
xor esi, esi
mov ebx, dword [0x4883d0]
mov eax, dword [esp]
mov edi, eax
jmp 0x465880
push eax
call fcn.0045eddc
pop ecx
test eax, eax
je 0x465875
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x465879
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x465864
mov eax, dword [0x4883d0]
test eax, eax
je 0x465896
push eax
call fcn.0045e7b0
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4883d0], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46bcb0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46bcde
mov eax, ebx
call fcn.0046c754
cmp dword [ebx + 0x3c], 0
je 0x46bcd7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46bd4f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x46bd41
cmp dword [ebx + 8], 0
je 0x46bd00
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x46bd12
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46bd41
cmp dword [ebx + 8], 0
je 0x46bcf3
cmp eax, 3
je 0x46bd25
dec eax
jne 0x46bcf3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46bcf3
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x46bcf3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x46bd6d
cmp dword [ebx + 0x10], 0xcc
je 0x46bd6d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046bd78
pop ebx
ret
Function at 0x4095f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x40f4cc]
cmp dword [eax + 0x28], 0
jne 0x409608
xor eax, eax
jmp 0x409737
mov ecx, dword [0x40f43c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x40f430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x40f42c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x40f430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x40f42c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x40f4b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x40d680
push 0x40d6d0
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x40f428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00409530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x4095c0
mov edx, dword [0x40f4cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x40f434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x409737
cmp dword [ebp - 0x38], 0x12
jne 0x40972b
mov dword [0x40f444], 0
call fcn.00409740
xor eax, eax
jmp 0x409737
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4096fc
mov esp, ebp
pop ebp
ret 4

Function at 0x40ab00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40b69c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x40d168
sub eax, eax
test esi, esi
je 0x40b774
sub eax, 1
test ecx, ecx
je 0x40b772
test esi, 3
je 0x40b6da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40b6bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x40b759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40b6e4
mov ecx, edx
test ecx, ecx
je 0x40b772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40b75f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40b77c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040b7ff
jae 0x40b78a
xor ecx, ecx
call fcn.0040b7ff
jae 0x40b7b9
xor eax, eax
call fcn.0040b7ff
jae 0x40b7c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040b7ff
adc al, al
jae 0x40b7ab
jne 0x40b7f5
stosb byte es:[edi], al
jmp 0x40b78d
call fcn.0040b80b
sub ecx, ebx
jne 0x40b7d2
call fcn.0040b809
jmp 0x40b7f1
lodsb al, byte [esi]
shr eax, 1
je 0x40b81b
adc ecx, ecx
jmp 0x40b7ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040b809
cmp eax, 0x7d00
jae 0x40b7ee
cmp ah, 5
jae 0x40b7ef
cmp eax, 0x7f
ja 0x40b7f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40b78d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40c14c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f000]
jne 0x40c156
repz ret
jmp fcn.0040c3fd