joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486d50
Capabilities:
Connect socket

Disassembly:
mov eax, dword [0x5cc538]
sub esp, 0x10
cmp ecx, eax
jne 0x486d63
shr edx, 0x10
test edx, edx
je 0x486d7c
mov ecx, 0x9c7
xor edx, edx
call fcn.0041f1a0
mov ecx, eax
call fcn.00486c90
add esp, 0x10
ret 4
mov dx, word [0x5bfd6c]
mov cx, word [0x5bfd68]
push 0
push 0
push 2
push 0
mov dword [0x5cc538], 0
call fcn.00515a30
cmp eax, 0xffffffff
mov dword [0x5bfa84], eax
jne 0x486dc4
mov ecx, 0x9c8
xor edx, edx
call fcn.0041f1a0
mov ecx, eax
call fcn.00486c90
add esp, 0x10
ret 4
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push 0x4f
mov dword [esp + 0x10], eax
mov word [esp + 4], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
jne 0x486dfd
mov ecx, dword [0x5cc54c]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [0x5f92ec]
mov edx, dword [0x5bfa84]
push 0x10
push 0x8023
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov ecx, dword [0x5bfa84]
push 0x10
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x486e54
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x486e54
mov ecx, 0x9c9
xor edx, edx
call fcn.0041f1a0
mov ecx, eax
call fcn.00486c90
add esp, 0x10
ret 4

Function at 0x486e60
Capabilities:
Send data
Send data on socket

Disassembly:
shr ecx, 0x10
sub esp, 0x104
test ecx, ecx
je 0x486e77
mov ecx, 0x9c9
jmp 0x486fa1
mov al, byte [0x5cc468]
push esi
xor edx, edx
test al, al
push 0x5cc4d0
je 0x486eca
push 0x5cc468
mov ecx, 0x9ca
call fcn.0041f1a0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x10]
push eax
call esi
mov ecx, dword [0x5c9d48]
add esp, 0x10
push ecx
mov ecx, dword [0x5f9304]
lea edx, [esp + 8]
call fcn.00513d20
push 0x5cc468
push 0x5a5880
jmp 0x486f05
mov ecx, 0x9cb
call fcn.0041f1a0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0xc]
push eax
call esi
mov ecx, dword [0x5c9d48]
add esp, 0xc
push ecx
mov ecx, dword [0x5f9304]
lea edx, [esp + 8]
call fcn.00513d20
push 0x5cc4d0
push str.__s_n
lea edx, [esp + 0xc]
push edx
call esi
mov edx, dword [0x5c9d44]
mov ecx, dword [0x5f9304]
add esp, 0xc
call fcn.00513bc0
mov edx, 0x64
mov ecx, 0x5cc468
call fcn.00420e60
mov edx, 0x64
mov ecx, 0x5cc4d0
call fcn.00420e60
mov edx, 0x3e7
mov ecx, 0x5cc940
call fcn.00420e60
mov eax, dword [0x5f92ec]
mov ecx, dword [0x5bfa84]
push 0x21
push 0x8024
push eax
push ecx
mov dword [0x5ccd28], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x486f78
sub eax, edx
push 0
mov esi, eax
mov eax, dword [0x5bfa84]
push esi
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
pop esi
je 0x486faf
mov ecx, 0x9cc
xor edx, edx
call fcn.0041f1a0
mov ecx, eax
call fcn.00486c90
add esp, 0x104
ret
Function at 0x486fc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [0x5cc534]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x486fe4
mov ecx, 0x5a4bec
call fcn.00486c90
pop ebx
add esp, 0x10c
ret
mov edx, dword [0x5bfa84]
push 1
push 1
mov ecx, 0x8024
call fcn.0056ab30
test eax, eax
jne 0x4871b5
push ebp
push esi
push edi
mov eax, dword [0x5ccd2c]
inc eax
cmp eax, 0x14
mov dword [0x5ccd2c], eax
jl 0x487034
mov edx, dword [0x5bfa84]
push ebx
push 1
mov ecx, 0x8024
mov dword [0x5ccd2c], ebx
call fcn.0056ab30
test eax, eax
jne 0x4871b2
mov ecx, dword [0x5bfa84]
push ebx
push 0x103
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x48715a
cmp edi, ebx
jle 0x487177
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x18], bl
mov dword [esp + 0x10], ebp
jle 0x487003
mov edx, dword [0x5ccd28]
jmp 0x487080
cmp edx, 0x3b5
jae 0x487110
mov al, byte [esp + ebp + 0x18]
cmp al, 0xd
je 0x487148
cmp al, 0xa
jne 0x4870bb
cmp edx, ebx
jne 0x4870ac
mov byte [0x5cc940], 0x20
mov edx, 1
mov byte [edx + 0x5cc940], bl
mov edx, dword [0x5c9d4c]
push edx
jmp 0x48712c
cmp al, 9
jne 0x487101
xor esi, esi
cmp edx, ebx
jl 0x4870ce
lea esi, [edx + 8]
shr esi, 3
shl esi, 3
sub esi, edx
cmp esi, ebx
jle 0x487148
mov ecx, esi
mov ebp, ecx
shr ecx, 2
lea edi, [edx + 0x5cc940]
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, ebp
mov ebp, dword [esp + 0x10]
and ecx, 3
add edx, esi
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
mov dword [0x5ccd28], edx
jmp 0x487148
mov byte [edx + 0x5cc940], al
inc edx
mov dword [0x5ccd28], edx
jmp 0x487148
cmp edx, ebx
jne 0x487120
mov byte [0x5cc940], 0x20
mov edx, 1
mov eax, dword [0x5c9d4c]
mov byte [edx + 0x5cc940], bl
push eax
mov ecx, dword [0x5f9304]
mov edx, 0x5cc940
mov dword [0x5ccd28], ebx
call fcn.00513d20
mov edx, dword [0x5ccd28]
inc ebp
cmp ebp, edi
mov dword [esp + 0x10], ebp
jl 0x487080
jmp 0x487003
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4871b2
xor edx, edx
mov ecx, 0x9cd
call fcn.0041f1a0
mov ecx, eax
jmp 0x48717c
mov ecx, 0x5a4bec
call fcn.00486c90
mov edx, dword [0x5c9d44]
mov ecx, dword [0x5f9304]
call fcn.00513bc0
mov ecx, dword [0x5c9d48]
push ecx
xor edx, edx
mov ecx, 0x9ce
call fcn.0041f1a0
mov ecx, dword [0x5f9304]
mov edx, eax
call fcn.00513d20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x4871c0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
push edi
call fcn.004f0c40
mov edi, eax
test edi, edi
je 0x487263
push 0x5cc4d0
mov edx, 0x104
lea ecx, [esp + 0xc]
call fcn.00420d70
lea eax, [esp + 8]
push 0x20
push eax
call fcn.005912e0
add esp, 8
test eax, eax
je 0x4871ff
mov byte [eax], 0
push esi
lea ecx, [esp + 0xc]
push 0x40
push ecx
call fcn.005912e0
mov esi, eax
add esp, 8
test esi, esi
mov ecx, 0x5cc468
je 0x487242
lea edx, [esp + 0xc]
push edx
mov edx, 0x64
mov byte [esi], 0
call fcn.00420d70
mov byte [esi], 0x40
inc esi
push esi
mov edx, 0x64
mov ecx, 0x5cc4d0
call fcn.00420d70
jmp 0x48724c
mov edx, 0x64
call fcn.00420e60
mov edx, 0xf
lea ecx, [esp + 0xc]
call fcn.00537560
mov al, byte [esp + 0xc]
test al, al
pop esi
jne 0x487274
xor ecx, ecx
call fcn.0041f0a0
xor eax, eax
pop edi
add esp, 0x108
ret
push 0
push 0x5ee150
push 0
mov edx, 0x5a4dfc
mov ecx, str.finger
call fcn.004bcfe0
push 0
push 1
lea edx, [esp + 0x10]
mov ecx, eax
mov dword [esp + 0xc], eax
call fcn.004d4440
test eax, eax
je 0x4872bf
push 0x5ee150
push 0x14
push 0x5a4dfc
mov edx, str.finger
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.004bd180
lea ecx, [esp + 4]
call fcn.004d3d60
mov ecx, dword [0x5f9304]
test ecx, ecx
je 0x48735b
mov edx, dword [0x5c9d44]
call fcn.00513bc0
mov dword [0x5cc534], 1
call fcn.00545350
push 0x5cc4d0
xor edx, edx
mov ecx, 0x9c5
call fcn.0041f1a0
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x5c9d48]
mov ecx, dword [0x5f9304]
add esp, 0xc
push edx
lea edx, [esp + 0xc]
call fcn.00513d20
push 0x5cc4d0
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4873c3
push eax
xor edx, edx
xor ecx, ecx
mov dword [0x5cc538], 0
call fcn.00486d50
mov eax, 1
pop edi
add esp, 0x108
ret
mov eax, dword [str.Finger_Window]
mov ecx, dword [0x5a8264]
mov edx, dword [0x5a8268]
push 0x5f9304
push edi
mov dword [esp + 0x10], eax
mov ax, word [0x5a826c]
push 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
push 0
mov edx, 5
lea ecx, [esp + 0x18]
mov word [esp + 0x24], ax
call fcn.005677e0
test eax, eax
mov dword [0x5f9304], eax
jne 0x4872e1
xor ecx, ecx
call fcn.0041f0a0
mov ecx, 0x5a4bec
call fcn.00486c90
xor eax, eax
pop edi
add esp, 0x108
ret
mov edx, 0x400
mov ecx, 0x5cc540
call fcn.00420e60
mov eax, dword [0x5f92ec]
push 0x400
push 0x5cc540
push 0x5cc4d0
push 0x8022
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [0x5cc538], eax
jne 0x48734e
xor edx, edx
mov ecx, 0x9c7
call fcn.0041f1a0
mov ecx, eax
call fcn.00486c90
xor eax, eax
pop edi
add esp, 0x108
ret
Function at 0x487b50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x5bfa8c], 0xffffffff
mov dword [0x5bfa88], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x5bfa88], eax
je 0x487b9c
mov edx, 0x4f
mov ecx, eax
call fcn.00515960
test eax, eax
je 0x487b9c
mov eax, dword [0x5bfa88]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x487ba3
xor ecx, ecx
jmp fcn.00487aa0
mov ecx, dword [0x5f92ec]
mov edx, dword [0x5bfa88]
push 8
push 0x802e
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x4881b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov eax, ecx
shr eax, 0x10
test eax, eax
push esi
push edi
jne 0x4883ef
cmp cx, 0x20
je 0x4883ef
mov edx, dword [0x5bfa8c]
cmp edx, 0xffffffff
je 0x4883ef
cmp dword [0x5bfa88], 0xffffffff
je 0x4883ef
push 1
push 2
mov ecx, 0x8030
call fcn.0056ab30
test eax, eax
jne 0x4883fd
mov ebp, dword [sym.imp.WSOCK32.dll_send]
xor ebx, ebx
mov eax, dword [0x5cd298]
inc eax
cmp eax, 0x14
mov dword [0x5cd298], eax
jl 0x488236
mov edx, dword [0x5bfa8c]
push ebx
push 2
mov ecx, 0x8030
mov dword [0x5cd298], ebx
call fcn.0056ab30
test eax, eax
jne 0x4883fd
cmp byte [0x5cceb0], bl
jne 0x488366
mov ecx, dword [0x5cce44]
push ecx
push 0x3e7
push 0x5cceb0
call fcn.00591c9a
add esp, 0xc
test eax, eax
je 0x4883ef
mov ecx, 0x5cceb0
call fcn.004bcf90
test eax, eax
jne 0x4883ef
mov ecx, 0x5cceb0
call fcn.00487c60
test eax, eax
je 0x4883ce
push 0xa
push 0x5cceb0
call fcn.005912e0
add esp, 8
test eax, eax
jne 0x4882b2
mov edi, 0x5cceb0
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4882a0
mov dx, word [0x5a551c]
mov word [edi], dx
push 0x5a551c
push 0x5cceb0
call fcn.005a299c
add esp, 8
test eax, eax
jne 0x488366
mov eax, dword [0x5cce44]
push eax
call fcn.005940c6
mov ecx, dword [0x5cce44]
push ecx
push 0x3e7
push 0x5cceb0
mov edi, eax
mov esi, 1
call fcn.00591c9a
add esp, 0x10
test eax, eax
je 0x488345
jmp 0x488300
mov ecx, 0x5cceb0
call fcn.004bcf90
test eax, eax
jne 0x488345
push 0x5a551c
push 0x5cceb0
call fcn.005a299c
add esp, 8
test eax, eax
jne 0x488343
mov edx, dword [0x5cce44]
push edx
push 0x3e7
push 0x5cceb0
call fcn.00591c9a
add esp, 0xc
test eax, eax
jne 0x488300
jmp 0x488345
xor esi, esi
mov eax, dword [0x5cce44]
push ebx
push edi
push eax
call fcn.00592bfe
add esp, 0xc
cmp esi, ebx
jne 0x4883ce
mov byte [0x5cceb0], 0xa
mov byte [0x5cceb1], bl
mov eax, 0x5cceb0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x488370
sub eax, edx
mov esi, eax
mov eax, 0x5cceb0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x488383
mov ecx, dword [0x5bfa8c]
push ebx
sub eax, edx
push eax
push 0x5cceb0
push ecx
call ebp
cmp eax, 0xffffffff
je 0x4883e2
cmp eax, esi
jge 0x4883ce
lea edx, [eax + 0x5cceb0]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4883b0
sub eax, esi
inc eax
push eax
push edx
push 0x5cceb0
call fcn.00592290
add esp, 0xc
jmp 0x488205
mov edx, 0x3e7
mov ecx, 0x5cceb0
call fcn.00420e60
jmp 0x488205
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4883fd
pop edi
pop esi
pop ebp
mov ecx, 2
pop ebx
jmp fcn.00487aa0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x48b5a0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3e8
push esi
mov esi, ecx
mov ecx, dword [0x5cd3f0]
test ecx, ecx
je 0x48b617
cmp dword [ecx], esi
je 0x48b5c9
mov ecx, dword [ecx + 0x21c]
test ecx, ecx
jne 0x48b5b3
pop esi
add esp, 0x3e8
ret
call fcn.0048b520
cmp esi, dword [0x5f92ec]
jne 0x48b5ec
mov ecx, 4
call fcn.0054d610
pop esi
add esp, 0x3e8
jmp fcn.0041f710
mov edx, 0x3e7
lea ecx, [esp + 4]
call fcn.00420e60
push 0x3e6
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
add esp, 0x3e8
ret
Function at 0x48dc80
Capabilities:
Capture screenshot

Disassembly:
push esi
mov esi, ecx
call fcn.005612a0
test eax, eax
je 0x48de19
mov eax, dword [esi + 0x884]
push ebp
xor ebp, ebp
cmp eax, ebp
push edi
je 0x48dcc9
xor edx, edx
mov ecx, esi
call fcn.00565480
mov eax, dword [esi + 0x884]
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push ebp
push eax
call edi
mov eax, dword [esi + 0x888]
cmp eax, ebp
je 0x48dcc9
push 1
push ebp
push eax
call edi
mov eax, dword [esi + 0x88c]
cmp eax, ebp
je 0x48ddc7
push ebx
push 1
push eax
call dword [sym.imp.USER32.dll_GetScrollPos]
mov ebx, dword [sym.imp.USER32.dll_ShowScrollBar]
mov edi, eax
cmp edi, ebp
je 0x48dcf9
mov ecx, dword [esi + 0x88c]
push ebp
push 1
push ecx
call ebx
mov edx, dword [esi + 0x98c]
mov eax, dword [esi + 0x88c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push edx
push 0x30
push eax
call ebp
mov ecx, dword [esi]
call fcn.004f4340
test edi, edi
je 0x48dd2b
mov ecx, dword [esi + 0x88c]
push 1
push 1
push ecx
call ebx
mov eax, dword [esi + 0x71c]
cmp eax, 1
mov ecx, dword [esi + 0xa04]
pop ebx
je 0x48dd8a
cmp eax, 9
jne 0x48dd4b
cmp dword [esi + 0x720], 1
je 0x48dd8a
mov eax, dword [esi + 0x76c]
cmp eax, 1
je 0x48dd86
cmp eax, 2
mov edx, dword [0x5f1964]
jne 0x48dd66
cmp edx, 1
je 0x48dd86
cmp eax, 3
je 0x48dd74
cmp eax, 2
jne 0x48dd8a
cmp edx, eax
jne 0x48dd8a
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
add ecx, edx
jmp 0x48dd8a
lea ecx, [ecx + ecx - 1]
mov edx, dword [esi + 0x88c]
movzx ecx, cx
push ecx
push 0
push 0x1a0
push edx
call ebp
mov eax, dword [esi]
cmp eax, dword [0x5f9300]
jne 0x48ddad
call fcn.004f6000
mov eax, dword [esi + 0xdd8]
test eax, eax
je 0x48ddc5
mov ecx, dword [esi]
push 0
mov edx, 0x8098
call fcn.005625c0
xor ebp, ebp
cmp dword [esi + 0x71c], 3
jne 0x48dddc
mov edx, 1
mov ecx, esi
call fcn.0054a240
mov eax, dword [esi + 0x6cc]
cmp eax, ebp
je 0x48ddf3
mov dword [eax + 0x14], ebp
mov dword [eax + 0x18], ebp
mov eax, dword [eax + 0x40]
cmp eax, ebp
jne 0x48dde6
mov ecx, dword [esi]
mov edx, 0x80b8
call fcn.00563590
mov ecx, dword [esi]
push 0x601
push ebp
push ebp
push ecx
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop ebp
mov ecx, esi
pop esi
jmp fcn.0053b590
pop esi
ret
Function at 0x48f6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
mov eax, dword [0x5ed440]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov dword [esp + 8], edx
mov esi, ecx
je 0x48f6f6
pop esi
xor eax, eax
pop ebx
add esp, 0x80
ret 0x14
mov eax, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
mov dword [0x5ed428], eax
mov dword [0x5ed42c], ebx
mov ecx, dword [ebp]
push edi
mov dword [0x5ed440], 1
mov dword [0x5ed430], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.00561000
mov edx, dword [esp + 0x10]
mov dword [0x5ed43c], eax
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
mov ecx, 0xf
lea edi, [esp + 0x18]
push 0x1f
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x78]
push eax
call fcn.005911a0
mov edi, dword [esp + 0xa0]
mov ecx, dword [edi]
mov edx, dword [esp + 0xa4]
mov eax, dword [edx]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0xa8]
mov dl, byte [ecx]
add esp, 0xc
push esi
mov dword [esp + 0x68], eax
mov byte [esp + 0x6f], dl
mov dword [esp + 0x1c], 0x3c
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x48f7c7
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x48f7c7
mov ecx, dword [0x5ed428]
xor eax, eax
cmp ecx, ebx
setge al
mov dword [esp + 0x1c], esi
lea eax, [eax + eax + 4]
mov dword [0x5eeeac], eax
jmp 0x48f7db
mov ecx, dword [0x5f92ec]
mov dword [esp + 0x1c], ecx
mov dword [0x5eeeac], 2
mov eax, dword [0x5eeee0]
cmp eax, ebx
lea edx, [esp + 0x54]
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], 0x12059
mov dword [esp + 0x4c], 5
mov dword [esp + 0x50], 0x1e
mov word [esp + 0x48], 0xa000
mov dword [esp + 0x3c], 0x1e0
jne 0x48f818
mov eax, dword [0x5f92e8]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], 0x48f4e0
call dword [sym.imp.comdlg32.dll_ChooseFontA]
test eax, eax
jle 0x48f8d2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x70]
lea eax, [esp + 0x70]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x48f845
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x98]
neg edx
mov dword [edi], edx
movzx edx, byte [esp + 0x6b]
mov dword [eax], ecx
mov ecx, dword [esp + 0x9c]
mov dword [ecx], edx
mov edx, dword [0x5ed430]
mov dword [ebp], edx
cmp dword [esp + 0xa4], ebx
jge 0x48f89c
pop edi
pop ebp
pop esi
mov dword [0x5ed440], ebx
mov eax, 1
pop ebx
add esp, 0x80
ret 0x14
mov edx, dword [ebp]
mov ecx, dword [ecx]
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push edx
mov edx, dword [eax]
mov eax, dword [edi]
push ecx
push edx
mov edx, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.0048e570
xor ecx, ecx
call fcn.0048e480
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
jmp 0x48f8df
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
pop edi
pop ebp
pop esi
mov dword [0x5ed428], ebx
mov dword [0x5ed42c], ebx
mov dword [0x5eeeac], ebx
mov dword [0x5ed440], ebx
pop ebx
add esp, 0x80
ret 0x14
Function at 0x491cb0
Capabilities:
Clear file content

Disassembly:
sub esp, 0x3f0
push esi
mov esi, ecx
mov eax, dword [esi + 0x468]
push edi
xor edi, edi
cmp eax, edi
je 0x491d95
mov ecx, dword [esi + 0x474]
cmp ecx, 1
jne 0x491d67
lea eax, [esi + 0x234]
push eax
lea ecx, [esi + 0x130]
push ecx
lea edx, [esp + 0x18]
push 0x5a49b4
push edx
mov dword [esi + 0x474], 2
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
call fcn.00421690
test eax, eax
je 0x491d58
mov eax, dword [esp + 8]
xor ecx, ecx
cmp eax, eax
jne 0x491d58
mov edx, dword [esp + 0xc]
cmp edx, ecx
jne 0x491d58
cmp dword [esi + 0x464], eax
jb 0x491d58
mov eax, dword [esi + 0x468]
cmp eax, 0x2000
jb 0x491d58
add eax, 0xffffe000
pop edi
mov dword [esi + 0x468], eax
pop esi
add esp, 0x3f0
ret
mov dword [esi + 0x468], edi
pop edi
pop esi
add esp, 0x3f0
ret
cmp ecx, 2
mov dword [esi + 0x474], edi
jne 0x491d95
mov ecx, dword [esi + 0x43c]
push edi
push eax
xor edx, edx
call fcn.00490410
and eax, edx
cmp eax, 0xffffffff
je 0x491d95
mov eax, dword [esi + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
add esp, 0x3f0
ret
Function at 0x492040
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x5ed44c]
sub esp, 0x7d0
test eax, eax
push esi
mov esi, ecx
je 0x492060
cmp eax, esi
je 0x49206a
mov eax, dword [eax + 0x4bc]
test eax, eax
jne 0x492052
xor eax, eax
pop esi
add esp, 0x7d0
ret
mov ecx, dword [esi + 0x4b8]
call fcn.004f0af0
test eax, eax
je 0x492060
mov ecx, dword [0x5f92ec]
push edi
push 0
push 0x46d320
mov edx, 0xfa
mov dword [0x5ca43c], esi
call fcn.0046c300
mov ecx, esi
mov edi, eax
mov dword [0x5ca43c], 0
call fcn.00491bd0
test eax, eax
je 0x49210c
mov ecx, dword [esi + 0x4b8]
call fcn.004f0af0
test eax, eax
je 0x492103
test edi, edi
jg 0x492117
mov eax, dword [esi + 0x47c]
test eax, eax
je 0x492103
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4920e5
push 0
sub eax, edx
mov edx, dword [esi + 0x4b0]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
xor edx, edx
mov ecx, esi
call fcn.00491f60
pop edi
xor eax, eax
pop esi
add esp, 0x7d0
ret
cmp edi, 2
jne 0x492286
mov eax, dword [esi + 0x47c]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x4921a5
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call edi
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x492146
push 0
sub eax, edx
mov edx, dword [esi + 0x4b0]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
lea eax, [esi + 0x68]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x3f8]
push str._s_id__s
push edx
call edi
mov eax, dword [esi + 0x4b8]
add esp, 0x10
push eax
mov edx, 2
lea ecx, [esp + 0x3f4]
call fcn.004d9d40
lea ecx, [esp + 0x3f0]
push ecx
push str.__ignore__wdu__s
jmp 0x4921e4
lea eax, [esi + 0x68]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x3f8]
push 0x5a5d90
push edx
call edi
mov eax, dword [esi + 0x4b8]
add esp, 0x10
push eax
mov edx, 2
lea ecx, [esp + 0x3f4]
call fcn.004d9d40
lea ecx, [esp + 0x3f0]
push ecx
push str.__ignore__du__s
lea edx, [esp + 0x10]
push edx
call edi
mov eax, dword [esi + 0x4b8]
mov ecx, dword [eax]
add esp, 0xc
push eax
push 0
push 0
push 0
lea edx, [esp + 0x18]
push 0
call fcn.00440db0
xor edx, edx
mov ecx, esi
call fcn.00491f60
mov esi, dword [0x5ed44c]
test esi, esi
je 0x49227b
jmp 0x492220
mov eax, dword [esi + 0x47c]
test eax, eax
lea eax, [esi + 0x68]
lea ecx, [esi + 4]
push eax
lea edx, [esp + 0xc]
push ecx
je 0x49223d
push str._s_id__s
jmp 0x492242
push 0x5a5d90
push edx
call edi
add esp, 0x10
push 1
push 0
lea edx, [esp + 0x10]
lea ecx, [esp + 0x3f8]
call fcn.00560640
test eax, eax
je 0x492271
xor edx, edx
mov ecx, esi
call fcn.00491f60
mov esi, dword [0x5ed44c]
jmp 0x492277
mov esi, dword [esi + 0x4bc]
test esi, esi
jne 0x492220
pop edi
xor eax, eax
pop esi
add esp, 0x7d0
ret
mov eax, edi
pop edi
pop esi
add esp, 0x7d0
ret
Function at 0x493c40
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.005925e0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x493e35
cmp dword [esi + 0x474], ebx
je 0x493c65
call fcn.00491cb0
mov edx, dword [esi + 0x4b0]
push 1
push 1
mov ecx, 0x8012
mov dword [esi + 0x4ac], ebx
call fcn.0056ab30
test eax, eax
jne 0x493e35
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push edi
nop
mov ecx, dword [esi + 0x4b4]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x4b4], ecx
jl 0x493cc5
mov edx, dword [esi + 0x4b0]
push ebx
push 1
mov ecx, 0x8012
mov dword [esi + 0x4b4], ebx
call fcn.0056ab30
test eax, eax
jne 0x493e33
mov ecx, dword [esi + 0x4b0]
push ebx
push 0x2000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov edi, eax
cmp dword [esi + 0x440], 4
jne 0x493e33
cmp edi, 0xffffffff
je 0x493df6
cmp edi, ebx
jle 0x493e16
mov edx, dword [esi + 0x458]
mov ecx, dword [esi + 0x470]
mov eax, dword [esi + 0x468]
add edx, edi
add ecx, edi
cmp eax, ebx
mov dword [esi + 0x458], edx
mov dword [esi + 0x470], ecx
jbe 0x493d30
mov edx, dword [esi + 0x43c]
push 2
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x43c]
push ebx
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x493e1d
cmp edi, dword [esp + 0x10]
jne 0x493e1d
mov eax, dword [esi + 0x458]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, esi
mov dword [esi + 0x45c], eax
call fcn.00491e20
mov ecx, esi
call fcn.00493690
test eax, eax
je 0x493e33
mov eax, dword [0x5ed44c]
cmp eax, ebx
je 0x493e33
cmp eax, esi
je 0x493db0
mov eax, dword [eax + 0x4bc]
cmp eax, ebx
jne 0x493d95
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2004
ret
mov eax, dword [esi + 0x464]
cmp eax, ebx
jbe 0x493dc2
cmp dword [esi + 0x458], eax
jae 0x493e0a
cmp dword [0x5ed450], ebx
je 0x493c90
cmp dword [esi + 0x470], 0x7d000
jl 0x493c90
mov ecx, dword [esi + 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esi + 0x470], ebx
jmp 0x493c90
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x493e33
mov ecx, 0xb67
jmp 0x493e22
mov edx, dword [esi + 0x464]
mov dword [esi + 0x458], edx
push 0x5a4bec
jmp 0x493e2a
mov ecx, 0xb65
xor edx, edx
call fcn.0041f1a0
push eax
mov ecx, esi
xor edx, edx
call fcn.00492700
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2004
ret