joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4696c8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4696e4
cmp dword [esi + 4], 0
je 0x469711
test byte [ebx + 0x55], 1
jne 0x469703
mov eax, ebx
call fcn.00468268
test eax, eax
jne 0x469703
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x469821
mov edx, esi
mov eax, ebx
call fcn.004691ec
jmp 0x469821
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46981a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046b538
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00465ef8
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004696c8
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046b538
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469821
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ff20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4d9bbc]
cmp byte [eax + 0xc], 0
je 0x47008d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x470086
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4dabe4], 0
jne 0x46ff74
push 0x470094
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x47009c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dabe4], eax
cmp dword [0x4d8094], 0
jne 0x47006f
push 0x4700ac
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4d8094], eax
cmp dword [0x4d8094], 0
je 0x47006f
push 0x4700b8
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dabe8], eax
push 0x4700c8
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dabec], eax
push 0x4700dc
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dabf0], eax
push 0x4700f4
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dabf4], eax
push 0x47010c
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dabf8], eax
push 0x470120
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dabfc], eax
push 0x470138
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dac00], eax
push 0x470150
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dac04], eax
push 0x47016c
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dac08], eax
push 0x470178
mov eax, dword [0x4d8094]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dac0c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47008d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4941eb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4d8fce
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x494243
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4d8fef
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x494239
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x494247
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4b7208
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b7229
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b7229
xor eax, eax
ret
mov al, 1
ret
Function at 0x100043c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006534f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1009a8a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x1000449c
je 0x10004497
cmp eax, 0x80000000
je 0x10004497
test eax, eax
jne 0x100044a3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Heap::constructor_void_]
mov eax, dword [0x1009bddc]
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000444b
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.10010da0
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_class_ScCore::Variant____thiscall_ScCore::Variant::operator_unsigned_short_int_const__]
mov eax, dword [0x1009bddc]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x1000447c
mov eax, dword [ebp - 0x10]
lea ecx, [ecx + eax*4]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100044bf
xorps xmm0, xmm0
jmp 0x100044ba
cmp eax, 0x40000000
je 0x100044af
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100044b6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10010da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10010daf
pop dword [ebp - 0x28]
mov eax, 0x5e836a99
add eax, 0xb17da316
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x1e484018
add dword [ebp - 0x38], 0x300a0533
mov dword [ebp - 0x34], 0x3cd2efbb
add dword [ebp - 0x34], 0xf5605c8a
mov dword [ebp - 0x30], 0x2fe6ef71
sub dword [ebp - 0x30], 0xe39aab43
mov dword [ebp - 0x2c], 0xc2bb0a6
sub dword [ebp - 0x2c], 0xc2bb0a6
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6545f68f
sub dword [ebp - 0x38], 0xf0d38d39
mov dword [ebp - 0x34], 0xf8e1d22a
sub dword [ebp - 0x34], 0xb77570b5
mov dword [ebp - 0x30], 0x7d292a11
add dword [ebp - 0x30], 0xe646425b
mov dword [ebp - 0x2c], 0x31799687
add dword [ebp - 0x2c], 0xce866979
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x1cb6c736
sub eax, 0xcafb72e
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x4864f
push 0
call eax
mov ecx, 0x6e7242f9
add ecx, 0x918e0cab
xor esi, esi
add esi, eax
mov edx, 0xfd80e09b
sub edx, 0xed761a9b
add edx, dword [ebp - 0x28]
mov ebx, 0x878c2196
sub ebx, 0x1d44048b
sub dword [ebp - 4], 0x9465ae7e
mov edi, dword [edx]
add dword [ebp - 0xc], 0x8113db58
xor edi, ebx
add dword [ebp - 0x14], ecx
mov dword [esi], edi
mov dword [ebp - 0x18], 0x4b53dfa1
add esi, 4
add edx, 0x95914ebb
sub edx, 0x95914eb7
loop 0x10010ece
add eax, 0x72ff32eb
add eax, 0x8d01fe78
mov ebx, eax
add eax, 5
mov ecx, 0xf2824dc1
add ecx, 0x1d7db23f
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x41f0b8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4cb7b1
call fcn.004cb2b8
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], 0x2b1cecb4
mov dword [ebp - 0x18], 0x49febb67
mov dword [ebp - 0x18], 0x3823
cmp dword [ebp - 0x18], 0x3934
jle 0x41f148
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, ebx
cdq
idiv ecx
xor edx, edi
or edx, esi
mov eax, edx
cdq
push edx
push eax
mov ecx, 0xadf2f8
call fcn.00416069
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0xe6b
jl 0x41f0fe
inc ebx
cmp ebx, 0x7f9b
jl 0x41f0f9
inc edi
cmp edi, 0xe75
jl 0x41f0f7
inc esi
cmp esi, 0x48d2
jl 0x41f0f5
push 0
call dword [0xae2124]
mov dword [ebp - 0x14], 0xfffffff9
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x35e1
jge 0x41f16b
mov edx, 0xac2690
mov ecx, 0xadf2f8
call fcn.00418565
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xce96f8f
mov dword [ebp - 0x14], 0
jmp 0x41f1b5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x28], 0x6b9dd952
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x41f1a7
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, 0xffffffe6
cdq
mov ecx, 0x4e8
idiv ecx
sub eax, 0x1a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x31c489d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x3dcc94e
pushfd
mov esp, esi
pushal
pushfd
pushal
lea esp, [esp + 0x44]
jmp 0x384e75a

Function at 0x376bce2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, edx
mov byte [esp], 0x15
stc
clc
mov dword [ebp - 0x10], ecx
bts cx, 6
rcl ch, cl
bts cx, 0xf
mov ecx, dword [ebp + 0xc]
clc
pushal
cmp ecx, 0xffff
push ebx
lea esp, [esp + 0x28]
jbe 0x31c3bdf
inc bx
mov edi, dword [edx + 0x24]
btr bx, 0xf
adc ch, 0xfd
add edi, eax
shr cx, 1
jl 0x3dca3aa
bsr bx, si
test cl, 0x97
mov ebx, dword [edx + 0x20]
pushfd
sub cx, dx
add ebx, eax
ror ecx, cl
mov dword [ebp - 8], 0
bswap cx
sbb cx, 0xd9b6
mov ecx, dword [edx + 0x18]
test ch, bl
pushal
jmp 0x375cb76
bt dx, di
stc
cmc
pushal
sub ecx, dword [edx + 0x10]
push 0x971c0cbf
cmp bh, 0x76
sub esp, 0xffffffdc
jp 0x3dcc0b8
bt bp, 9
cmp ecx, dword [edx + 0x14]
pushfd
lea esp, [esp + 4]
jae 0x384e75a
pushal
lea esp, [esp + 0x20]
jmp fcn.03dcd64c
lea esp, [esp + 0x2c]
je 0x384e75a
movzx cx, dl
pushfd
add edx, eax
stc
ror cl, cl
bswap ecx
sal ch, 5
mov ecx, dword [esi + 0x7c]
jmp 0x3159290
cmp ecx, dword [ebp - 8]
push dword [esp + 4]
call fcn.037660df
mov dword [edi], edi
push ecx
mov ah, 0xf5
dec edx
pop edx
adc al, 0xe0
cmp byte [eax], al
or eax, 0x1615040e
adc byte [edi], ch
push ebp
insd dword es:[edi], dx
nop
adc eax, 0xfdd97b9
xchg ebp, ebp
pop ss
dec eax
dec edx
wait
sbb bh, al
dec eax
insb byte es:[edi], dx
fld xword [ebx]
mov eax, 0x9c2c3a63
jb 0x375cbb9
sti
leave
xchg ebp, eax
add dword [esi + 0xb], ebx
inc esi
push esp
aam 0x1c
mov dl, 0x73
sar dword [0x2c480b48], 1
sbb al, 0xb2
jae 0x375cb8e
cmp eax, 0x2c480b48
pop es
inc esp
stc
push ebx
bound ebx, qword [ebp - 0x447a75af]
out dx, al
invalid
mov byte [esp + 4], 0xbb
pushal
lea esp, [esp + 0x2c]
je 0x384e75a
push ebx
rcr dh, cl
rol dx, cl
bt bx, dx
mov esi, dword [eax + 0x3c]
and dl, al
add esi, eax
movsx dx, dl
mov edx, dword [esi + 0x78]
pushal
test edx, edx
pushfd
pushfd
jmp 0x31c6220
pushal
inc al
clc
call fcn.03d8a19f
rol bl, cl
adc cx, ax
mov ebx, dword [edx + 0x20]
shrd cx, dx, cl
not cx
inc ch
add ebx, eax
clc
movzx cx, bl
mov dword [ebp - 8], 0
movzx cx, al
shld cx, cx, 0xa
movzx cx, al
shr ecx, 0xc
mov ecx, dword [edx + 0x18]
test sp, di
push esp
push 0x12a5fe51
cmp ecx, dword [ebp - 8]
pushal
pushfd
lea esp, [esp + 0x2c]
jbe 0x384e75a
xor esi, edx
rol edi, 0x11
sub ecx, 1
not si
bsr di, ax
mov dword [ebp - 4], ecx
movzx cx, al
inc cl
rol di, 0xe
mov ecx, dword [ebp - 8]
shl si, 2
rol edi, 0x14
sal si, cl
add ecx, dword [ebp - 4]
rcr si, cl
xadd di, si
mov di, cx
rcr di, cl
shr ecx, 1
sar di, 1
shr edi, cl
btr di, bp
mov edi, dword [ebx + ecx*4]
btc si, 0xf
push esi
add edi, eax
push ebp
mov esi, dword [ebp + 0xc]
push dword [esp]
mov dword [esp + 8], eax
not al
lodsb al, byte [esi]
mov word [esp], 0x6555
not al
jmp 0x3d8d86f
push 0x81832b12
cmp ecx, dword [edx + 0x14]
push 0x858f29a1
lea esp, [esp + 8]
jae 0x384e75a
pushal
lea esp, [esp + 0x20]
jmp fcn.03dcd64c
Function at 0x384debd
Capabilities:
Encode data using xor

Disassembly:
pushal
pushfd
lea esp, [esp + 0x34]
jb 0x375a36d
stc
stc
pushfd
stc
cmp ah, 0x5a
push 0xdd811232
push 0xb5ebbe0c
push 0xa745f193
push 0x2f3aad75
lea esp, [esp + 0x14]
ja 0x375a36d
clc
pushal
stc
mov word [esp + 4], di
add ah, 0x20
pushal
cmc
bt bp, 8
mov byte [esp], cl
or al, al
pushfd
push dword [esp + 4]
lea esp, [esp + 0x48]

Function at 0x3dcef51
Capabilities:
Encode data using xor

Disassembly:
push dword [edi]
pop dword [esp + 8]
pushal
test bh, al
mov byte [esp], 0xe8
cmp edi, ebx
push esp
call fcn.031c23a7
lodsb al, byte [esi]
invalid
Function at 0x406cc0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
and esp, 0xfffffff8
sub esp, 0xd8
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x40]
movzx edx, word [esp + 0xc6]
mov si, dx
add edx, edx
mov di, dx
mov word [esp + 0xc6], di
mov dword [esp + 0xc0], 0x4c14af98
mov edx, dword [esp + 0xc8]
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0xcc], 0
mov dword [esp + 0xc8], 0x640619ec
mov edi, eax
mov byte [esp + 0xc5], 0xea
mov dword [esp], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov word [esp + 0x36], si
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
call fcn.00405040
lea ecx, [0x407460]
mov edx, dword [esp + 0xb8]
mov dword [esp + 0x94], edx
mov dword [esp + 0x5c], 0x1b000
mov si, word [esp + 0x36]
add si, 0xd102
mov edx, dword [esp + 0xa0]
mov word [esp + 0xc6], si
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
jmp 0x406e0a
lea eax, [esp + 0x40]
xor ecx, ecx
mov edx, dword [esp + 0x1c]
mov esi, dword [edx]
mov edi, dword [esi + 0x3c]
mov ebx, esi
add ebx, edi
mov esi, dword [esi + edi]
mov edi, dword [esp + 0x30]
or edi, 0x6ff0bcd7
mov edx, dword [esp + 0x38]
mov dword [esp + 0xcc], edx
mov dword [esp + 0xc8], edi
cmp esi, 0x4550
cmove ecx, ebx
mov ecx, dword [ecx + 0x50]
mov esi, dword [esp + 0x18]
mov dword [esi], ecx
mov ecx, dword [0x4269c8]
mov edi, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [esp], eax
call fcn.00401100
mov eax, 1
mov dword [esp + 0x10], eax
jmp 0x406e35
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
mov ecx, dword [esp + 0xc0]
xor ecx, 0xb3eb5f98
and eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x406dee
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov edx, dword [esp + 0xc]
cmp dword [edx + ecx], 0x4550
mov dword [esp + 8], eax
je 0x406e41
jmp 0x406dee
mov eax, dword [esp + 0x10]
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
lea eax, [esp + 0x40]
lea ecx, [esp + 0x50]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x50], edx
mov esi, dword [esp + 8]
mov edi, dword [esi + 0x50]
lea ebx, [esp + 0x64]
mov dword [esp + 0x64], edi
mov edi, dword [0x4269c0]
mov dword [esp + 0x68], edi
mov edi, dword [0x4269c4]
mov dword [esp + 0x80], edi
mov edi, dword [0x4269c8]
lea edx, [esp + 0x4c]
mov dword [esp + 0x4c], edi
mov edi, dword [0x4269cc]
mov dword [esp + 0x78], edi
mov edi, dword [0x4269d0]
mov dword [esp + 0x88], edi
mov edi, dword [esp + 0x30]
not edi
mov esi, dword [esp + 0x38]
not esi
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], edi
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], edx
call fcn.00406ef0
mov eax, 0xfffffffe
cmp dword [0x4269fc], 0
mov dword [esp + 0x10], eax
je 0x406e35
jmp 0x406d8b
Function at 0x401070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x64
push 0x41c198
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x41c130
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov edx, dword [ebp + 8]
push edx
call fcn.00401190
add esp, 4
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4010c3
xor eax, eax
jmp 0x401186
push 0x6d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 4], eax
push str..ConnectServer.ini
push 0
push str.GenerateLogs
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x41b360], eax
push 1
call fcn.00402e60
add esp, 4
push str.Initializing...
push 4
call dword [0x41c29c]
add esp, 8
mov ecx, 0x426980
call fcn.00404320
call fcn.00403090
push 0
push 0x101
push 0x113
mov eax, dword [0x41c1fc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.00403970
call fcn.004057c0
call fcn.00401800
call fcn.00401000
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401183
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x401181
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401143
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [0x41c194], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x280
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x1e0
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0x1e0
push 0x280
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 0xcf0000
push 0x41c198
push 0x41c130
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x41c1fc], eax
cmp dword [0x41c1fc], 0
jne 0x40128d
xor eax, eax
jmp 0x40130a
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [0x41c1fc]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x41c1fc]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [0x41c1fc]
push ecx
mov ecx, 0x42f0ec
call fcn.004016d0
push 0
push 0x5dc
push 0x101
mov edx, dword [0x41c1fc]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0xea60
push 0x102
mov eax, dword [0x41c1fc]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x3e8
push 0x103
mov ecx, dword [0x41c1fc]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401800
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x41a064]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
push 0x41c248
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [0x42a498]
push ecx
call fcn.00401860
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405d6a
mov esp, ebp
pop ebp
ret

Function at 0x401860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x41c204], eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x401a30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41c200], eax
cmp dword [0x41c200], 0
jne 0x4018ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateThread___failed_with_error__d
call dword [0x41c2a0]
add esp, 8
xor eax, eax
jmp 0x4018b1
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4018c0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41a064]
xor eax, ebp
mov dword [ebp - 8], eax
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [0x41b364], eax
cmp dword [0x41b364], 0xffffffff
jne 0x401911
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.WSASocket___failed_with_error__d
call dword [0x41c2a0]
add esp, 8
xor eax, eax
jmp 0x4019f5
mov eax, 2
mov word [ebp - 0x18], ax
push 0
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [ebp - 0x14], eax
movzx ecx, word [0x41c204]
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x16], ax
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [0x41b364]
push eax
call dword [sym.imp.WSOCK32.dll_bind]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40198a
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.bind___failed_with_error__d
push 2
call dword [0x41c29c]
add esp, 0xc
mov ecx, dword [0x41c204]
push ecx
push str.error_L3_:_cant_bind_port:__d
call fcn.00403800
add esp, 8
push 1
call fcn.004061ff
xor eax, eax
jmp 0x4019f5
push 5
mov edx, dword [0x41b364]
push edx
call dword [sym.imp.WSOCK32.dll_listen]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4019da
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.listen___failed_with_error__d
push 2
call dword [0x41c29c]
add esp, 0xc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.error_L3_:_listen___failed_with_error__d
call fcn.00403800
add esp, 8
push 1
call fcn.004061ff
xor eax, eax
jmp 0x4019f5
mov eax, dword [0x41c204]
push eax
push str.Server_Listen_OK._Port:__d
push 4
call dword [0x41c29c]
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405d6a
mov esp, ebp
pop ebp
ret