joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438fb0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x40], 0xa4a4
mov dword [0x526ab8], 0
call dword [sym.imp.USER32.dll_GetDC]
push 0x10
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
mov dword [0x5267f8], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [0x526bd0], eax
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [ebp - 0x48]
push ecx
push 2
lea edx, [ebp - 0x40]
push edx
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov dl, byte [ebp - 8]
shr eax, 1
push 5
mov dword [0x5256a4], eax
mov dword [0x526884], ecx
mov byte [0x525371], dl
mov dword [0x52671c], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
push 0
mov dword [0x526bec], eax
mov dword [0x525688], eax
call esi
push eax
call sub.IMM32.dll_ImmGetProperty
mov dword [0x526ac0], eax
xor eax, eax
mov dword [0x526ac4], eax
mov dword [0x526ac8], eax
mov dword [0x526acc], eax
mov dword [0x526ad0], eax
mov dword [0x526ad4], eax
mov dword [0x526ad8], eax
mov dword [0x526adc], eax
mov dword [0x526ae0], eax
mov dword [0x526ae4], eax
mov dword [0x526ae8], eax
mov dword [0x526aec], eax
mov dword [0x526af0], eax
mov dword [0x526af4], eax
mov dword [0x526af8], eax
mov dword [0x526afc], eax
mov dword [0x526b00], eax
mov dword [0x526b04], eax
mov dword [0x526b08], eax
mov dword [0x526b0c], eax
mov dword [0x526b10], eax
mov dword [0x526b14], eax
mov dword [0x526b18], eax
mov dword [0x526b1c], eax
mov dword [0x526b20], eax
mov dword [0x526b24], eax
mov dword [0x526b28], eax
mov dword [0x526b2c], eax
mov dword [0x526b30], eax
mov dword [0x526b34], eax
mov dword [0x526b38], eax
mov dword [0x526b3c], eax
mov dword [0x526b40], eax
push eax
call esi
push edi
mov dword [0x5269ec], eax
call fcn.00438c60
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
pop esi
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x439150
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push eax
call sub.IMM32.dll_ImmGetContext
mov esi, eax
test esi, esi
je 0x4391fd
push edi
push 0
push 0
push 8
push esi
call sub.IMM32.dll_ImmGetCompositionStringA
push 0x40
push 0
push 0x526890
mov edi, eax
call fcn.004cce10
add esp, 0xc
push edi
push 0x526890
push 8
push esi
call sub.IMM32.dll_ImmGetCompositionStringA
test byte [ebp + 0xc], 0x10
mov byte [edi + 0x526890], 0
je 0x4391db
push ebx
push 0
push 0
push 0x10
push esi
call sub.IMM32.dll_ImmGetCompositionStringA
mov ebx, eax
push ebx
push 0x5256f0
push 0x10
push esi
call sub.IMM32.dll_ImmGetCompositionStringA
mov ecx, dword [ebp + 8]
mov byte [ebx + 0x5256f0], 0
pop ebx
push esi
push ecx
mov dword [0x526abc], edi
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop esi
pop ebp
ret
push 0x40
push 0
push 0x5256f0
call fcn.004cce10
mov ecx, dword [ebp + 8]
add esp, 0xc
push esi
push ecx
mov dword [0x526abc], edi
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop esi
pop ebp
ret

Function at 0x4394a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call sub.IMM32.dll_ImmGetContext
mov esi, eax
test esi, esi
je 0x43951c
push edi
push 0
push 0
push 0x800
push esi
call sub.IMM32.dll_ImmGetCompositionStringA
mov edi, eax
test edi, edi
je 0x439514
push 0x40
push 0
push 0x5267b0
call fcn.004cce10
add esp, 0xc
push edi
push 0x5267b0
push 0x800
push esi
call sub.IMM32.dll_ImmGetCompositionStringA
push ebx
call fcn.00439360
add esp, 4
cmp dword [0x52690c], 0
jle 0x439514
mov eax, dword [0x526718]
mov ecx, dword [eax*4 + 0x5e9f3c]
push 0x5267b0
call fcn.0048a180
push esi
push ebx
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43bad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43bb5e
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x10]
push edx
push 0
push eax
push ecx
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43bb42
mov eax, dword [ebp + 8]
xor edx, edx
cmp dword [ebp - 4], edx
mov esi, 1
setle dl
dec edx
and edx, dword [ebp - 0xc]
mov dword [eax], edx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
push edx
mov dword [ecx], 0
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43bb70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
lea edx, [ebp - 0x108]
push edx
push 0x20019
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43bc85
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0
push edi
push eax
mov dword [ebp - 0x10c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43bc56
cmp dword [ebp - 0x10c], eax
jle 0x43bc24
lea eax, [ebp - 0x104]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43bbf6
mov edx, dword [ebp - 0x108]
push edx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push 0x4e59bd
push esi
call fcn.004cce8a
mov edx, dword [ebp - 0x108]
add esp, 8
push edx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push 0x4e59bd
push esi
call fcn.004cce8a
mov edx, dword [ebp - 0x108]
add esp, 8
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x43bca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43bd37
mov edx, dword [ebp + 0x10]
push esi
push edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43bd27
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp + 0x18]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call edi
mov eax, dword [ebp - 8]
push eax
call edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push eax
xor esi, esi
call edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43bd40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43bdd7
mov edx, dword [ebp + 0x10]
push esi
push edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43bdc7
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call edi
mov eax, dword [ebp - 8]
push eax
call edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push eax
xor esi, esi
call edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43bde0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43be26
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 4]
neg eax
push edx
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x46d600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [edi]
cmp ecx, dword [eax]
jne 0x46d6fd
mov edx, dword [edi + 4]
cmp edx, dword [eax + 4]
jne 0x46d6fd
mov eax, dword [eax + 8]
cmp eax, 1
jne 0x46d6d6
push ebx
push str.Received_stats_and_achievements_from_Steam_t_t_t
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebx, ebx
mov dword [ebp - 0x88], ebx
cmp dword [edi + 0xc], ebx
jle 0x46d6c0
push esi
mov esi, dword [edi + 8]
mov eax, dword [esi + ebx + 4]
add esi, ebx
test eax, eax
je 0x46d68a
dec eax
cmp eax, 1
ja 0x46d6aa
push 0x4f7018
call dword [sym.imp.steam_api.dll_SteamInternal_ContextInit]
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add esp, 4
lea edx, [esi + 0x10]
push edx
mov edx, dword [esi + 8]
push edx
call eax
jmp 0x46d6aa
push 0x4f7018
call dword [sym.imp.steam_api.dll_SteamInternal_ContextInit]
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
add esp, 4
lea eax, [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
call edx
mov eax, dword [ebp - 0x88]
inc eax
add ebx, 0x1c
mov dword [ebp - 0x88], eax
cmp eax, dword [edi + 0xc]
jl 0x46d655
pop esi
pop ebx
mov byte [edi + 0x10], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret 4
push eax
push str.RequestStats___failed___d_t_t_t
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.004cf2b2
add esp, 0x10
lea ecx, [ebp - 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004ccd49
mov esp, ebp
pop ebp
ret 4
Function at 0x46da30
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd1c
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6a5550], 0x100
jne 0x46da5f
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.steam_api.dll_SteamInternal_ContextInit]
push edi
push 0x4f7018
call esi
mov ecx, dword [eax + 0x38]
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0xec]
add esp, 4
push edi
push edx
call eax
mov dword [ebp - 0xcf4], eax
test al, 4
jne 0x46daa2
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
push 0x3ff
lea ecx, [ebp - 0x503]
push ebx
push ecx
mov dword [ebp - 0xcf0], ebx
mov dword [ebp - 0xd1c], ebx
mov dword [ebp - 0xd18], ebx
mov byte [ebp - 0x504], bl
call fcn.004cce10
push 0x4f7018
call esi
mov ecx, dword [eax + 0x38]
mov edx, dword [ecx]
mov edx, dword [edx + 0xf0]
add esp, 0x10
lea eax, [ebp - 0xcf0]
push eax
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0xd1c]
push eax
mov eax, dword [ebp + 8]
push edi
push eax
call edx
test al, al
jne 0x46db1a
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
test byte [ebp - 0xcf4], 2
je 0x46db43
lea eax, [ebp - 0x504]
push eax
push 0x4e6598
lea ecx, [ebp - 0xcec]
push 0x400
push ecx
call fcn.004cf2b2
add esp, 0x10
push 0x525608
push 0x525258
lea edx, [ebp - 0x104]
push 0x4e4cec
push edx
call fcn.004cce8a
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x8ec]
push str._s
push ecx
call fcn.004cce8a
add esp, 0x1c
lea edx, [ebp - 0x8ec]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x8eb], bl
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x103], bl
xor eax, eax
mov dword [ebp - 0xd04], eax
mov ecx, 0x50
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xd0c], eax
mov dword [ebp - 0xd08], eax
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0xcfc], eax
mov word [ebp - 0xd04], cx
mov word [ebp - 0xcf8], ax
lea ecx, [ebp - 0xd14]
lea edx, [ebp - 0x8ec]
lea eax, [ebp - 0x104]
push ecx
mov dword [ebp - 0xd14], ebx
mov dword [ebp - 0xd10], 2
mov dword [ebp - 0xcfe], ebx
mov dword [ebp - 0xd0c], edx
mov dword [ebp - 0xd08], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push 0x4f7018
call esi
mov ecx, dword [eax + 0x38]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov edx, dword [edx + 0x7c]
add esp, 4
push 0x3c
push edi
push eax
call edx
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x46dc60
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
jmp 0x46dc80
mov edi, dword [ebx + 0x1a83068]
test edi, edi
je 0x46dccf
mov eax, dword [edi + 0x263c]
mov ecx, dword [edi + 0x2640]
lea esi, [edi + 0x2630]
mov edx, eax
or edx, ecx
mov dword [esi], vtable.CCallResult_class_CWorkshopItem__struct_SteamUGCRequestUGCDetailsResult_t_.0
je 0x46dcbc
push ecx
push eax
push esi
call dword [sym.imp.steam_api.dll_SteamAPI_UnregisterCallResult]
add esp, 0xc
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
push edi
call fcn.004ce59b
add esp, 4
mov dword [ebx + 0x1a83068], 0
add ebx, 4
cmp ebx, 0x400
jb 0x46dc80
push 0x4f7018
mov dword [0x6a5550], 0
call dword [sym.imp.steam_api.dll_SteamInternal_ContextInit]
mov ecx, dword [eax + 0x38]
mov eax, dword [ecx]
mov eax, dword [eax + 0xe8]
add esp, 4
push 0x100
lea edx, [ebp - 0x904]
push edx
call eax
mov edi, eax
cmp edi, 0x100
jle 0x46dd1a
mov edi, 0x100
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x525258
call esi
push 0x525608
lea ecx, [ebp - 0x104]
push str.rd__s_q__s
push ecx
call fcn.004cce8a
lea edx, [ebp - 0x104]
push edx
call fcn.004cf35e
add esp, 0x10
push 0x525258
call esi
push 0
push 0x525608
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor esi, esi
test edi, edi
jle 0x46dd8d
jmp 0x46dd70
mov eax, dword [ebp + esi*8 - 0x900]
mov ecx, dword [ebp + esi*8 - 0x904]
push eax
push ecx
call fcn.0046da30
inc esi
add esp, 8
cmp esi, edi
jl 0x46dd70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
Function at 0x46fa50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x524d44], 0
mov dword [0x5267fc], 0
call fcn.0043b870
call fcn.0046ebc0
call fcn.0046fa10
mov eax, dword [ebp + 8]
test eax, eax
jne 0x46fa84
mov dword [0x526b70], eax
jmp 0x46faa0
cmp eax, 1
jne 0x46fa90
mov dword [0x526b70], eax
jmp 0x46faa0
xor eax, eax
cmp dword [0x526b70], eax
sete al
mov dword [0x526b70], eax
mov ecx, dword [0x5256e8]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ecx
call esi
mov edx, dword [0x5256e8]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [0x526b70], 0
jne 0x46fae5
and eax, 0x6f30ffff
or eax, 0xce0000
push eax
mov eax, dword [0x5256e8]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x46fb0e
mov ecx, dword [0x5256e8]
and eax, 0xff30ffff
or eax, 0x90000000
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, dword [0x5256e8]
push 0
push edx
call dword [sym.imp.USER32.dll_SetMenu]
call fcn.0046ebd0
call fcn.0046ec10
mov eax, dword [0x5256e8]
push eax
call fcn.00438c60
mov ecx, dword [0x5256e8]
add esp, 4
push 1
push ecx
call esi
mov edx, dword [0x5256e8]
push 9
push edx
call esi
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
mov eax, dword [0x633870]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push 0
push eax
call edx
push 0x64
push 0x64
call dword [sym.imp.USER32.dll_SetCursorPos]
fld dword [0x4e4cf4]
fstp dword [0x5256e0]
call fcn.0043be30
mov dword [0x524d44], 1
mov dword [0x5267fc], 1
pop esi
pop ebp
ret
Function at 0x47b1f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5f3d58]
cmp dword [ebp + 8], eax
jne 0x47b316
push 0x539de8
push eax
call sub.WS2_32.dll___WSAFDIsSet
mov edx, dword [0x5f3d58]
cmp eax, 1
jne 0x47b264
mov ecx, dword [0x539de8]
xor eax, eax
test ecx, ecx
je 0x47b264
cmp dword [eax*4 + 0x539dec], edx
je 0x47b233
inc eax
cmp eax, ecx
jb 0x47b223
jmp 0x47b264
push esi
lea esi, [ecx - 1]
cmp eax, esi
jae 0x47b25c
jmp 0x47b240
mov ecx, dword [eax*4 + 0x539df0]
mov dword [eax*4 + 0x539dec], ecx
mov ecx, dword [0x539de8]
inc eax
lea esi, [ecx - 1]
cmp eax, esi
jb 0x47b240
dec ecx
mov dword [0x539de8], ecx
pop esi
mov eax, dword [0x5256e8]
push 0
push 0
push eax
push edx
call sub.WS2_32.dll_WSAAsyncSelect
mov ecx, dword [0x5f3d58]
push 1
push ecx
call sub.WS2_32.dll_shutdown
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x53b0ac]
mov eax, dword [0x5f3d58]
push 0
push 0xffff
push edx
push eax
call sub.WS2_32.dll_recv
test eax, eax
je 0x47b2d3
lea ebx, [ebx]
cmp eax, 0xffffffff
je 0x47b2d3
mov ecx, dword [0x53b0ac]
mov edx, dword [0x5f3d58]
push 0
push 0xffff
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
jne 0x47b2b0
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x5f3d58]
push 2
push eax
call sub.WS2_32.dll_shutdown
mov ecx, dword [0x5f3d58]
push ecx
call sub.WS2_32.dll_closesocket
push 0x3e8
mov dword [0x5f3d58], 0xffff
mov dword [0x6a3880], 3
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebp
ret

Function at 0x47b320
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [0x6a3880], 1
jl 0x47b456
mov eax, dword [0x5f3d58]
cmp eax, 0xffff
jae 0x47b456
push 0x539de8
push eax
call sub.WS2_32.dll___WSAFDIsSet
mov edx, dword [0x5f3d58]
cmp eax, 1
jne 0x47b3a4
mov ecx, dword [0x539de8]
xor eax, eax
test ecx, ecx
je 0x47b3a4
nop
cmp dword [eax*4 + 0x539dec], edx
je 0x47b370
inc eax
cmp eax, ecx
jb 0x47b360
jmp 0x47b3a4
push esi
lea esi, [ecx - 1]
cmp eax, esi
jae 0x47b39c
jmp 0x47b380
mov ecx, dword [eax*4 + 0x539df0]
mov dword [eax*4 + 0x539dec], ecx
mov ecx, dword [0x539de8]
inc eax
lea esi, [ecx - 1]
cmp eax, esi
jb 0x47b380
dec ecx
mov dword [0x539de8], ecx
pop esi
mov eax, dword [0x5256e8]
push 0
push 0
push eax
push edx
call sub.WS2_32.dll_WSAAsyncSelect
mov ecx, dword [0x5f3d58]
push 1
push ecx
call sub.WS2_32.dll_shutdown
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x53b0ac]
mov eax, dword [0x5f3d58]
push 0
push 0xffff
push edx
push eax
call sub.WS2_32.dll_recv
test eax, eax
je 0x47b413
lea ebx, [ebx]
cmp eax, 0xffffffff
je 0x47b413
mov ecx, dword [0x53b0ac]
mov edx, dword [0x5f3d58]
push 0
push 0xffff
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
jne 0x47b3f0
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x5f3d58]
push 2
push eax
call sub.WS2_32.dll_shutdown
mov ecx, dword [0x5f3d58]
push ecx
call sub.WS2_32.dll_closesocket
push 0x3e8
mov dword [0x5f3d58], 0xffff
mov dword [0x6a3880], 3
call dword [sym.imp.KERNEL32.dll_Sleep]
ret
Function at 0x47b460
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5f3d58]
cmp dword [ebp + 8], eax
jne 0x47b5b8
push 0x539de8
push eax
call sub.WS2_32.dll___WSAFDIsSet
mov edx, dword [0x5f3d58]
cmp eax, 1
jne 0x47b4d4
mov ecx, dword [0x539de8]
xor eax, eax
test ecx, ecx
je 0x47b4d4
cmp dword [eax*4 + 0x539dec], edx
je 0x47b4a3
inc eax
cmp eax, ecx
jb 0x47b493
jmp 0x47b4d4
push esi
lea esi, [ecx - 1]
cmp eax, esi
jae 0x47b4cc
jmp 0x47b4b0
mov ecx, dword [eax*4 + 0x539df0]
mov dword [eax*4 + 0x539dec], ecx
mov ecx, dword [0x539de8]
inc eax
lea esi, [ecx - 1]
cmp eax, esi
jb 0x47b4b0
dec ecx
mov dword [0x539de8], ecx
pop esi
mov eax, dword [0x5256e8]
push 0
push 0
push eax
push edx
call sub.WS2_32.dll_WSAAsyncSelect
mov ecx, dword [0x5f3d58]
push 1
push ecx
call sub.WS2_32.dll_shutdown
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x53b0ac]
mov eax, dword [0x5f3d58]
push 0
push 0xffff
push edx
push eax
call sub.WS2_32.dll_recv
test eax, eax
je 0x47b543
lea ebx, [ebx]
cmp eax, 0xffffffff
je 0x47b543
mov ecx, dword [0x53b0ac]
mov edx, dword [0x5f3d58]
push 0
push 0xffff
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
jne 0x47b520
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x5f3d58]
push 2
push eax
call sub.WS2_32.dll_shutdown
mov ecx, dword [0x5f3d58]
push ecx
call sub.WS2_32.dll_closesocket
cmp dword [0x6424d0], 0
mov dword [0x5f3d58], 0xffff
mov dword [0x6a3880], 3
mov dword [0x5f344c], 0
jne 0x47b5b8
mov eax, dword [0x5ec230]
add eax, dword [0x1a3ba10]
push eax
push 0x6a3200
call fcn.004cce8a
push 0x34
mov dword [0x6424d0], 1
call fcn.00470df0
add esp, 0xc
pop ebp
ret
Function at 0x47b5c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [0x6a3880], 1
jl 0x47b741
mov eax, dword [0x5f3d58]
cmp eax, 0xffff
jae 0x47b741
push 0x539de8
push eax
call sub.WS2_32.dll___WSAFDIsSet
mov edx, dword [0x5f3d58]
cmp eax, 1
jne 0x47b644
mov ecx, dword [0x539de8]
xor eax, eax
test ecx, ecx
je 0x47b644
nop
cmp dword [eax*4 + 0x539dec], edx
je 0x47b610
inc eax
cmp eax, ecx
jb 0x47b600
jmp 0x47b644
push edi
lea edi, [ecx - 1]
cmp eax, edi
jae 0x47b63c
jmp 0x47b620
mov ecx, dword [eax*4 + 0x539df0]
mov dword [eax*4 + 0x539dec], ecx
mov ecx, dword [0x539de8]
inc eax
lea edi, [ecx - 1]
cmp eax, edi
jb 0x47b620
dec ecx
mov dword [0x539de8], ecx
pop edi
push 1
push edx
call sub.WS2_32.dll_shutdown
mov edx, dword [0x5256e8]
mov eax, dword [0x5f3d58]
push 0
push 0
push edx
push eax
call sub.WS2_32.dll_WSAAsyncSelect
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x53b0ac]
mov edx, dword [0x5f3d58]
push 0
push 0xffff
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
je 0x47b6b2
jmp 0x47b690
cmp eax, 0xffffffff
je 0x47b6b2
mov eax, dword [0x53b0ac]
mov ecx, dword [0x5f3d58]
push 0
push 0xffff
push eax
push ecx
call sub.WS2_32.dll_recv
test eax, eax
jne 0x47b690
push 0x6444a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x5f3d58]
push 2
push edx
call sub.WS2_32.dll_shutdown
mov eax, dword [0x5f3d58]
push eax
call sub.WS2_32.dll_closesocket
mov eax, dword [0x526908]
mov dword [0x5f3d58], 0xffff
mov dword [0x6a3880], 3
mov dword [0x5f344c], 0
cmp eax, 0x51
je 0x47b741
cmp eax, 0x50
jne 0x47b70d
call fcn.004509f0
call fcn.0046fc50
cmp dword [0x6424d0], 0
jne 0x47b741
mov edx, dword [0x5ec230]
add edx, dword [0x1a3ba10]
push edx
push 0x6a3200
call fcn.004cce8a
push 0x34
mov dword [0x6424d0], 1
call fcn.00470df0
add esp, 0xc
ret