joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457070
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495912
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
push edi
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x200
je 0x4570cc
jmp 0x457237
cmp dword [ebp - 0x38], 0
jne 0x4570f2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
jmp 0x457252
mov ecx, dword [ebp - 0x38]
call fcn.004097c0
test eax, eax
je 0x45710b
mov ecx, dword [ebp - 0x38]
call fcn.004097c0
mov dword [ebp - 0x38], eax
jmp 0x4570f2
lea ecx, [ebp - 0x34]
push ecx
call fcn.004019b0
mov ecx, dword [eax + 0x20]
call sub.MFC42.DLL_CWnd::GetWindowTextA
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x38]
call sub.MFC42.DLL_CWnd::GetWindowTextA
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.0041daf0
and eax, 0xff
test eax, eax
je 0x45715e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
jmp 0x457252
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
push 2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, eax
jne 0x457196
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
jmp 0x457252
push 0x1b
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x4571c5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
jmp 0x457252
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4571f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
jmp 0x457252
push 0x1e
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00458210
add esp, 8
cmp dword [0x4b051f], eax
je 0x457222
mov dword [0x4b058b], 1
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458210
add esp, 8
mov dword [0x4b051f], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457b40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push 0x10
push 0x4b0523
push 0x47a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x80
lea ecx, [ebp - 0x80]
push ecx
push 0x47f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 8
jle 0x457ba6
mov dword [ebp - 0x8c], 8
jmp 0x457bb9
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jge 0x457bce
mov dword [ebp - 0x90], 0
jmp 0x457c0b
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 8
jle 0x457bec
mov dword [ebp - 0x94], 8
jmp 0x457bff
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x90]
mov dword [0x4b054b], edx
push 0x80
lea eax, [ebp - 0x80]
push eax
push 0x481
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov dword [0x4b054f], eax
push 0x80
lea eax, [ebp - 0x80]
push eax
push 0x483
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [0x4b054f]
add esi, 1
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
cmp esi, eax
jle 0x457c91
mov eax, dword [0x4b054f]
add eax, 1
mov dword [ebp - 0x98], eax
jmp 0x457ca4
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov dword [ebp - 0x98], eax
mov edx, dword [ebp - 0x98]
mov dword [0x4b0553], edx
push 0
push 0
push 0x147
push 0x482
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x457cfc
mov dword [0x4b0547], 0x53
push 0x498130
push 0x4b0557
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x457d2d
mov dword [0x4b0547], 0x54
push 0x20
push 0x4b0557
push 0x480
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [0x4b054b], 0
mov dword [ebp - 0x84], 0
jmp 0x457d48
mov edx, dword [ebp - 0x84]
add edx, 1
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x84]
cmp eax, dword [0x4b0594]
jge 0x457d94
mov ecx, dword [ebp - 0x84]
imul ecx, ecx, 0x54
mov edx, dword [ecx + 0x4ab100]
cmp edx, dword [0x4b0543]
jne 0x457d92
push 0x54
push 0x4b0523
mov eax, dword [ebp - 0x84]
imul eax, eax, 0x54
add eax, 0x4ab0e0
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
jmp 0x457d96
jmp 0x457d39
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4593c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jne 0x4593de
mov al, 1
jmp 0x4594ac
cmp dword [ebp + 0xc], 2
jne 0x4593eb
xor al, al
jmp 0x4594ac
mov dword [ebp - 8], 0
push 0
push 4
call sub.WINDCS32.dll_Ordinal_69
push eax
push str._s_recipeprojectplant.ini
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x459438
lea edx, [ebp - 0x10c]
push edx
push 0
push str.EnableStreams
push str.Version4.60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x459438
xor al, al
jmp 0x4594ac
cmp dword [ebp + 0xc], 1
jne 0x459453
push 0x42
call sub.WINDCS32.dll_Ordinal_53_1
push eax
call sub.PROD32.DLL_Ordinal_1_2
test eax, eax
jne 0x459453
xor al, al
jmp 0x4594ac
cmp dword [ebp + 0xc], 2
jne 0x45947a
lea eax, [ebp - 0x10c]
push eax
push 0
push str.FreeCandidateRecipeEnabled
push str.Version5.00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x45947a
xor al, al
jmp 0x4594ac
cmp dword [ebp + 8], 4
jne 0x459484
mov al, 1
jmp 0x4594ac
cmp dword [ebp + 0xc], 4
jne 0x45948e
mov al, 1
jmp 0x4594ac
cmp dword [ebp + 8], 3
jne 0x45949a
cmp dword [ebp + 0xc], 2
je 0x4594a6
cmp dword [ebp + 8], 2
jne 0x4594aa
cmp dword [ebp + 0xc], 3
jne 0x4594aa
xor al, al
jmp 0x4594ac
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x469720
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x4b0916]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x469785
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
cmp edx, dword [ebp + 0xc]
je 0x469785
cmp dword [ebp - 4], 0
je 0x469753
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
jmp 0x46975a
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push str.WMC____4.4X___wmc_OnSocketEvent:_Event_from_unknown_socket___4.4X__n
push 0x4b1180
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x4b1180
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x469892
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
je 0x4697a0
cmp dword [ebp - 0x14], 0x20
je 0x469853
jmp 0x469892
cmp dword [ebp - 4], 0
jne 0x4697ab
jmp 0x469892
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0x20
jge 0x4697bd
mov dword [ebp - 0x18], 0x20
jmp 0x4697cc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
xor edx, edx
mov dx, word [ecx + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
sub edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x14]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call sub.WSOCK32.dll_recv
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
xor eax, eax
mov ax, word [edx + 0xc]
cmp eax, 0xfe08
jle 0x469816
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
jmp 0x469892
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov cx, word [eax + 0xc]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], ecx
jge 0x46983b
jmp 0x469892
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004692e0
add esp, 4
jmp 0x469892
cmp dword [ebp - 4], 0
je 0x469864
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
jmp 0x46986b
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
push ecx
push str.WMC____4.4X___wmc_OnSocketEvent:_FD_CLOSE_received____call_wmc_Disconnect___..._n
push 0x4b1180
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x4b1180
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.0046a030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x469950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0
push str.PCU_SERV
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x469977
push 5
push str.PCU_SERV.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469980
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4699a2
mov eax, dword [ebp - 4]
jmp 0x469a09
mov word [ebp - 0x14], 2
push 0x3ffe
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
je 0x4699d5
mov eax, dword [ebp - 4]
jmp 0x469a09
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov eax, dword [ebp - 4]
push eax
push str.WMC____4.4X___wmc_Connect:_ConnectOneHost_FAILED_with__d___n
push 0x4b1180
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x4b1180
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
push ecx
call sub.WSOCK32.dll_closesocket
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a030
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x4b0916]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46a052
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 8], edx
jmp 0x46a059
mov dword [ebp - 8], 0
push 0x4b08a0
mov eax, dword [ebp - 8]
push eax
push str.WMC____4.4X___wmc_Disconnect:_AppName_s_n
push 0x4b1180
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x4b1180
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x4b0ef8], 0
je 0x46a0d2
cmp dword [ebp - 4], 0
je 0x46a09a
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
jmp 0x46a0a1
mov dword [ebp - 0xc], 0
push 0x4b08a0
mov eax, dword [ebp - 0xc]
push eax
push str.WMC____4.4X___wmc_Disconnect:_AppName_s__REENTRANT___n
push 0x4b1180
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x4b1180
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
jmp 0x46a211
mov dword [0x4b0ef8], 1
cmp dword [ebp - 4], 0
je 0x46a155
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_shutdown
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call sub.WSOCK32.dll_closesocket
mov edx, dword [ebp - 4]
cmp dword [edx + 0xfe20], 0
je 0x46a118
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xfe20]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call sub.WSOCK32.dll_WSACleanup
push 0x4b0ee0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x4b0f00
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [0x4b08b4], 0
je 0x46a174
push 0
push 0
push 0x7d0a
mov ecx, dword [0x4b08b4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x4b08c6], 0
je 0x46a1a4
mov edx, dword [0x4b08c6]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [0x4b08c6]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4b08ca], 0
je 0x46a1ba
mov ecx, dword [0x4b08ca]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4b08ba], 0
je 0x46a1d0
mov edx, dword [0x4b08ba]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4b08be], 0
je 0x46a1e5
mov eax, dword [0x4b08be]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4b08c2], 0
je 0x46a1fb
mov ecx, dword [0x4b08c2]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x7e
push 0
push 0x4b08a0
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a990
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
cmp dword [0x4b08c6], 0
jne 0x46a9ac
xor eax, eax
jmp 0x46ab44
call fcn.0046bc10
mov dword [ebp - 0xc], 0
jmp 0x46a9c3
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [0x4b08ce]
jge 0x46a9ef
mov edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x4b08d2]
cmp edx, ecx
jne 0x46a9ed
xor eax, eax
jmp 0x46ab44
jmp 0x46a9ba
mov edx, dword [0x4b0916]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x46aa05
xor eax, eax
jmp 0x46ab44
push 0x4b0ee0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4b08c6]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov byte [ecx], 0x10
mov edx, dword [ebp - 8]
mov al, byte [ebp + 8]
mov byte [edx + 1], al
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
add ecx, 0x1e
mov edx, dword [ebp - 8]
mov byte [edx + 2], cl
mov eax, dword [ebp - 8]
mov cx, word [ebp + 0x10]
mov word [eax + 3], cx
mov edx, dword [ebp - 8]
mov word [edx + 5], 0x8000
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xf], ecx
push 0x20
push 0
mov edx, dword [0x4b08c6]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [0x4b08c6]
mov ecx, dword [0x4b08b4]
mov dword [eax], ecx
mov edx, dword [0x4b08c6]
mov dword [edx + 4], 0x7d04
mov eax, dword [0x4b08c6]
mov word [eax + 8], 1
mov ecx, dword [0x4b08c6]
mov dx, word [ebp + 0x18]
mov word [ecx + 0xa], dx
mov eax, dword [0x4b08c6]
mov word [eax + 0xc], 0x33
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0x7a120
mov dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0x40
jae 0x46aaf3
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp + ecx*4 - 0x10c], eax
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
xor edx, edx
test edx, edx
jne 0x46aac8
lea eax, [ebp - 0x118]
push eax
push 0
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0
call sub.WSOCK32.dll_select
push 0
mov edx, dword [0x4b08c6]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
mov ecx, dword [0x4b08c6]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call sub.WSOCK32.dll_send
push 0x4b0ee0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bc10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
cmp dword [0x4b0928], 0
je 0x46bc2a
jmp 0x46bd0c
mov dword [0x4b0928], 1
push 0
push 0xffffffffffffffff
call sub.WINDCS32.dll_Ordinal_69
push eax
push str._sSYSPCU_SERV.INI
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x50]
push ecx
push 0x80
lea edx, [ebp - 0xd0]
push edx
push 0x498130
push str.NoWrite
push str.TRANS_NT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0xd0]
test eax, eax
jne 0x46bc85
jmp 0x46bd0c
mov dword [ebp - 0xd8], 0
push 0x4a113c
lea ecx, [ebp - 0xd0]
push ecx
call dword [sym.imp.MSVCRT.dll_strtok]
add esp, 8
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x46bd01
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov ecx, dword [ebp - 0xd8]
mov byte [ecx + 0x4b08d2], al
push 0x4a113c
push 0
call dword [sym.imp.MSVCRT.dll_strtok]
add esp, 8
mov dword [ebp - 0xd4], eax
mov edx, dword [ebp - 0xd8]
add edx, 1
mov dword [ebp - 0xd8], edx
cmp dword [ebp - 0xd8], 0x40
jne 0x46bcff
jmp 0x46bd01
jmp 0x46bcaa
mov eax, dword [ebp - 0xd8]
mov dword [0x4b08ce], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ed40
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048efdf
test eax, eax
jne 0x48ed61
xor eax, eax
jmp 0x48ee74
mov edx, dword [ebp + 0x10]
push edx
push 0x4a928c
push 0x4b1340
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x4a9290
push 0x4b0f60
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x124], 0x4b0f60
push 0x4a9294
push 0x4b0f60
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48edd1
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x124], ecx
push 0x4a9298
push 0
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
jmp 0x48edae
mov edx, dword [ebp - 0x124]
push edx
push 0x4b1340
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.LZ32.dll_LZOpenFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48ee04
xor eax, eax
jmp 0x48ee74
push 0x1000
lea edx, [ebp - 0x120]
push edx
push 0x4b1340
call sub.LZ32.dll_LZOpenFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x48ee30
mov eax, dword [ebp - 0x10]
push eax
call sub.LZ32.dll_LZClose
xor eax, eax
jmp 0x48ee74
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.LZ32.dll_LZCopy
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.LZ32.dll_LZClose
mov ecx, dword [ebp - 0xc]
push ecx
call sub.LZ32.dll_LZClose
cmp dword [ebp - 8], 0
jg 0x48ee65
push 0x4b1340
call sub.MSVCRT.dll__unlink
add esp, 4
cmp dword [ebp - 8], 0
jge 0x48ee6f
xor eax, eax
jmp 0x48ee74
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48efdf
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
push 0x4a929c
push 0x4b0f60
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov byte [0x4b1340], 0
push 0x4a92a0
push 0x4b0f60
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48f026
mov eax, 1
jmp 0x48f1b6
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
cmp eax, 1
ja 0x48f098
mov edx, dword [ebp + 0xc]
push edx
push 0x4a92a4
push 0x4b0f60
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x4a92a8
push 0x4b0f60
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48f070
xor eax, eax
jmp 0x48f1b6
mov eax, dword [ebp - 4]
push eax
push 0x4b1340
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x4a92ac
push 0
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
jmp 0x48f167
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x48f152
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 1]
cmp ecx, 0x5c
jne 0x48f152
push 0x4a92b0
push 0x4b1340
call sub.MSVCRT.dll_strcat
add esp, 8
push str._
push 0x4b0f60
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48f0eb
xor eax, eax
jmp 0x48f1b6
mov edx, dword [ebp - 4]
push edx
push 0x4b1340
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x4a92b8
push 0x4b1340
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x4a92bc
push 0
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48f12d
xor eax, eax
jmp 0x48f1b6
mov eax, dword [ebp - 4]
push eax
push 0x4b1340
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x4a92c0
push 0
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
jmp 0x48f167
push 0x4a92c4
push 0x4b0f60
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48f1b1
push 0x4a92c8
push 0x4b1340
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
push 0x4b1340
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x4b1340
call sub.MSVCRT.dll__mkdir
add esp, 4
push 0x4a92cc
push 0
call sub.MSVCRT.dll_strtok
add esp, 8
mov dword [ebp - 4], eax
jmp 0x48f167
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x48f1bc
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x118], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffff
je 0x48f233
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll__lclose]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x118], 1
jne 0x48f2a0
push 2
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffff
je 0x48f2a0
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x118]
mov esp, ebp
pop ebp
ret