joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413ca0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00401b60
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x413cf7
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
push 0
push 4
mov eax, dword [ebp - 0xc]
add eax, 0x11
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x413de4
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
push 0
push 0
push 6
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
add eax, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
cmp dword [eax], 0x12345678
je 0x413d66
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call fcn.004ce490
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
mov dword [edx], 0x12345678
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x413de4
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0
jne 0x413de4
mov eax, dword [ebp - 4]
add eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x11], dl
add dword [ebp - 0x10], 1
cmp byte [ebp - 0x11], 0
jne 0x413d83
mov edi, dword [ebp - 0x10]
mov eax, dword [str._Eve]
mov dword [edi], eax
mov cl, byte [0x5f07bc]
mov byte [edi + 4], cl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0
jne 0x413de4
mov eax, dword [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x11
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
cmp dword [ebp - 4], 0
je 0x413df6
mov eax, dword [ebp - 4]
push eax
call fcn.004c7fad
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x41a540
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
movzx eax, word [ebp - 0x1a]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
mov dword [ebp - 4], ecx
mov ax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret
Function at 0x41c430
Capabilities:
Accept command line arguments
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5adf9b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00419d60
add esp, 4
movzx eax, al
test eax, eax
je 0x41c478
xor eax, eax
jmp 0x41c635
push 0
call fcn.0041a150
add esp, 4
mov ecx, 2
mov word [ebp - 0x1a8], cx
lea edx, [ebp - 0x1a4]
push edx
movzx eax, word [ebp - 0x1a8]
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41c4af
or eax, 0xffffffff
jmp 0x41c635
cmp dword [ebp + 8], 7
je 0x41c4bb
cmp dword [ebp + 8], 6
jne 0x41c4d8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041bb80
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x41c635
cmp dword [ebp + 8], 2
jl 0x41c520
cmp dword [ebp + 8], 3
jne 0x41c4f2
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1d4], ecx
jmp 0x41c4fc
mov dword [ebp - 0x1d4], 0
mov edx, dword [ebp - 0x1d4]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call fcn.00436c60
add esp, 8
movzx edx, al
test edx, edx
je 0x41c520
xor eax, eax
jmp 0x41c635
push 0x5dee71
lea ecx, [ebp - 0x1c4]
call fcn.00403100
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c8], 0
jmp 0x41c552
mov eax, dword [ebp - 0x1c8]
add eax, 1
mov dword [ebp - 0x1c8], eax
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [ebp + 8]
jge 0x41c587
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.00409380
push 0x5eb930
lea ecx, [ebp - 0x1c4]
call fcn.00409380
jmp 0x41c543
call fcn.00401ff0
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
je 0x41c601
push 4
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 0x1cc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1cc]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x41c601
lea ecx, [ebp - 0x1c4]
call fcn.00403210
push eax
mov edx, dword [ebp + 8]
push edx
push str.Param_error:_argc____d___argv____s__n
push 0x1ea
push str..main.cpp
push 4
call fcn.00405d70
movzx eax, al
push eax
mov ecx, dword [ebp - 0x1cc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1cc]
push eax
mov ecx, dword [edx + 0x10]
call ecx
add esp, 0x20
xor edx, edx
jne 0x41c587
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c4]
call fcn.00403180
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret
Function at 0x427590
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x4275ae
mov ecx, dword [ebp - 8]
call fcn.00427810
jmp 0x4275c1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x4275c1
mov ecx, dword [ebp - 8]
call fcn.004276c0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shl edx, 0xf
and edx, 0xefc60000
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shr eax, 0x12
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x427620
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0x20
xor eax, eax
je 0x427643
or edx, 0xffffffff
mov ecx, dword [ebp - 8]
shl edx, cl
not edx
mov dword [ebp - 0x18], edx
jmp 0x42764a
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
and ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 1
jmp 0x427677
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x270
jge 0x4276ae
mov eax, dword [ebp - 4]
shr eax, 0x1e
xor eax, dword [ebp - 4]
imul eax, eax, 0x6c078965
add eax, dword [ebp - 0x10]
and eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [edx + ecx*4 + 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
jmp 0x42766e
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x270
mov esp, ebp
pop ebp
ret 4
Function at 0x4276c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
jmp 0x4276db
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x42773d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
shr edx, 1
mov eax, dword [ebp - 0xc]
and eax, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor edx, dword [eax + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [eax + ecx*4 + 4], edx
jmp 0x4276d2
jmp 0x427748
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x26f
jge 0x4277ac
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + edx*4 + 0x9c4]
and ecx, 0x80000000
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + edx*4 + 0x9c8]
and edx, 0x7fffffff
or ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
shr eax, 1
mov ecx, dword [ebp - 0x10]
and ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor eax, ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor eax, dword [ecx + edx*4 - 0x388]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + edx*4 + 4], eax
jmp 0x42773f
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + edx*4 + 0x9c4]
and ecx, 0x80000000
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
and eax, 0x7fffffff
or ecx, eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp - 8]
and edx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
mov eax, dword [ebp - 0x14]
xor ecx, dword [eax + 0x634]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [eax + edx*4 + 4], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret

Function at 0x427810
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x270
jmp 0x42782b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x42788d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp - 8]
and eax, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
xor edx, dword [eax + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [eax + ecx*4 + 4], edx
jmp 0x427822
mov esp, ebp
pop ebp
ret
Function at 0x4288d0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call fcn.00401ff0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x428931
push 0
movzx eax, byte [0x623349]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x428931
push str.CServiceModule::RunService
push 0x5e96dc
push 0x168
push 0x5e96ec
push 0
movzx edx, byte [0x623349]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x1c
xor ecx, ecx
jne 0x4288d6
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x62aef8
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [ebp - 0x19], cl
add dword [ebp - 0x14], 1
cmp byte [ebp - 0x19], 0
jne 0x42894c
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
jne 0x42896e
mov eax, dword [ebp - 8]
jmp 0x4289cb
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4289c8
push 0xf01ff
push 0x62aef8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4289be
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4359b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x435a49
call fcn.00401ff0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x435a3e
push 4
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x435a3e
push 0x5e4db4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.setsockopt_failed:__d_in__s_n
push 0x68
push 0x5e4de8
push 4
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x20
xor ecx, ecx
jne 0x4359dd
xor al, al
jmp 0x435b25
mov dword [ebp - 0x28], 0
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x7530
mov dword [ebp - 0x20], 0xbb8
mov dword [ebp - 0x14], 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0xc
lea ecx, [ebp - 0x28]
push ecx
push 0x98000004
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x435b07
call fcn.00401ff0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x435aff
push 4
call fcn.00405d70
movzx eax, al
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x435aff
push str.SetSocketKeepAlive
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAIoctl_failed:__d_n_in__s
push 0x7d
push 0x5e4e24
push 4
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x20
xor ecx, ecx
jne 0x435a9e
xor al, al
jmp 0x435b25
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x1e
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], 3
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x437130
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2378
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x31], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403140
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.00403230
movzx ecx, al
test ecx, ecx
je 0x4371c1
mov byte [ebp - 0x13c], 0
push 0x103
push 0
lea edx, [ebp - 0x13b]
push edx
call fcn.004ce490
add esp, 0xc
push 0x104
lea eax, [ebp - 0x13c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004031c0
push 0
lea ecx, [ebp - 0x2c]
call fcn.00403210
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jbe 0x4372d9
mov edx, dword [ebp - 0x30]
push edx
call fcn.004bde9a
add esp, 4
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x30]
push edx
push 0
lea ecx, [ebp - 0x2c]
call fcn.00403210
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4372b4
mov dword [ebp - 0x144], 4
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x188]
push ecx
push 0x5e5154
mov edx, dword [ebp - 0x140]
push edx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x188]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x188]
mov edx, dword [ecx + 8]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
push ecx
push 0x5e5158
lea edx, [ebp - 0x184]
push edx
call fcn.004c7ef1
add esp, 0x18
lea eax, [ebp - 0x184]
push eax
mov ecx, dword [ebp + 8]
call fcn.004031c0
mov byte [ebp - 0x31], 1
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x190], ecx
mov edx, dword [ebp - 0x190]
push edx
call fcn.004bdea5
add esp, 4
mov dword [ebp - 0x140], 0
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x191], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403180
mov al, byte [ebp - 0x191]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret
Function at 0x437310
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, 2
mov word [ebp - 0x18], ax
push 0x5e5164
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
movzx ecx, word [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x43735f
xor al, al
jmp 0x43738e
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x43737e
xor al, al
jmp 0x43738e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
jmp 0x43738e
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret

Function at 0x4373a0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, 2
mov word [ebp - 0x18], ax
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x14], eax
movzx ecx, word [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4373ec
xor al, al
jmp 0x43742f
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x43740b
xor al, al
jmp 0x43742f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp + 8]
push edx
call fcn.00437310
add esp, 4
jmp 0x43742f
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret
Function at 0x438b70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x400
push 0
push 0x62cfd0
call fcn.004ce490
add esp, 0xc
call fcn.00401ff0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x438be7
push 0
call fcn.00405d70
movzx eax, al
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x438be7
push str.GetLanguage
push 0x5e5480
push 0x429
push 0x5e5484
push 0
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x1c
xor ecx, ecx
jne 0x438b8a
mov edx, dword [ebp + 0x14]
push edx
push 0x400
push 0x62cfd0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x438c79
call fcn.00401ff0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x438c70
push 0
call fcn.00405d70
movzx eax, al
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x438c70
mov edx, dword [ebp + 0x10]
push edx
push str.Return_normal_value___s__n
push 0x42e
push 0x5e54ac
push 0
call fcn.00405d70
movzx eax, al
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x10]
call ecx
add esp, 0x1c
xor edx, edx
jne 0x438c14
mov eax, dword [ebp + 0x10]
jmp 0x438c7e
mov eax, 0x62cfd0
mov esp, ebp
pop ebp
ret
Function at 0x438fd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a22f6
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401ff0
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x43906a
push 0
call fcn.00405d70
movzx eax, al
push eax
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, al
test ecx, ecx
je 0x43906a
push str._GetRegPath
push 0x5e5584
push 0x479
push 0x5e5590
push 0
call fcn.00405d70
movzx edx, al
push edx
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x13c]
push edx
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x1c
xor ecx, ecx
jne 0x438ffb
push 0x5dec02
lea ecx, [ebp - 0x138]
call fcn.00403100
mov dword [ebp - 4], 0
push 0x104
push 0
lea edx, [ebp - 0x11c]
push edx
call fcn.004ce490
add esp, 0xc
push 0x103
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x138]
call fcn.004031c0
mov edx, dword [0x5f0818]
push edx
push 0x5c
lea ecx, [ebp - 0x138]
call fcn.00411f40
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x5f0818]
je 0x439147
mov ecx, dword [ebp - 0x10]
add ecx, 1
push ecx
push 0
lea edx, [ebp - 0x158]
push edx
lea ecx, [ebp - 0x138]
call fcn.00403280
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x160], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x160]
push ecx
lea ecx, [ebp - 0x138]
call fcn.004031a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x158]
call fcn.00403180
push 0x5e559c
lea ecx, [ebp - 0x138]
call fcn.00409380
jmp 0x439157
push 0x5e55ac
lea ecx, [ebp - 0x138]
call fcn.004031c0
push 0x104
push 0
lea edx, [ebp - 0x11c]
push edx
call fcn.004ce490
add esp, 0xc
lea ecx, [ebp - 0x138]
call fcn.00403210
push eax
push 0x103
lea eax, [ebp - 0x11c]
push eax
push 0x5e55bc
push 0x5e55dc
push 0x5e55ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x11c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004031c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.00403180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret