joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5166e0
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
mov eax, 0x2004
call fcn.00571390
push esi
mov esi, ecx
test esi, esi
je 0x516925
mov edx, dword [esi + 0x3c4]
push 1
push 2
mov ecx, 0x8017
mov dword [esi + 0x39c], 0
call fcn.0054c250
test eax, eax
jne 0x516925
push ebx
push ebp
push edi
mov edi, edi
mov ecx, dword [esi + 0x3c0]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x3c0], ecx
jl 0x51675a
mov edx, dword [esi + 0x3c4]
push 0
push 2
mov ecx, 0x8017
mov dword [esi + 0x3c0], 0
call fcn.0054c250
test eax, eax
jne 0x516922
cmp dword [esi + 0x33c], 2
jne 0x516922
mov eax, dword [0x5b01f4]
test eax, eax
jne 0x51678b
mov eax, dword [0x59bd1c]
test eax, eax
jne 0x51678b
mov eax, dword [esi + 0x350]
cmp eax, dword [esi + 0x358]
jb 0x516922
mov eax, dword [esi + 0x3ac]
test eax, eax
mov edi, dword [esi + 0x34c]
je 0x5167c8
mov ecx, esi
call fcn.00514b50
test eax, eax
jne 0x5167c6
mov edx, dword [esi + 0x3c4]
push eax
push 2
mov ecx, 0x8017
call fcn.0054c250
test eax, eax
jne 0x516922
mov eax, 0x200
mov edi, eax
cmp edi, 0x200
jge 0x5167d7
mov edi, 0x200
jmp 0x5167e4
cmp edi, 0x2000
jbe 0x5167e4
mov edi, 0x2000
mov ecx, dword [esi + 0x338]
push 1
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x338]
push 0
lea edx, [esp + 0x14]
push edx
mov ebp, eax
push edi
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5168d9
mov eax, dword [esp + 0x10]
test eax, eax
mov ebx, eax
jl 0x5168d9
je 0x516922
push 0
push eax
mov eax, dword [esi + 0x3c4]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
je 0x5168e0
cmp edi, ebx
jge 0x516872
mov edx, dword [esi + 0x338]
push 0
push 0
lea ecx, [edi + ebp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, edi
mov ecx, dword [esi + 0x3b0]
mov edx, dword [esi + 0x358]
add ecx, ebx
add edx, ebx
mov dword [esi + 0x3b0], ecx
mov ecx, esi
mov dword [esi + 0x358], edx
call fcn.00514fe0
mov eax, dword [0x5b01f4]
test eax, eax
jne 0x516720
mov eax, dword [0x59bd1c]
test eax, eax
je 0x516922
mov eax, dword [esi + 0x34c]
mov ecx, dword [esi + 0x358]
mov ebx, dword [esi + 0x350]
lea edx, [eax + eax*4]
sub ecx, ebx
shl edx, 1
cmp ecx, edx
jb 0x516720
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x2004
ret
mov ecx, 0x1397
jmp 0x516911
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x51690c
mov eax, dword [esi + 0x338]
push 0
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x2004
ret
mov ecx, 0x139a
xor edx, edx
call fcn.0041d620
mov ecx, esi
xor edx, edx
push eax
call fcn.00515c80
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x2004
ret
Function at 0x516930
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x516a29
cmp dword [esi + 0x33c], 2
jne 0x516a29
mov ecx, dword [esi + 0x3c4]
push 0
push 4
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esi + 0x39c], 0
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x51699a
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x516a29
xor edx, edx
mov ecx, 0x139a
call fcn.0041d620
push eax
xor edx, edx
mov ecx, esi
call fcn.00515c80
xor eax, eax
pop esi
pop ecx
ret
test eax, eax
jle 0x5169c7
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.WSOCK32.dll_ntohl]
cmp eax, dword [esi + 0x350]
jbe 0x5169c7
mov ecx, dword [esi + 0x364]
cmp eax, ecx
mov dword [esi + 0x350], eax
jb 0x5169da
mov dword [esi + 0x350], ecx
push 0x583b74
xor edx, edx
mov ecx, esi
call fcn.00515c80
xor eax, eax
pop esi
pop ecx
ret
mov ecx, esi
call fcn.00514fe0
mov edx, dword [esi + 0x358]
cmp edx, dword [esi + 0x364]
jae 0x516a29
mov eax, dword [esi + 0x34c]
mov ecx, dword [esi + 0x350]
push edi
lea eax, [eax + eax*4]
shl eax, 1
mov edi, edx
sub edi, ecx
cmp edi, eax
sbb eax, eax
neg eax
cmp ecx, edx
mov dword [esp + 8], eax
pop edi
jae 0x516a22
mov ecx, dword [0x59bd1c]
test ecx, ecx
je 0x516a29
test eax, eax
je 0x516a29
mov ecx, esi
call fcn.005166e0
xor eax, eax
pop esi
pop ecx
ret
Function at 0x516a30
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, dword [0x5afc18]
test eax, eax
push esi
push edi
mov esi, ecx
je 0x516697
cmp eax, esi
je 0x516562
mov eax, dword [eax + 0x3cc]
test eax, eax
jne 0x516551
pop edi
pop esi
ret
mov ecx, dword [esi + 0x3c8]
call fcn.004e2760
test eax, eax
jne 0x516584
push 0x583b74
xor edx, edx
mov ecx, esi
call fcn.00515c80
pop edi
xor eax, eax
pop esi
ret
mov dword [esi + 0x33c], 1
mov dword [esi + 0x39c], 0
mov eax, dword [0x5a8b60]
test eax, eax
je 0x516656
mov eax, dword [esi + 0x3c8]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
xor edx, edx
xor ecx, ecx
call fcn.0048a3e0
mov al, byte [0x5a8a28]
test al, al
je 0x51663a
mov eax, dword [0x5a8b68]
test eax, eax
mov edx, 0x64
lea edi, [esi + 0xcc]
je 0x5165dd
push 0x5a8a28
jmp 0x5165ea
mov ecx, dword [esi + 0x3c8]
add ecx, 0x8a4
push ecx
mov ecx, edi
call fcn.0041ee40
mov eax, dword [esi + 0x340]
test eax, eax
mov word [esi + 0x354], 0
jne 0x51660f
call fcn.0041ec80
mov dword [esi + 0x340], eax
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x516641
mov eax, dword [esi + 0x3c8]
mov ecx, dword [eax]
push 9
push 0
push edi
mov edx, str.firewall
call fcn.00470c10
test eax, eax
jne 0x5166cd
mov ecx, 0x1393
jmp 0x516686
push 5
push 0
mov edx, edi
mov ecx, esi
call fcn.00514eb0
pop edi
mov eax, 1
pop esi
ret
mov dx, word [0x59bcfc]
push 1
push 1
lea ecx, [esi + 0x354]
push 0
push ecx
mov cx, word [0x59bcf8]
call fcn.005049f0
cmp eax, 0xffffffff
mov dword [esi + 0x3c4], eax
jne 0x51669c
mov ecx, 0x138f
xor edx, edx
call fcn.0041d620
push eax
xor edx, edx
mov ecx, esi
call fcn.00515c80
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [0x5b4314]
push 8
push 0x8016
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x3c8]
mov ecx, dword [eax + 0x908]
push 3
push ecx
lea edx, [eax + 0x8a4]
mov ecx, esi
call fcn.00514eb0
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [0x5afc18]
test ecx, ecx
je 0x516a54
lea ebx, [ebx]
mov eax, dword [ecx + 0x3a0]
test eax, eax
jne 0x516a70
mov ecx, dword [ecx + 0x3cc]
test ecx, ecx
jne 0x516a40
mov eax, dword [0x5b4314]
push 0x85
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x5b01f8], 0
ret
mov eax, dword [ecx + 0x378]
test eax, eax
mov dword [ecx + 0x3a0], 0
je 0x516a89
jmp fcn.00516360
jmp 0x516540
Function at 0x518fc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
push esi
mov dword [esp + 0x10], edx
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push 0x461
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
jne 0x518ff2
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x5a0bc8
push 0x3e7
push 0xd
push 0x480
push edi
call ebp
mov al, byte [0x5a0bc8]
xor ebx, ebx
cmp al, bl
je 0x519207
push 0x2a
push 0x5a0bc8
call fcn.00570260
add esp, 8
test eax, eax
jne 0x519207
push 0x3f
push 0x5a0bc8
call fcn.00570260
add esp, 8
test eax, eax
jne 0x519207
push 0x5afc20
push 0x64
push 0xd
push 0x98
push esi
call ebp
push 0x5a07e0
push 0x64
push 0xd
push 0x98
push esi
mov byte [0x5afc20], bl
call ebp
cmp byte [0x5a07e0], 0x20
mov eax, 0x5a07e0
jne 0x519089
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x519080
cmp byte [eax], bl
je 0x5190c8
mov edx, 0x5afc20
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x519094
mov eax, 0x5afc20
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5190a6
sub eax, edx
dec eax
cmp eax, ebx
jle 0x5190c8
cmp byte [eax + 0x5afc20], 0x20
jne 0x5190c8
mov byte [eax + 0x5afc20], bl
dec eax
cmp eax, ebx
jg 0x5190b4
cmp byte [0x5afc20], bl
jne 0x5190f5
push 0x98
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ecx, ecx
call fcn.0041d520
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x90
push esi
call edi
dec eax
neg eax
sbb eax, eax
push 0x97
inc eax
push esi
mov dword [0x5b01f0], eax
call edi
dec eax
neg eax
sbb eax, eax
push 0x92
inc eax
push esi
mov dword [0x59bd1c], eax
call edi
mov ecx, dword [esp + 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [0x59bd24], eax
call fcn.00518b40
cmp byte [0x5b0e00], bl
jne 0x519163
push 0x460
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ah, ah
jns 0x5191a9
push 0x53
call edi
test ah, ah
js 0x5191a9
push 9
push 0x5b0e00
call fcn.00570260
add esp, 8
test eax, eax
jne 0x51919e
call fcn.004e27f0
push eax
xor edx, edx
mov ecx, 0x5b0e00
call fcn.00520010
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebx
push ebx
push 0x147
push 0x9a
push esi
call ebp
cmp eax, 0xffffffff
jne 0x5191bf
xor eax, eax
cmp eax, ebx
mov ecx, 0x200
mov dword [0x59bd20], ecx
jle 0x519207
mov edi, edi
add ecx, ecx
dec eax
jne 0x5191d0
cmp ecx, 0x200
mov dword [0x59bd20], ecx
jge 0x5191f5
pop ebp
pop edi
pop esi
mov dword [0x59bd20], 0x200
xor eax, eax
pop ebx
pop ecx
ret
cmp ecx, 0x2000
jle 0x519207
mov dword [0x59bd20], 0x2000
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x519770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push 0x461
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
je 0x51982f
push 0x5a0bc8
push 0x3e7
push 0xd
push 0x480
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov al, byte [0x5a0bc8]
test al, al
je 0x51982f
push 0x2a
push 0x5a0bc8
call fcn.00570260
add esp, 8
test eax, eax
jne 0x51982f
push 0x3f
push 0x5a0bc8
call fcn.00570260
add esp, 8
test eax, eax
jne 0x51982f
test edi, edi
je 0x51982f
mov ecx, edi
call fcn.00518b40
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x51982f
mov al, byte [0x5b0e00]
test al, al
je 0x519826
push 9
push 0x5b0e00
call fcn.00570260
add esp, 8
test eax, eax
jne 0x519826
call fcn.004e27f0
push eax
xor edx, edx
mov ecx, 0x5b0e00
call fcn.00520010
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x51c680
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x94
push esi
mov esi, ecx
lea eax, [esi + 0x64]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x51c6a9
mov eax, 3
pop esi
add esp, 0x94
ret
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 8], eax
xor eax, eax
mov ax, word [esi + 0xc8]
push ebx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0
push eax
mov dword [esp + 0x1c], edx
mov word [esp + 0x10], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esp + 0x24]
mov word [esp + 0xe], ax
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
push 0x5ae5a0
mov edx, 0x64
lea ecx, [esp + 0x40]
call fcn.0041ee40
mov al, byte [esi + 0xca]
test al, al
mov ebx, dword [0x5ae598]
lea edi, [esi + 0xca]
je 0x51c73a
push edi
mov edx, 0x64
mov ecx, 0x5ae5a0
call fcn.0041ee40
mov dword [0x5ae598], 2
mov dx, word [0x59bcfc]
mov cx, word [0x59bcf8]
push 0
push 0
push 2
push 0
call fcn.005049f0
mov dword [esi + 0x190], eax
lea eax, [esp + 0x3c]
push eax
mov edx, 0x64
mov ecx, 0x5ae5a0
call fcn.0041ee40
mov dword [0x5ae598], ebx
mov ecx, dword [esi + 0x190]
cmp ecx, 0xffffffff
jne 0x51c78f
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x94
ret
call fcn.0054af90
mov ecx, dword [0x5b4314]
mov edx, dword [esi + 0x190]
push 0x10
push 0x8039
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x190]
cmp eax, 0xffffffff
je 0x51c801
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x51c801
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
mov edx, 0x64
mov ecx, edi
call fcn.0041ee40
mov ecx, dword [esp + 0x2e]
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
mov word [esi + 0x12e], ax
mov eax, dword [esi + 0x190]
push 0x10
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x51c835
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x51c835
pop edi
pop ebx
mov eax, 2
pop esi
add esp, 0x94
ret
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x94
ret
Function at 0x51c850
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
xor esi, esi
test eax, eax
mov dword [esp + 0x14], edx
mov ebp, 1
mov dword [esp + 0x10], 0
je 0x51c8b9
cmp byte [eax], 0x2d
jne 0x51c8b9
push 0x584de8
push eax
call fcn.005809c6
add esp, 8
test eax, eax
jne 0x51c88c
mov esi, ebp
test esi, esi
mov ebp, 2
je 0x51c8b9
mov eax, dword [edi + 8]
test eax, eax
je 0x51ca93
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x51c950
mov dword [esp + 0x10], ebp
mov ebp, 3
mov ecx, dword [edi + ebp*4]
test ecx, ecx
je 0x51ca93
mov eax, dword [edi + ebp*4 + 4]
test eax, eax
je 0x51ca93
mov eax, dword [edi + ebp*4 + 8]
test eax, eax
je 0x51ca93
call fcn.0051b1e0
test eax, eax
je 0x51c8f8
xor edx, edx
mov ecx, 0x1453
call fcn.0041d620
push eax
mov eax, dword [edi + ebp*4]
push eax
jmp 0x51c91f
mov eax, dword [edi + ebp*4]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51c900
sub eax, edx
cmp eax, 0x5a
jbe 0x51c93c
xor edx, edx
mov ecx, 0x1452
call fcn.0041d620
mov ecx, dword [edi + ebp*4]
push eax
push ecx
push str.__sockopen:__s__s
push 0x5a7240
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov edx, dword [edi + ebp*4 + 8]
push edx
call fcn.00570543
mov ebx, eax
add esp, 4
test bx, bx
ja 0x51c964
mov edx, dword [edi]
push 3
xor ecx, ecx
push ecx
call fcn.00479790
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call fcn.0051afa0
mov esi, eax
test esi, esi
jne 0x51c983
mov edx, dword [edi]
push 2
xor ecx, ecx
push ecx
call fcn.00479790
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [edi + ebp*4]
push eax
mov edx, 0x64
mov ecx, esi
call fcn.0041ee40
mov ecx, dword [edi + ebp*4 + 4]
push ecx
lea ecx, [esi + 0x64]
mov edx, 0x64
call fcn.0041ee40
push 0
mov word [esi + 0xc8], bx
mov dword [esi + 0x14c], 3
mov dword [esi + 0x150], 0
call fcn.00570bc6
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x51c9f2
mov edx, dword [edi + eax*4]
push edx
lea ecx, [esi + 0xca]
mov edx, 0x64
call fcn.0041ee40
mov ebx, dword [esp + 0x14]
mov dword [esi + 0x194], ebx
mov eax, dword [edi + ebp*4 + 4]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x51ca5d
mov dword [esi + 0x150], 4
mov ecx, dword [edi + ebp*4 + 4]
mov edx, dword [edi + ebp*4]
push 4
push 0
push ecx
mov ecx, dword [ebx]
call fcn.00470c10
test eax, eax
jne 0x51ca50
mov edx, dword [esi + 0x190]
push 0x274d0010
push edx
mov dword [esi + 0x150], eax
mov eax, dword [0x5b4314]
push 0x8039
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov ecx, esi
call fcn.0051c680
test eax, eax
jle 0x51ca86
mov ecx, dword [esi + 0x190]
mov edx, dword [0x5b4314]
push 0x274d0010
push ecx
push 0x8039
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov edx, dword [edi]
push 0
xor ecx, ecx
push ecx
call fcn.00479790
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x51cab0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [0x5b1224]
test esi, esi
mov eax, edx
je 0x51cbd2
cmp dword [esi + 0x190], ecx
je 0x51cadb
mov esi, dword [esi + 0x198]
test esi, esi
jne 0x51cac4
pop esi
add esp, 0x14
ret
shr eax, 0x10
test ax, ax
je 0x51cb28
movzx eax, ax
mov dword [esi + 0x184], eax
mov eax, dword [0x5ae60c]
test eax, eax
push edi
mov edi, dword [esi + 0x148]
je 0x51cb0c
push 3
push 0x3d
mov edx, esi
mov ecx, str.SOCKOPEN
call fcn.0051b2f0
mov edx, edi
mov ecx, esi
call fcn.0051b1b0
test eax, eax
pop edi
je 0x51cbd2
call fcn.0051b0e0
pop esi
add esp, 0x14
ret
push 0
mov dword [esi + 0x14c], 2
call fcn.00570bc6
mov edx, dword [esi + 0x190]
add esp, 4
push 0x23
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
mov ecx, dword [0x5b4314]
push 0x8038
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [esi + 0x190]
cmp eax, 0xffffffff
je 0x51cbb9
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x10], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x51cbb9
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [esi + 0xca]
mov edx, 0x64
call fcn.0041ee40
mov ecx, dword [esp + 0xa]
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
mov word [esi + 0x12e], ax
mov eax, dword [0x5ae60c]
test eax, eax
je 0x51cbd2
push 0
push 0x3d
mov edx, esi
mov ecx, str.SOCKOPEN
call fcn.0051b2f0
pop esi
add esp, 0x14
ret
Function at 0x51da10
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [0x5b1224]
test esi, esi
mov eax, edx
je 0x51dc6c
cmp dword [esi + 0x190], ecx
je 0x51da3b
mov esi, dword [esi + 0x198]
test esi, esi
jne 0x51da24
pop esi
add esp, 0x18
ret
cmp dword [esi + 0x14c], 2
jne 0x51dc6c
shr eax, 0x10
test ax, ax
push edi
je 0x51da83
movzx eax, ax
jmp 0x51db47
push 0x3f
mov ecx, str.SOCKWRITE
call fcn.0051b2f0
mov edx, edi
mov ecx, esi
call fcn.0051b1b0
test eax, eax
je 0x51dc6b
mov ecx, esi
call fcn.0051b0e0
pop edi
pop esi
add esp, 0x18
ret
mov eax, dword [esi + 0x140]
test eax, eax
je 0x51dc6b
mov edi, dword [esi + 0x144]
cmp edi, 0x2000
jle 0x51daa4
mov edi, 0x2000
mov ecx, dword [esi + 0x158]
test ecx, ecx
je 0x51db1e
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [esi + 0x160]
mov dword [esp + 0x18], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov word [esp + 0x10], 2
mov edx, dword [eax]
xor eax, eax
mov ax, word [esi + 0x164]
mov dword [esp + 0x14], edx
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esp + 8]
push 0x10
mov word [esp + 0x16], ax
mov edx, dword [ecx]
mov ecx, dword [esi + 0x140]
lea eax, [esp + 0x14]
push eax
push 0
push edi
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x190]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
jmp 0x51db2f
push 0
push edi
push eax
mov eax, dword [esi + 0x190]
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x51db7e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x51dc6b
mov edi, dword [esi + 0x148]
mov dword [esi + 0x184], eax
mov eax, dword [0x5ae60c]
test eax, eax
je 0x51da65
mov eax, dword [esi + 0x158]
test eax, eax
mov edx, esi
push 3
je 0x51da59
push 0x45
mov ecx, str.UDPWRITE
jmp 0x51da60
push 0
call fcn.00570bc6
add esp, 4
test edi, edi
mov dword [esi + 0x17c], eax
jle 0x51dc00
mov edx, dword [esi + 0x170]
mov eax, dword [esi + 0x144]
add edx, edi
cmp edi, eax
mov dword [esi + 0x170], edx
jge 0x51dc00
mov ecx, dword [esi + 0x140]
sub eax, edi
push eax
lea edx, [ecx + edi]
push edx
push ecx
mov dword [esi + 0x144], eax
call fcn.00571040
mov eax, dword [esi + 0x144]
mov ecx, dword [esi + 0x140]
add eax, 0xa
push eax
push ecx
call fcn.00571c26
add esp, 0x14
test eax, eax
je 0x51dbe6
mov dword [esi + 0x140], eax
mov edx, dword [esi + 0x190]
push 0
push 2
mov ecx, 0x8038
call fcn.0054c250
pop edi
pop esi
add esp, 0x18
ret
mov edx, dword [esi + 0x140]
push edx
call fcn.005700aa
mov eax, dword [esi + 0x158]
add esp, 4
test eax, eax
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
je 0x51dc3b
mov ecx, dword [esi + 0x15c]
test ecx, ecx
je 0x51da76
mov ecx, dword [0x5ae60c]
test ecx, ecx
je 0x51dc6b
test eax, eax
mov edx, esi
push 0
je 0x51dc5f
push 0x45
mov ecx, str.UDPWRITE
call fcn.0051b2f0
pop edi
pop esi
add esp, 0x18
ret
push 0x3f
mov ecx, str.SOCKWRITE
call fcn.0051b2f0
pop edi
pop esi
add esp, 0x18
ret
Function at 0x525630
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esi
mov esi, ecx
call fcn.00542ed0
test eax, eax
jne 0x525647
pop esi
mov eax, 1
pop ebp
ret 0x10
mov eax, dword [esp + 0x14]
sub eax, 0
push ebx
push edi
je 0x5257e6
dec eax
jne 0x52584b
mov ebx, dword [esp + 0x14]
cmp ebx, 0xd
je 0x5257d6
cmp ebx, 0xa
je 0x5257d6
movzx eax, bl
push eax
call fcn.00570da4
add esp, 4
test eax, eax
je 0x525690
push ebx
call fcn.00570d82
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x874]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x19f
push ecx
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x52584b
mov ebp, edi
inc edi
cmp edi, ebp
mov dword [esp + 0x1c], ebp
je 0x5257cd
cmp dword [esi + 0x708], 4
jne 0x525710
mov eax, dword [esi + 0x874]
lea edx, [esp + 0x20]
push edx
push edi
push 0x189
push eax
call ebx
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x525729
cmp eax, 0xffffffff
je 0x525729
cmp byte [ecx], 0x20
jne 0x5256fb
inc ecx
mov dword [esp + 0x20], ecx
cmp byte [ecx], 0x20
je 0x5256f1
mov edx, dword [esi + 0xbbc]
call fcn.004ff610
test al, al
je case.0x52574c.2
inc dword [esp + 0x20]
jmp case.0x52574c.2
mov ecx, dword [esi + 0x874]
push 0x5ac5e0
push edi
push 0x189
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x525730
xor edi, edi
jmp 0x5257ab
mov eax, dword [esi + 0x708]
dec eax
cmp eax, 8
mov ecx, 0x5ac5e0
mov dword [esp + 0x20], ecx
ja case.0x52574c.2
movzx edx, byte [eax + 0x525864]
jmp dword [edx*4 + 0x525858]
mov edx, dword [esi + 0xbbc]
mov ecx, 0x5ac5e0
call fcn.004ff650
jmp 0x525706
cmp byte [0x5ac5e0], 0x20
jne case.0x52574c.2
mov edi, edi
inc ecx
mov dword [esp + 0x20], ecx
cmp byte [ecx], 0x20
je 0x525770
mov eax, dword [esp + 0x20]
mov al, byte [eax]
test al, al
je 0x5257aa
movzx ebp, al
push ebp
call fcn.00570da4
add esp, 4
test eax, eax
je 0x5257a0
push ebp
call fcn.00570d82
add esp, 4
movzx ebp, al
cmp ebp, dword [esp + 0x14]
je 0x5257bc
mov ebp, dword [esp + 0x1c]
inc edi
cmp edi, ebp
jne 0x5256c2
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0x10
mov ecx, dword [esi]
push 1
push 1
push edi
mov edx, 0x8098
call fcn.0041e370
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0x10
mov ecx, dword [esi]
call fcn.0042f600
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0x10
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x525816
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x52584b
mov ecx, dword [esp + 0x20]
push 0xffffffffffffffff
push 0
mov edx, 1
call fcn.004779b0
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0x10
cmp eax, 9
jne 0x525830
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
js 0x52584b
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0x10
cmp eax, 0xd
je 0x52583a
cmp eax, 0xa
jne 0x52584b
mov edx, dword [esp + 0x20]
mov ecx, dword [esi]
push 3
call fcn.00478670
test eax, eax
jne 0x5257cd
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret 0x10