joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417edf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
push 2
push dword [ebp + 0x10]
mov ebx, dword [0x53741c]
push ebx
call sub.KERNEL32.dll_FindResourceA
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x418092
push eax
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x418092
push dword [0x537420]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
je 0x418092
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x417f46
mov esi, eax
jmp 0x417f51
mov cx, word [ebx + 0xe]
mov esi, 1
shl esi, cl
test esi, esi
jle 0x418020
cmp esi, 0x100
jg 0x418020
lea eax, [esi - 1]
shl eax, 2
add eax, 8
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418020
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x417ffd
mov edx, dword [ebp - 8]
mov word [edx + 2], si
mov ecx, dword [ebp - 8]
mov word [ecx], 0x300
lea edx, [ebx + 0x28]
xor eax, eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
lea eax, [ecx + 4]
add edx, 2
mov dword [ebp - 0x14], edx
cmp esi, dword [ebp - 0x10]
jle 0x417fe8
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx]
mov byte [eax], dl
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx - 1]
mov byte [eax + 1], dl
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx - 2]
mov byte [eax + 2], dl
mov byte [eax + 3], 0
inc dword [ebp - 0x10]
add eax, 4
add dword [ebp - 0x14], 4
cmp esi, dword [ebp - 0x10]
jg 0x417fbc
push dword [ebp - 8]
call sub.GDI32.dll_CreatePalette
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalUnlock
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalFree
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x418020
push 0
push eax
push edi
call sub.GDI32.dll_SelectPalette
mov dword [ebp - 0xc], eax
push edi
call sub.GDI32.dll_RealizePalette
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x418052
push 0xf
call sub.GDI32.dll_GetStockObject
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x418052
push 0
mov edx, dword [ebp + 0xc]
push dword [edx]
push edi
call sub.GDI32.dll_SelectPalette
mov dword [ebp - 0xc], eax
push edi
call sub.GDI32.dll_RealizePalette
movzx ecx, word [ebx]
add ecx, ebx
shl esi, 2
movzx eax, si
add ecx, eax
mov esi, ecx
push 0
push ebx
push esi
push 4
push ebx
push edi
call sub.GDI32.dll_CreateDIBitmap
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x418086
push 0
push dword [ebp - 0xc]
push edi
call sub.GDI32.dll_SelectPalette
push edi
push dword [0x537420]
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41850e
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
jne 0x418527
xor eax, eax
jmp 0x4186d6
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebp + 0xc]
jle 0x418532
mov dword [ebp + 0xc], eax
mov edx, dword [ebx + 0x10]
cmp edx, dword [ebp + 0x10]
jle 0x41853d
mov dword [ebp + 0x10], edx
cmp ebx, 0x536854
jne 0x41854b
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0xc], 1
jl 0x418590
cmp dword [ebp + 0x10], 1
jl 0x418590
lea ecx, [ebp - 0x30]
push ecx
push 0x18
push dword [ebx + 4]
call sub.GDI32.dll_GetObjectA
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0xc]
jne 0x41857f
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp + 0x10]
jne 0x41857f
mov eax, 1
jmp 0x4186d6
push dword [0x537420]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
jne 0x4185c6
mov eax, dword [ebx + 4]
test eax, eax
je 0x41859d
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [ebx + 4], edx
mov eax, dword [ebx + 8]
test eax, eax
je 0x4185af
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [ebx + 8], edx
mov byte [ebx + 0x14], 0
push 0
call fcn.00415bea
xor eax, eax
jmp 0x4186d6
push edi
call sub.GDI32.dll_CreateCompatibleDC
mov esi, eax
test esi, esi
jne 0x4185e0
push edi
push dword [0x537420]
call sub.USER32.dll_ReleaseDC
jmp 0x418590
push edi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x418603
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x537420]
call sub.USER32.dll_ReleaseDC
jmp 0x418590
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x418637
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x537420]
call sub.USER32.dll_ReleaseDC
jmp 0x418590
push dword [ebp - 0xc]
push esi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
push dword [ebx + 4]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x14], edx
push 0xcc0020
push 0
push 0
push dword [ebp - 0x10]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push esi
call sub.GDI32.dll_BitBlt
mov ecx, dword [ebx + 0xc]
add dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jl 0x41865b
mov edx, dword [ebx + 0x10]
add dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 0x10]
jl 0x418656
push dword [ebp - 4]
push esi
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x537420]
call sub.USER32.dll_ReleaseDC
push dword [ebx + 4]
call sub.GDI32.dll_DeleteObject
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418eb9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004f9c59
mov esi, eax
test esi, esi
je 0x419002
mov eax, dword [esi + 0x618]
test eax, eax
je 0x418fa1
mov ebx, eax
test ebx, ebx
je 0x418ef3
cmp dword [ebx + 0x18], 1
je 0x418ef3
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x418ee6
test ebx, ebx
je 0x418f6e
cmp dword [ebx + 0x30], 0
je 0x418f6e
mov eax, dword [ebx + 0x30]
cmp dword [eax], 0
je 0x418f6e
xor edx, edx
mov dword [ebx + 0x18], edx
mov ebx, dword [ebx + 0x30]
mov dword [ebx + 0x18], 1
push dword [ebx]
push 0
push 0xc
push dword [esi + 0x744]
call sub.USER32.dll_SendMessageA
push dword [ebx]
call fcn.005183dc
pop ecx
push eax
push dword [ebx]
call fcn.005183dc
pop ecx
push eax
push 0xb1
push 0x427
push dword [esi]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push 0x427
push dword [esi]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
jmp 0x419002
mov eax, dword [esi + 0x618]
cmp ebx, dword [eax + 0x34]
jne 0x418fa1
mov ebx, eax
test ebx, ebx
je 0x418f8b
xor eax, eax
mov dword [ebx + 0x18], eax
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x418f7f
push 0x529686
push 0
push 0xc
push dword [esi + 0x744]
call sub.USER32.dll_SendMessageA
jmp 0x419002
push 0x555aeb
push 0x3e6
push 0xd
push dword [esi + 0x744]
call sub.USER32.dll_SendMessageA
push 0x52968a
push 0x555aeb
call fcn.005186f0
add esp, 8
test eax, eax
je 0x418fd1
mov byte [eax], 0
cmp byte [0x555aeb], 0
je 0x418fe7
push 0x555aeb
push edi
call fcn.00418c6b
jmp 0x418fee
push 0
call fcn.00415bea
push 0x52968e
push 0
push 0xc
push dword [esi + 0x744]
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x419009
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004f9c59
mov ebx, eax
test ebx, ebx
je 0x419088
mov eax, dword [ebx + 0x618]
test eax, eax
je 0x419034
cmp dword [eax + 0x18], 0
jne 0x419088
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x419027
push 0x555aeb
push 0x3e6
push 0xd
push dword [ebx + 0x744]
call sub.USER32.dll_SendMessageA
push 0x529692
push 0x555aeb
call fcn.005186f0
add esp, 8
test eax, eax
je 0x419064
mov byte [eax], 0
cmp byte [0x555aeb], 0
je 0x419088
push 0x555aeb
push esi
call fcn.00418c6b
mov edx, dword [ebx + 0x618]
mov ecx, dword [edx + 0x34]
mov dword [ecx + 0x18], 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41b934
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, 0x552583
xor ebp, ebp
push ebp
push 0x529a88
lea eax, [esp + 8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x529888
push 0x3e7
push edi
push 0x529a97
lea edx, [esp + 0x10]
push edx
push 0x529a8d
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x41ba36
push 0x20
push edi
call fcn.0051833c
add esp, 8
mov esi, eax
test esi, esi
je 0x41b9a1
mov byte [esi], 0
inc esi
jmp 0x41b995
inc esi
cmp byte [esi], 0x20
je 0x41b994
cmp byte [esi], 0
jne 0x41b9a1
xor esi, esi
test esi, esi
jne 0x41b9af
mov esi, 0x529a9b
jmp 0x41b9af
mov byte [ebx], 0x20
push 0x2c
push edi
call fcn.0051833c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41b9ac
jmp 0x41b9c5
mov byte [ebx], 0x27
push 0x22
push esi
call fcn.0051833c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41b9c2
cmp byte [esi], 0
je 0x41b9f1
push esi
push edi
push 0x529a9f
push 0x55296a
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x41ba04
push edi
push 0x529aa8
push 0x55296a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebp
push 0x529aac
lea edx, [esp + 8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x529888
push 0x55296a
lea ecx, [esp + 8]
push ecx
push 0x529ab1
call fcn.00486c04
inc ebp
jmp 0x41b942
push 0x529888
push 0
push 0
push 0x529abd
call fcn.00486c04
push 0x529888
push 0
push 0
push 0
call fcn.00486c04
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41ba61
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, 0x529a88
mov ebp, 0x552583
push 0x529888
push 0x3e7
push ebp
lea eax, [edi + 0x4d]
push eax
lea edx, [edi + 0x49]
push edx
lea ecx, [edi + 0x3f]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebp], 0
je 0x41ba99
call fcn.0041b934
xor ebx, ebx
xor esi, esi
push esi
lea eax, [edi + 0x51]
push eax
lea edx, [esp + 8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x529888
push 0x3e7
push ebp
lea ecx, [edi + 0x62]
push ecx
lea eax, [esp + 0x10]
push eax
lea edx, [edi + 0x56]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebp], 0
je 0x41baf1
mov ecx, dword [0x529a0c]
inc dword [0x529a0c]
push ecx
push 0
push ebp
push ebx
call fcn.0049d9f0
test eax, eax
je 0x41baf1
mov ebx, eax
inc esi
jmp 0x41ba9d
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41c078
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, 0x55296a
push 0x20
push dword [ebp + 8]
call fcn.0051833c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41c0a7
mov byte [ebx], 0
inc ebx
jmp 0x41c0a0
inc ebx
cmp byte [ebx], 0x20
je 0x41c09f
jmp 0x41c0b1
mov ebx, 0x529b13
jmp 0x41c0b1
mov byte [esi], 0x27
push 0x22
push ebx
call fcn.0051833c
add esp, 8
mov esi, eax
test eax, eax
jne 0x41c0ae
push 2
call fcn.0043d398
test eax, eax
je 0x41c103
cmp byte [ebx], 0
je 0x41c0eb
push 0x533c8c
push ebx
push dword [ebp + 8]
push str._s___s____s
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x41c134
push 0x533c8c
push dword [ebp + 8]
push str._s____s
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x41c134
cmp byte [ebx], 0
je 0x41c11c
push ebx
push dword [ebp + 8]
push 0x529b2d
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x41c134
push dword [ebp + 8]
push 0x529b36
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x41c134
mov byte [edi + ebx - 1], 0
push edi
call fcn.005183dc
pop ecx
mov ebx, eax
dec eax
jl 0x41c147
cmp byte [edi + ebx - 1], 0x2c
je 0x41c12f
xor ebx, ebx
push ebx
push 0x529b3a
lea eax, [ebp - 0xc]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x529888
push 0x3e7
push 0x552583
push 0x529b4b
lea edx, [ebp - 0xc]
push edx
push 0x529b3f
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x552583], 0
je 0x41c19b
push edi
push 0x5437ec
call fcn.005185a0
add esp, 8
test eax, eax
je 0x41c19b
inc ebx
jmp 0x41c149
test ebx, ebx
jl 0x41c1c5
push ebx
push 0x529b4f
lea ecx, [ebp - 0xc]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x529888
push edi
lea eax, [ebp - 0xc]
push eax
push 0x529b54
call fcn.00486c04
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41d3fc
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, 0x529c20
push 0x52ffb0
push 0x32
push 0x546458
lea eax, [ebx + 0x14]
push eax
lea edx, [ebx + 0xe]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x546458], 0
je 0x41d47a
push 0
push 0x546458
call fcn.0045a9f5
push 0x52ffb0
push 0
lea ecx, [ebx + 0x26]
push ecx
lea eax, [ebx + 0x18]
push eax
call fcn.00486c04
push 0x546458
push 0x5437ec
call sub.USER32.dll_wsprintfA
add esp, 8
push 0x5437ec
call fcn.0045a7c3
push 0x52ffb0
push 0x5437ec
lea edx, [ebx + 0x3a]
push edx
lea ecx, [ebx + 0x2c]
push ecx
call fcn.00486c04
pop ebx
ret
push 0x52ffb0
push 0x32
push 0x546458
lea eax, [ebx + 0x54]
push eax
lea edx, [ebx + 0x4e]
push edx
lea ecx, [ebx + 0x40]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x546458
call fcn.0045a7eb
pop ebx
ret
Function at 0x41d514
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, 0x529c20
mov esi, 0x546354
push 0x52ffb0
push 0x104
push esi
lea eax, [ebx + 0x94]
push eax
lea edx, [ebx + 0x8e]
push edx
lea ecx, [ebx + 0x80]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x41d5a3
push 0
push esi
call fcn.0045a9f5
push 0x52ffb0
push 0
lea eax, [ebx + 0xa6]
push eax
lea edx, [ebx + 0x98]
push edx
call fcn.00486c04
push esi
push 0x5437ec
call sub.USER32.dll_wsprintfA
add esp, 8
push 0x5437ec
call fcn.0045a7c3
push 0x52ffb0
push 0x5437ec
lea ecx, [ebx + 0xba]
push ecx
lea eax, [ebx + 0xac]
push eax
call fcn.00486c04
jmp 0x41d5ce
push 0x52ffb0
push 0x104
push esi
lea edx, [ebx + 0xd6]
push edx
lea ecx, [ebx + 0xcf]
push ecx
lea eax, [ebx + 0xc1]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push esi
call fcn.0045a7eb
push esi
call fcn.004e4ff3
pop esi
pop ebx
ret

Function at 0x41d6c4
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov byte [0x546250], 0
push 0x52ffb0
push 0x104
push 0x54614c
push 0x529d36
push 0x529d32
push 0x529d24
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x54614c
push 0x52feac
push 0x529d44
push 0x543bd3
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push 0x543bd3
call fcn.00416273
test eax, eax
jne 0x41d730
mov esi, 0x529d4a
mov edi, 0x54614c
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.0041d514
call fcn.0041d3fc
pop edi
pop esi
ret
Function at 0x41e09f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
lea ebx, [ebp - 4]
push 0x180
push 0
push 0x4301
push dword [ebp + 8]
call fcn.0051e680
add esp, 0x10
mov esi, eax
mov dword [0x529c14], esi
test esi, esi
jge 0x41e0da
push 0
call fcn.00415bea
jmp 0x41e2af
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 8], eax
push 0x180
push 0x555704
push dword [0x537434]
call sub.USER32.dll_GetWindowTextA
push 0
push 0x57c
call fcn.00415c87
push eax
push 0x555704
call fcn.005186f0
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x41e156
add dword [ebx], 4
push dword [ebx]
call fcn.005183dc
pop ecx
push eax
push dword [ebx]
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
push 1
push 0x529db8
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
xor edi, edi
push ebx
push edi
push 0x189
push 0x425
push dword [0x537434]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
je 0x41e291
cmp dword [ebx], 0
je 0x41e291
mov eax, dword [ebx]
push edi
mov esi, 0x555704
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [ebx], 0x555704
jmp 0x41e1b1
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0x20
je 0x41e1af
mov edx, dword [ebx]
cmp byte [edx], 0
je 0x41e28b
push 9
push dword [ebx]
call fcn.0051833c
add esp, 8
mov esi, eax
test esi, esi
je 0x41e28b
mov byte [esi], 0
push dword [ebx]
call fcn.005183dc
pop ecx
push eax
push dword [ebx]
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
inc esi
cmp byte [esi], 0
je 0x41e276
mov dword [ebx], esi
push 9
push dword [ebx]
call fcn.0051833c
add esp, 8
mov esi, eax
test esi, esi
je 0x41e212
mov byte [esi], 0
push 1
push 0x529dbb
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
push dword [ebx]
call fcn.005183dc
pop ecx
push eax
push dword [ebx]
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
test esi, esi
je 0x41e276
inc esi
cmp byte [esi], 0
je 0x41e276
push 1
push 0x529dbe
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
push esi
call fcn.005183dc
pop ecx
push eax
push esi
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
push 1
push 0x529dc1
push dword [0x529c14]
call fcn.0051e1ec
add esp, 0xc
inc edi
jmp 0x41e158
push dword [0x529c14]
call fcn.0051b824
pop ecx
mov dword [0x529c14], 0xffffffff
push dword [ebp - 8]
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4215b4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, 0x5464c0
test ebx, ebx
jne 0x4215cc
xor eax, eax
jmp 0x421704
cmp dword [ebx + 0x51c], 3
je 0x4215e5
cmp dword [ebx + 0x530], 2
je 0x4215e5
xor eax, eax
jmp 0x421704
cmp dword [0x537b6c], 0x14
jl 0x421650
mov dword [0x537b6c], 0xa
push 2
push 0
push 0
push 0
push esi
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x42163f
mov eax, dword [esi + 4]
cmp eax, 0x41d
je 0x42163f
cmp eax, 0x12
je 0x42163f
push 3
push 0
push 0
push 0
push esi
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x42163f
mov ecx, esi
mov edx, 6
push dword [ecx + edx*4]
dec edx
jns 0x421632
call fcn.004a9c31
jmp 0x4215f8
push ebx
call fcn.0041f683
test eax, eax
jne 0x421650
xor eax, eax
jmp 0x421704
push 0
call fcn.00526bc8
pop ecx
mov dword [ebx + 0x874], eax
push 0
push 0x3b5
push 0x546d0e
push dword [ebx + 0x878]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4216d4
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4216a2
push 0x23
push 0x41d
push dword [0x537420]
push dword [ebx + 0x878]
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x421704
push ebx
push 0
push 0x527
call fcn.00415c87
push eax
call fcn.0041f7ba
cmp dword [0x534d3c], 0
je 0x4216d0
push ebx
call fcn.0041f683
test eax, eax
je 0x4216d0
push ebx
push dword [ebx]
call fcn.004fd42e
xor eax, eax
jmp 0x421704
test eax, eax
jle 0x4216fc
mov byte [eax + 0x546d0e], 0
mov dword [0x537b70], 1
push eax
push ebx
call fcn.0042150b
xor edx, edx
mov dword [0x537b70], edx
xor eax, eax
jmp 0x421704
push ebx
call fcn.0042182e
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x421a94
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x52a170
mov esi, 0x547130
push 0x52ffb0
push 0x104
push esi
lea eax, [ebx + 0x10]
push eax
lea edx, [ebx + 8]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x52ffb0
push 0x104
lea ecx, [esi + 0x104]
push ecx
lea eax, [ebx + 0x23]
push eax
lea edx, [ebx + 0x1c]
push edx
lea ecx, [ebx + 0x14]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x52ffb0
push 0x104
lea eax, [esi + 0x208]
push eax
lea edx, [ebx + 0x38]
push edx
lea ecx, [ebx + 0x2f]
push ecx
lea eax, [ebx + 0x27]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x52ffb0
push 0x104
lea edx, [esi + 0x30c]
push edx
lea ecx, [ebx + 0x4e]
push ecx
lea eax, [ebx + 0x44]
push eax
lea edx, [ebx + 0x3c]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x52ffb0
push 0x104
lea ecx, [esi + 0x410]
push ecx
lea eax, [ebx + 0x62]
push eax
lea edx, [ebx + 0x5a]
push edx
lea ecx, [ebx + 0x52]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
jne 0x421b52
push esi
mov edi, esi
lea esi, [ebx + 0x66]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp byte [esi + 0x104], 0
jne 0x421b6c
push esi
lea edi, [esi + 0x104]
lea esi, [ebx + 0x6f]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x208], 0
jne 0x421b85
push esi
lea edi, [esi + 0x208]
lea esi, [ebx + 0x7a]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
cmp byte [esi + 0x30c], 0
jne 0x421ba2
push esi
lea edi, [esi + 0x30c]
lea esi, [ebx + 0x84]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x410], 0
jne 0x421bd6
push esi
lea edi, [esi + 0x104]
add esi, 0x410
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
pop esi
pop ebx
ret

Function at 0x422b8a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x422ba4
or dword [ebx], 1
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x422bb3
or dword [ebx], 2
push 4
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x422bc2
or dword [ebx], 0x10
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x422bd1
or dword [ebx], 8
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x422be0
or dword [ebx], 4
pop ebx
pop ebp
ret 4
Function at 0x423b28
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x52a414
xor ebx, ebx
mov esi, 0x5481ec
push ebx
push edi
push 0x543bd3
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x52ffb0
push 0x3e7
push 0x5437ec
lea eax, [edi + 0xa]
push eax
push 0x543bd3
lea edx, [edi + 5]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x5437ec], 0
je 0x423b92
push 0xa
lea ecx, [ebp - 4]
push ecx
push 0x5437ec
call fcn.00522c80
add esp, 0xc
push eax
push dword [ebp + 8]
call sub.GDI32.dll_GetNearestColor
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 0x10
jl 0x423b3b
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x424751
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
call fcn.00423f74
push 0x52ffb0
push 0x3e7
push 0x5437ec
push 0x52a63c
push 0x52a638
push 0x52a62f
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x5437ec], 0
je 0x424814
xor ebp, ebp
mov esi, 0x5437ec
mov ebx, 0x547eb8
jmp 0x4247d0
push 0x2c
push esi
call fcn.0051833c
add esp, 8
mov edi, eax
test edi, edi
je 0x4247ad
mov byte [edi], 0
inc edi
push esi
call fcn.0052175c
pop ecx
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jl 0x4247c1
cmp eax, 0x10
jle 0x4247c5
xor edx, edx
mov dword [ebx], edx
inc ebp
add ebx, 0x1c
cmp ebp, 0x1e
jge 0x4247d9
mov esi, edi
test esi, esi
je 0x4247d9
cmp byte [esi], 0
jne 0x424798
cmp ebp, 0x18
jne 0x424814
mov eax, dword [0x54813c]
mov dword [0x548158], eax
mov edx, dword [0x548120]
mov dword [0x54813c], edx
mov ecx, dword [0x548104]
mov dword [0x548120], ecx
mov eax, dword [0x5480e8]
mov dword [0x548104], eax
mov dword [0x5480e8], 1
call fcn.0042436c
pop ebp
pop edi
pop esi
pop ebx
ret