joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdadc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004042a8
mov eax, dword [ebp - 8]
call fcn.004042a8
xor eax, eax
push ebp
push 0x4bdbb5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ca0
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push dword [ebp - 4]
push 0x4bdbcc
push dword [ebp - 8]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.004041b4
mov eax, dword [ebp - 0x60]
call fcn.004042b8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4bdb92
push 0xbb8
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bdbbc
lea eax, [ebp - 0x60]
call fcn.00403e74
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e98
ret
Function at 0x4062a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4d13f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], 5
mov ecx, dword [ebp - 0x118]
add ecx, 0x2fd4c0
call fcn.00411270
push eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
push str.PointNum
push 0x49dca8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x406300
mov eax, 5
jmp 0x40630f
lea ecx, [ebp - 0x110]
push ecx
call fcn.0047badb
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047ac28
mov esp, ebp
pop ebp
ret
Function at 0x406470
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493bf2
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4d13f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x134], ecx
mov ecx, dword [ebp - 0x134]
add ecx, 0x98
call fcn.0040ee00
lea ecx, [ebp - 0x124]
call fcn.0040cd10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004112b0
mov byte [ebp - 4], 1
mov byte [ebp - 0x114], 0
push 0xfe
push 0
lea eax, [ebp - 0x113]
push eax
call fcn.0047ba50
add esp, 0xc
mov dword [ebp - 0x128], 0
jmp 0x40650b
mov ecx, dword [ebp - 0x128]
add ecx, 1
mov dword [ebp - 0x128], ecx
cmp dword [ebp - 0x128], 0x64
jge 0x406702
mov edx, dword [ebp - 0x128]
add edx, 1
push edx
push str.font_d
lea eax, [ebp - 0x118]
push eax
call fcn.00411460
add esp, 0xc
mov ecx, dword [ebp - 0x134]
add ecx, 0x2fd4c0
call fcn.00411270
push eax
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 0x49daf5
lea ecx, [ebp - 0x118]
call fcn.00411270
push eax
mov ecx, dword [ebp - 0x134]
add ecx, 0x2fd4b8
call fcn.00411270
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x114]
push edx
push 0x49dcb8
lea eax, [ebp - 0x118]
push eax
call fcn.00411460
add esp, 0xc
lea ecx, [ebp - 0x118]
call fcn.00403da0
test eax, eax
jne 0x4065cd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.00403d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.0040cd40
jmp 0x406723
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x134]
add edx, 0x2fd4bc
push edx
lea eax, [ebp - 0x12c]
push eax
call fcn.0040de80
add esp, 0xc
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x13c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x13c]
push edx
lea ecx, [ebp - 0x124]
call fcn.00403d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
call fcn.00403d20
mov eax, dword [ebp - 0x128]
add eax, 1
push eax
push str.font_dRtn
lea ecx, [ebp - 0x118]
push ecx
call fcn.00411460
add esp, 0xc
push 0xff
push 0
lea edx, [ebp - 0x114]
push edx
call fcn.0047ba50
add esp, 0xc
mov ecx, dword [ebp - 0x134]
add ecx, 0x2fd4c0
call fcn.00411270
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x49daf6
lea ecx, [ebp - 0x118]
call fcn.00411270
push eax
mov ecx, dword [ebp - 0x134]
add ecx, 0x2fd4b8
call fcn.00411270
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x114]
push ecx
push 0x49dcc8
lea edx, [ebp - 0x118]
push edx
call fcn.00411460
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403d40
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x130], esp
lea edx, [ebp - 0x124]
push edx
call fcn.0040cd60
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x134]
add ecx, 0x98
call fcn.0040ee20
jmp 0x4064fc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.00403d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.0040cd40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047ac28
mov esp, ebp
pop ebp
ret
Function at 0x406740
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493c2d
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x4d13f4]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x144], 0xa
mov dword [ebp - 0x148], 0xa
mov dword [ebp - 0x10], 0x14
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x14c], 5
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x14]
call fcn.004112b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040caf0
lea ecx, [ebp - 0x28]
call fcn.0040cb00
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
push ecx
push 0x49dccc
lea edx, [ebp - 0x14]
push edx
call fcn.00411460
add esp, 0xc
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x154]
add ecx, 0x2fd4c0
call fcn.00411270
push eax
push 0x104
lea ecx, [ebp - 0x13c]
push ecx
push 0
lea ecx, [ebp - 0x14]
call fcn.00411270
push eax
mov ecx, dword [ebp - 0x154]
add ecx, 0x2fd4b8
call fcn.00411270
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4068b7
lea edx, [ebp - 0x13c]
push edx
lea ecx, [ebp - 0x150]
call fcn.00403ca0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
imul ecx, ecx, 0x14
mov edx, dword [ebp + 0x10]
lea eax, [edx + ecx + 5]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 5
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040e000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x150]
call fcn.00403d20
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0x15c]
push eax
push 0x49dcd4
lea ecx, [ebp - 0x14]
push ecx
call fcn.00411460
add esp, 0xc
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x4067f7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403d20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0047ac28
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408150
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493e01
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x4d13f4]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14c], ecx
push 0x11
mov ecx, dword [ebp - 0x14c]
add ecx, 0x3029fc
call fcn.0040ced0
mov dword [ebp - 0x13c], 0x12
mov dword [ebp - 0x148], 0x50
mov dword [ebp - 0x144], 0x20
mov dword [ebp - 0x140], 0x18b
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
call fcn.004112b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040caf0
lea ecx, [ebp - 0x28]
call fcn.0040cb00
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
push ecx
push 0x49ded0
lea edx, [ebp - 0x18]
push edx
call fcn.00411460
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14c]
add ecx, 0x2fd4c0
call fcn.00411270
push eax
push 0x104
lea ecx, [ebp - 0x134]
push ecx
push 0
lea ecx, [ebp - 0x18]
call fcn.00411270
push eax
mov ecx, dword [ebp - 0x14c]
add ecx, 0x2fd4b8
call fcn.00411270
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40834a
lea edx, [ebp - 0x134]
push edx
call fcn.0047b090
add esp, 4
test eax, eax
jne 0x408274
jmp 0x40834a
lea eax, [ebp - 0x134]
push eax
push 0x49ded8
lea ecx, [ebp - 0x18]
push ecx
call fcn.00411460
add esp, 0xc
push 0x14
mov edx, dword [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x14
add ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x140]
push edx
push 0
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x54
mov ecx, dword [ebp - 0x14c]
lea ecx, [ecx + eax + 0x2fd650]
call fcn.0045362f
push 1
mov edx, dword [ebp - 0x14c]
add edx, 0x3029fc
push edx
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x54
mov ecx, dword [ebp - 0x14c]
lea ecx, [ecx + eax + 0x2fd650]
call fcn.0040e2a0
lea ecx, [ebp - 0x18]
call fcn.00411270
push eax
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x54
mov eax, dword [ebp - 0x14c]
lea ecx, [eax + edx + 0x2fd650]
call fcn.0045338a
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x154]
push eax
push 0x49dedc
lea ecx, [ebp - 0x18]
push ecx
call fcn.00411460
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x408213
mov ecx, dword [ebp - 0x14c]
call fcn.00453302
mov dword [ebp - 0x138], eax
push 6
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x14
mov ecx, dword [ebp - 0x144]
lea edx, [ecx + eax + 0x28]
push edx
push 0x1f4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14c]
call fcn.0045362f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403d20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0047ac28
mov esp, ebp
pop ebp
ret
Function at 0x408910
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493e88
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x4d13f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x10], 0
mov al, byte [0x49db2e]
mov byte [ebp - 0x114], al
push 0xfe
push 0
lea ecx, [ebp - 0x113]
push ecx
call fcn.0047ba50
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004112b0
mov dword [ebp - 4], 0
push 0xff
push 0
lea edx, [ebp - 0x114]
push edx
call fcn.0047ba50
add esp, 0xc
mov ecx, dword [ebp - 0x12c]
add ecx, 0x2fd4c0
call fcn.00411270
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x49db2f
push 0x49df40
mov ecx, dword [ebp - 0x12c]
add ecx, 0x2fd4b8
call fcn.00411270
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x114]
push ecx
push 0x49df4c
lea edx, [ebp - 0x11c]
push edx
call fcn.00411460
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.00411270
push eax
call fcn.0047badb
add esp, 4
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jne 0x408a3b
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x2fd4ac]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.00403d20
mov eax, dword [ebp - 0x120]
jmp 0x408a91
cmp dword [ebp - 0x118], 2
jne 0x408a70
mov edx, dword [ebp - 0x12c]
mov eax, dword [edx + 0x2fd4b0]
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.00403d20
mov eax, dword [ebp - 0x124]
jmp 0x408a91
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.00403d20
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047ac28
mov esp, ebp
pop ebp
ret
Function at 0x415270
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x41528e
xor eax, eax
jmp 0x4153ad
push 0
push 0
push 0
push 0x49ea00
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x30], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 8], eax
push 0xa
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
jge 0x4152fd
mov dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0
jge 0x41530a
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 8]
jle 0x415318
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0xc]
jle 0x415326
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1c], eax
push 0xcc0020
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 4
Function at 0x416860
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494805
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x4d13f4]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0x400
mov dword [ebp - 0x14], 0
push 0
push 0
push 0
push 0
push str.RookIE_1.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x416992
push 0
push 0x4000000
push 0
push 0
lea ecx, [ebp + 8]
call fcn.00411270
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x416981
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x30]
call fcn.00456a14
mov byte [ebp - 4], 2
push 0
push 0x1002
lea ecx, [ebp + 0xc]
call fcn.00411270
push eax
lea ecx, [ebp - 0x30]
call fcn.00456f89
test eax, eax
je 0x416964
cmp dword [ebp - 0x20], 0
jbe 0x416955
lea ecx, [ebp - 0x20]
push ecx
push 0x3ff
lea edx, [ebp - 0x434]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x30]
call fcn.00456672
jmp 0x416920
lea ecx, [ebp - 0x30]
call fcn.004569b2
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00456bd1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x438], edx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00403d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403d20
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.0047ac28
mov esp, ebp
pop ebp
ret 8
Function at 0x41ea70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4950f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4d13f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.004112b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push 0x104
push 0x105
lea ecx, [ebp - 0x14]
call fcn.004112f0
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00411320
mov ecx, dword [ebp + 8]
call fcn.0041f5c0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x14]
call fcn.00403da0
cmp dword [ebp - 0x18], eax
jge 0x41eb9a
mov eax, dword [ebp - 0x18]
push eax
push 0x49f824
lea ecx, [ebp - 0x14]
call fcn.0040dcb0
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x41eb17
jmp 0x41eb9a
lea ecx, [ebp - 0x1c]
call fcn.004112b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041f220
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00403d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00403d20
lea ecx, [ebp - 0x1c]
call fcn.00411270
push eax
call fcn.0047baca
add esp, 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040e070
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
lea eax, [edx + ecx + 1]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00403d20
jmp 0x41eae4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403d20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42da70
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4d13f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x20]
push eax
push 0x8004667e
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], 2
mov dx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x13c], 0
jmp 0x42db16
mov eax, dword [ebp - 0x13c]
add eax, 1
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
cmp ecx, dword [ebp - 0x130]
jae 0x42db3a
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp + edx*4 - 0x12c]
cmp eax, dword [ebp - 0x1c]
jne 0x42db38
jmp 0x42db3a
jmp 0x42db07
mov ecx, dword [ebp - 0x13c]
cmp ecx, dword [ebp - 0x130]
jne 0x42db70
cmp dword [ebp - 0x130], 0x40
jae 0x42db70
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + edx*4 - 0x12c], eax
mov ecx, dword [ebp - 0x130]
add ecx, 1
mov dword [ebp - 0x130], ecx
xor edx, edx
jne 0x42dafb
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0
lea eax, [ebp - 0x138]
push eax
push 0
lea ecx, [ebp - 0x130]
push ecx
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x42dbb2
mov dword [ebp - 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047ac28
mov esp, ebp
pop ebp
ret
Function at 0x431500
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x120], 0
jmp 0x431566
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
cmp ecx, dword [ebp - 0x108]
jae 0x431590
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp + edx*4 - 0x104]
cmp ecx, dword [eax + 4]
jne 0x43158e
jmp 0x431590
jmp 0x431557
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp - 0x108]
jne 0x4315cc
cmp dword [ebp - 0x108], 0x40
jae 0x4315cc
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 4]
mov dword [ebp + eax*4 - 0x104], edx
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
xor ecx, ecx
jne 0x43154b
lea edx, [ebp - 0x11c]
push edx
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x114], eax
xor ecx, ecx
cmp dword [ebp - 0x114], 0
setg cl
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0
je 0x43162b
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 4]
push ecx
call sub.WS2_32.dll___WSAFDIsSet
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x4316e7
mov dl, byte [0x4a062e]
mov byte [ebp - 0x121], dl
push 2
push 1
lea eax, [ebp - 0x121]
push eax
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x114], eax
xor eax, eax
cmp dword [ebp - 0x114], 0
setg al
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x4316e7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x2744
je 0x4316d1
cmp dword [ebp - 0x128], 0x2745
je 0x4316d1
cmp dword [ebp - 0x128], 0x2746
je 0x4316d1
cmp dword [ebp - 0x128], 0x2726
je 0x4316d1
cmp dword [ebp - 0x114], 0
je 0x4316d1
mov dword [ebp - 0x130], 0
jmp 0x4316db
mov dword [ebp - 0x130], 1
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x10c], ecx
xor eax, eax
cmp dword [ebp - 0x10c], 0
sete al
mov esp, ebp
pop ebp
ret