joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d524
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, 0x52ca50
mov esi, 0x5437ec
push 0x52ffb0
push 0x3e7
push esi
lea eax, [ebx + 0x13]
push eax
lea edx, [ebx + 5]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x44d56b
lea ecx, [ebx + 0x17]
push ecx
push esi
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x44d56b
mov dword [0x52c964], 1
jmp 0x44d572
xor eax, eax
mov dword [0x52c964], eax
push 0x52ffb0
push 0x3c
push 0x52c914
lea edx, [ebx + 0x2d]
push edx
lea ecx, [ebx + 0x20]
push ecx
lea eax, [ebx + 0x1b]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x52ffb0
push 0x3e7
push esi
lea edx, [ebx + 0x43]
push edx
lea ecx, [ebx + 0x38]
push ecx
lea eax, [ebx + 0x33]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x44d5cd
lea edx, [ebx + 0x48]
push edx
push esi
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x44d5cd
mov dword [0x52c968], 1
jmp 0x44d5d5
xor ecx, ecx
mov dword [0x52c968], ecx
mov eax, sym.mirc32.exe_DDECallback
mov dword [0x52c910], eax
push 0
push 0x1c4020
push eax
push 0x52c90c
call sub.USER32.dll_DdeInitializeA
test eax, eax
jne 0x44d60b
cmp dword [0x52c964], 0
je 0x44d603
call fcn.0044d620
mov eax, 1
pop esi
pop ebx
ret
xor edx, edx
mov dword [0x52c90c], edx
xor ecx, ecx
mov dword [0x52c910], ecx
xor eax, eax
pop esi
pop ebx
ret
Function at 0x45963f
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x52d010
mov esi, 0x543bd3
mov edi, 0x52ffb0
mov ebp, 0x52d00c
push edi
push 0x3e7
push esi
lea eax, [ebx + 0xe]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45968b
push 0
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x45968b
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x21]
push ecx
lea eax, [ebx + 0x19]
push eax
lea edx, [ebx + 0x12]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x4596c2
push 1
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x4596c2
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x34]
push ecx
lea eax, [ebx + 0x2c]
push eax
lea edx, [ebx + 0x25]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x4596f9
push 2
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x4596f9
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x4b]
push ecx
lea eax, [ebx + 0x3f]
push eax
lea edx, [ebx + 0x38]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x459730
push 3
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x459730
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x5c]
push ecx
lea eax, [ebx + 0x56]
push eax
lea edx, [ebx + 0x4f]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x459767
push 4
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x459767
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x72]
push ecx
lea eax, [ebx + 0x67]
push eax
lea edx, [ebx + 0x60]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45979e
push 5
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x45979e
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x84]
push ecx
lea eax, [ebx + 0x7d]
push eax
lea edx, [ebx + 0x76]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x4597d8
push 6
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x4597d8
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x98]
push ecx
lea eax, [ebx + 0x8f]
push eax
lea edx, [ebx + 0x88]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x459818
push 7
push 0
push esi
call fcn.00416498
push eax
push dword [ebp]
call fcn.0049d9f0
test eax, eax
je 0x459818
mov dword [ebp], eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46568e
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov eax, dword [ebp + 8]
cmp eax, dword [0x52e2b8]
je 0x4656a7
xor eax, eax
jmp 0x4657a5
mov edx, dword [ebp + 0xc]
shr edx, 0x10
test dx, 0xffff
je 0x4656cd
push 0
push 0x9c7
call fcn.00415c87
push eax
call fcn.00465238
xor eax, eax
jmp 0x4657a5
xor edx, edx
mov dword [0x52e2b8], edx
push 0
push 2
push 0
mov cx, word [0x52c432]
push ecx
mov ax, word [0x52c430]
push eax
call fcn.004cb44e
mov ebx, eax
mov dword [0x52e2b4], ebx
cmp ebx, 0xffffffff
jne 0x465715
push 0
push 0x9c8
call fcn.00415c87
push eax
call fcn.00465238
xor eax, eax
jmp 0x4657a5
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0051825c
add esp, 0xc
mov word [ebp - 0x10], 2
push 0x4f
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x54ce64]
cmp eax, 0xffffffff
je 0x465745
mov dword [ebp - 0xc], eax
jmp 0x465754
mov eax, 0x54c960
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
push 0x10
push 0x423
push dword [0x537420]
push dword [0x52e2b4]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [0x52e2b4]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4657a3
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4657a3
push 0
push 0x9c9
call fcn.00415c87
push eax
call fcn.00465238
xor eax, eax
jmp 0x4657a5
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4657ac
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x54cd60
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x4657db
push 0
push 0x9c9
call fcn.00415c87
push eax
call fcn.00465238
xor eax, eax
jmp 0x4658da
cmp byte [0x52e1e8], 0
je 0x465832
push 0x52e24c
push 0x52e1e8
push 0
push 0x9ca
call fcn.00415c87
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [0x52a384]
push esi
push dword [0x537444]
call fcn.004c7cd0
push 0x52e1e8
push 0x52e2ea
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov byte [0x52e1e8], 0
jmp 0x465872
push 0x52e24c
push 0
push 0x9cb
call fcn.00415c87
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x52a384]
push esi
push dword [0x537444]
call fcn.004c7cd0
push 0x52e24c
push str.__s_n
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x52a380]
push dword [0x537444]
call fcn.004c7b7f
mov byte [0x54ce68], 0
xor edx, edx
mov dword [0x52e2c0], edx
push 0x21
push 0x424
push dword [0x537420]
push dword [0x52e2b4]
call sub.WSOCK32.dll_WSAAsyncSelect
push esi
call fcn.005183dc
pop ecx
mov ebx, eax
push 0
push ebx
push esi
push dword [0x52e2b4]
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x4658d8
push 0
push 0x9cc
call fcn.00415c87
push eax
call fcn.00465238
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x465b5b
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
or eax, 0xffffffff
mov dword [0x52e304], eax
mov dword [0x52e300], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x52e300], eax
cmp eax, 0xffffffff
jne 0x465b85
push 0
call fcn.00465ac4
ret
push 0x4f
push dword [0x52e300]
call fcn.004cb3a4
test eax, eax
jne 0x465b9e
push 0
call fcn.00465ac4
ret
push 5
push dword [0x52e300]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x465bb7
push 0
call fcn.00465ac4
ret
push 8
push 0x42e
push dword [0x537420]
push dword [0x52e300]
call sub.WSOCK32.dll_WSAAsyncSelect
ret
Function at 0x466067
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, 0x54d07c
mov esi, 0x52e310
mov edi, 0x52e314
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x4660a2
cmp eax, 0x20
je 0x4660a2
cmp dword [0x52e304], 0xffffffff
je 0x4660a2
cmp dword [0x52e300], 0xffffffff
jne 0x4660ae
push 2
call fcn.00465ac4
jmp 0x4661d6
cmp byte [ebx], 0
jne 0x466187
push dword [esi]
push 0x3e7
push ebx
call fcn.0051b93c
add esp, 0xc
test eax, eax
je 0x4661cf
push ebx
call fcn.00486dd7
test eax, eax
jne 0x4661cf
call fcn.00465c71
test eax, eax
je 0x4660ae
push 0xa
push ebx
call fcn.0051833c
add esp, 8
test eax, eax
jne 0x466102
lea eax, [edi + 0x41]
push eax
push ebx
call fcn.00518300
add esp, 8
lea ecx, [edi + 0x44]
push ecx
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x466187
push dword [esi]
call fcn.0051c2b4
pop ecx
mov dword [0x54cf70], eax
mov dword [0x54cf74], 1
jmp 0x466151
push ebx
call fcn.00486dd7
test eax, eax
jne 0x466165
lea eax, [edi + 0x47]
push eax
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
je 0x466151
xor edx, edx
mov dword [0x54cf74], edx
jmp 0x466165
push dword [esi]
push 0x3e7
push ebx
call fcn.0051b93c
add esp, 0xc
test eax, eax
jne 0x46612c
push 0
push dword [0x54cf70]
push dword [esi]
call fcn.0051c250
add esp, 0xc
cmp dword [0x54cf74], 0
jne 0x4661cf
mov byte [ebx], 0xa
mov byte [ebx + 1], 0
push 0
push ebx
call fcn.005183dc
pop ecx
push eax
push ebx
push dword [0x52e304]
call sub.WSOCK32.dll_send
test eax, eax
jge 0x4661c7
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4661cf
push 0x22
push 0x430
push dword [0x537420]
push dword [0x52e304]
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x4661d6
mov byte [ebx], 0
jmp 0x4660ae
push 2
call fcn.00465ac4
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4661e0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x52e374
mov esi, 0x5437ec
mov edi, 0x52ffb0
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x10]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0x79
jne 0x466218
mov dword [0x52e370], 1
jmp 0x466220
xor ecx, ecx
mov dword [0x52e370], ecx
push edi
push 0x64
push 0x54d570
lea eax, [ebx + 0x25]
push eax
lea edx, [ebx + 0x1b]
push edx
lea ecx, [ebx + 0x14]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x54d570
call fcn.004e50a7
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x36]
push eax
lea edx, [ebx + 0x30]
push edx
lea ecx, [ebx + 0x29]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x46626f
push esi
call fcn.0052175c
pop ecx
mov word [0x52e364], ax
jmp 0x466278
mov word [0x52e364], 0x438
cmp word [0x52e364], 0
ja 0x46628b
mov word [0x52e364], 0x438
push edi
push 0x64
push 0x54d5d4
lea eax, [ebx + 0x49]
push eax
lea edx, [ebx + 0x41]
push edx
lea ecx, [ebx + 0x3a]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x54d5d4
call fcn.004e50a7
push edi
push 0x64
push 0x54d638
lea eax, [ebx + 0x5e]
push eax
lea edx, [ebx + 0x54]
push edx
lea ecx, [ebx + 0x4d]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x54d638], 0
je 0x466311
push edi
push 0
lea eax, [ebx + 0x69]
push eax
lea edx, [ebx + 0x62]
push edx
call fcn.00486c04
push 0x54d638
push 0x55219c
call sub.USER32.dll_wsprintfA
add esp, 8
push 0x55219c
call fcn.0045a7c3
push edi
push 0x55219c
lea ecx, [ebx + 0x7a]
push ecx
lea eax, [ebx + 0x73]
push eax
call fcn.00486c04
jmp 0x46633d
push edi
push 0x64
push 0x54d638
lea edx, [ebx + 0x8d]
push edx
lea ecx, [ebx + 0x87]
push ecx
lea eax, [ebx + 0x80]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x54d638
call fcn.0045a7eb
push edi
push 0x3e7
push esi
lea edx, [ebx + 0xa0]
push edx
lea ecx, [ebx + 0x98]
push ecx
lea eax, [ebx + 0x91]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [ebx + 0xa4]
push edx
push esi
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x46637e
mov dword [0x52e368], 1
jmp 0x4663a5
lea ecx, [ebx + 0xa7]
push ecx
push esi
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x46639e
mov dword [0x52e368], 2
jmp 0x4663a5
xor eax, eax
mov dword [0x52e368], eax
push edi
push 0x3e7
push esi
lea edx, [ebx + 0xbb]
push edx
lea ecx, [ebx + 0xb5]
push ecx
lea eax, [ebx + 0xae]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0x79
jne 0x4663d7
mov dword [0x52e36c], 1
jmp 0x4663df
xor edx, edx
mov dword [0x52e36c], edx
pop edi
pop esi
pop ebx
ret
Function at 0x466beb
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x466c20
mov ebx, dword [0x52e360]
jmp 0x466c0b
mov ebx, dword [ebx + 0x80]
test ebx, ebx
je 0x466c15
cmp dword [ebx + 0x6c], 0
jne 0x466c05
test ebx, ebx
jne 0x466c20
xor eax, eax
jmp 0x466d02
cmp byte [esi], 0
je 0x466c30
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x466c42
push 1
push dword [ebx + 0x70]
push ebx
call fcn.0046672c
xor eax, eax
jmp 0x466d02
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x74], 0xb4
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0051825c
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [0x52e364]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0
push 2
push 0
mov ax, word [0x52c432]
push eax
mov dx, word [0x52c430]
push edx
call fcn.004cb44e
mov esi, eax
mov dword [ebx + 0x7c], esi
cmp esi, 0xffffffff
jne 0x466cb3
push 2
push dword [ebx + 0x70]
push ebx
call fcn.0046672c
xor eax, eax
jmp 0x466d02
push dword [ebx + 0x7c]
call fcn.004fe692
push 0x10
push 0x431
push dword [0x537420]
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x466cfd
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x466cfd
push 3
push dword [ebx + 0x70]
push ebx
call fcn.0046672c
xor eax, eax
jmp 0x466d02
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46884d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub eax, 6
je 0x46890b
sub eax, 0x12
je 0x468875
sub eax, 0xf9
je 0x46891d
jmp 0x468942
cmp dword [0x52e5e8], 1
jne 0x468891
push 0x52e7fe
push 0
push 0xc
push 0x65
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4688cd
cmp dword [0x52e5e8], 2
jne 0x4688ad
push str.query_chat_font
push 0
push 0xc
push 0x65
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4688cd
push 0
push 0x66
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x65
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
cmp dword [0x52e5e8], 0
jl 0x4688de
xor edx, edx
mov dword [0x52e5e8], edx
cmp dword [0x52e5e8], 0
jge 0x4688f1
push 0x1e
push ebx
call fcn.00419950
jmp 0x4688f9
push 7
push ebx
call fcn.00419950
test ebx, ebx
jne 0x468942
cmp dword [ebp + 0x10], 0
jne 0x468942
cmp dword [ebp + 0x14], 0
jne 0x468942
jmp 0x468942
cmp dword [ebp + 0x10], 0
je 0x468942
mov dword [0x531ef8], 0x3d4
jmp 0x468942
mov cx, word [ebp + 0x10]
dec cx
jne 0x46893e
push 0x66
push ebx
call sub.USER32.dll_IsDlgButtonChecked
test eax, eax
je 0x468942
mov dword [0x52e5e8], 1
jmp 0x468942
xor eax, eax
jmp 0x468944
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x4692b4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x54deda
mov edi, 0x52e844
mov dword [0x52cc88], ebx
push 0x44fc6b
push 0xfa
push dword [0x537420]
call fcn.0044ea80
xor edx, edx
mov dword [0x52cc88], edx
test eax, eax
jg 0x469334
cmp dword [ebx + 0x438], 0
je 0x469325
imul eax, dword [0x533af8], 0x64
add eax, 0x533a30
push eax
push edi
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.005183dc
pop ecx
push eax
push esi
push dword [ebx + 0x454]
call sub.WSOCK32.dll_send
push 0
push ebx
call fcn.004690ea
xor eax, eax
jmp 0x469450
cmp eax, 2
jne 0x469450
cmp dword [ebx + 0x438], 0
je 0x469392
imul edx, dword [0x533af8], 0x64
add edx, 0x533a30
push edx
lea ecx, [edi + 9]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.005183dc
pop ecx
push eax
push esi
push dword [ebx + 0x454]
call sub.WSOCK32.dll_send
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x12]
push ecx
push 0x54a708
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x4693ab
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x1e]
push ecx
push 0x54a708
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 2
push 0x54a708
call fcn.004a19c4
push esi
push edi
lea eax, [edi + 0x25]
mov edi, esi
mov esi, eax
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
push 1
push 0x1e
push esi
push 0x54a708
push 1
push dword [0x537430]
call fcn.004867ae
push 0
push ebx
call fcn.004690ea
mov ebx, dword [0x52e838]
test ebx, ebx
je 0x46944e
cmp dword [ebx + 0x438], 0
je 0x469410
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x2c]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x469425
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x38]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
push esi
push 0x54a708
call fcn.004f7684
test eax, eax
je 0x469444
push 0
push ebx
call fcn.004690ea
mov ebx, dword [0x52e838]
jmp 0x4693ec
mov ebx, dword [ebx + 0x458]
test ebx, ebx
jne 0x4693f0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x469e83
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x404], 2
push 0
call fcn.00526bc8
pop ecx
mov dword [ebx + 0x450], eax
cmp dword [ebx + 0x408], 0
je 0x469fa2
cmp word [ebx + 0x410], 0
jne 0x469fa2
cmp dword [0x52e370], 0
je 0x469f0e
cmp dword [0x52e36c], 0
je 0x469f0e
push 0
push 0xb5c
call fcn.00415c87
push eax
push 1
push 1
push 1
push 1
push ebx
call fcn.004f0350
push dword [ebx + 0x408]
push 1
push 0
add ebx, 0xcc
push ebx
call fcn.00466a52
mov eax, 1
jmp 0x46a0d7
push 1
push 0
lea edx, [ebx + 0x410]
push edx
mov cx, word [0x52c432]
push ecx
mov ax, word [0x52c430]
push eax
call fcn.004cb44e
mov esi, eax
mov dword [ebx + 0x454], esi
cmp esi, 0xffffffff
jne 0x469f56
push 1
push ebx
push 0
push 0xb5d
call fcn.00415c87
push eax
call fcn.00469c75
xor eax, eax
jmp 0x46a0d7
push 8
push 0x411
push dword [0x537420]
push dword [ebx + 0x454]
call sub.WSOCK32.dll_WSAAsyncSelect
push dword [ebx + 0x408]
push dword [ebx + 0x420]
mov dx, word [ebx + 0x410]
push edx
push dword [0x533ee8]
lea ecx, [ebx + 0x234]
push ecx
add ebx, 4
push ebx
call fcn.004dc6cc
mov eax, 1
jmp 0x46a0d7
lea edx, [ebx + 0xcc]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x469fd2
push 1
push ebx
push 0
push 0xb5e
call fcn.00415c87
push eax
call fcn.00469c75
xor eax, eax
jmp 0x46a0d7
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0051825c
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x28]
push eax
call fcn.005181ec
add esp, 0xc
mov dx, word [ebx + 0x410]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
push 0
push 2
push 0
mov cx, word [0x52c432]
push ecx
mov ax, word [0x52c430]
push eax
call fcn.004cb44e
mov esi, eax
mov dword [ebx + 0x454], esi
cmp esi, 0xffffffff
jne 0x46a078
push 1
push ebx
push 0
push 0xb5d
call fcn.00415c87
push eax
call fcn.00469c75
xor eax, eax
jmp 0x46a0d7
push dword [ebx + 0x454]
call fcn.004fe692
push 0x10
push 0x40f
push dword [0x537420]
push dword [ebx + 0x454]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x2c]
push edx
push dword [ebx + 0x454]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x46a0d5
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x46a0d5
push 1
push ebx
push 0
push 0xb5f
call fcn.00415c87
push eax
call fcn.00469c75
xor eax, eax
jmp 0x46a0d7
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46a64f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x46a663
xor eax, eax
jmp 0x46a795
push 0
call fcn.00526bc8
pop ecx
mov dword [ebx + 0x450], eax
push 0
push 0x2000
push 0x54deda
push dword [ebx + 0x454]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp dword [ebx + 0x404], 4
je 0x46a69a
xor eax, eax
jmp 0x46a795
cmp esi, 0xffffffff
jne 0x46a6ce
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x46a6b2
xor eax, eax
jmp 0x46a795
push 1
push ebx
push 0
push 0xb67
call fcn.00415c87
push eax
call fcn.00469c75
xor eax, eax
jmp 0x46a795
test esi, esi
jg 0x46a6df
push ebx
call fcn.0046aa13
xor eax, eax
jmp 0x46a795
mov byte [esi + 0x54deda], 0
mov edi, esi
add dword [ebx + 0x414], edi
cmp dword [ebx + 0x424], 0
jbe 0x46a709
push 2
push 0
push dword [ebx + 0x400]
call fcn.0051c638
add esp, 0xc
push edi
push 0x54deda
push dword [ebx + 0x400]
call fcn.0051e1ec
add esp, 0xc
cmp esi, eax
je 0x46a73a
push 1
push ebx
push 0
push 0xb65
call fcn.00415c87
push eax
call fcn.00469c75
xor eax, eax
jmp 0x46a795
push dword [ebx + 0x414]
call sub.WSOCK32.dll_htonl
mov dword [ebx + 0x418], eax
push ebx
call fcn.0046a88f
push ebx
call fcn.0046a79c
test eax, eax
jne 0x46a75f
xor eax, eax
jmp 0x46a795
push ebx
call fcn.004691e4
test eax, eax
jne 0x46a76d
xor eax, eax
jmp 0x46a795
mov eax, dword [ebx + 0x420]
test eax, eax
jbe 0x46a671
cmp eax, dword [ebx + 0x414]
ja 0x46a671
mov dword [ebx + 0x414], eax
push ebx
call fcn.0046aa13
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x46b29a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, 0x55001c
jmp 0x46b2b0
mov byte [eax], dl
inc ebx
inc eax
inc esi
mov dl, byte [ebx]
test dl, dl
jne 0x46b2ab
mov byte [eax], 0
mov ebx, 0x55001c
test esi, esi
ja 0x46b2c6
xor eax, eax
jmp 0x46b2e2
push esi
push ebx
call sub.USER32.dll_CharLowerBuffA
xor eax, eax
jmp 0x46b2dc
and edx, 0xff
xor eax, edx
add eax, eax
inc ebx
mov dl, byte [ebx]
test dl, dl
jne 0x46b2d1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x46d879
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x52ea28
mov esi, 0x55296a
mov edi, 0x5437ec
mov ebp, 0x550448
push 0x52ffb0
push 0x3e7
push esi
lea eax, [ebx + 0x1b]
push eax
lea edx, [ebx + 0x10]
push edx
lea ecx, [ebx + 0xa]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x46d94e
push dword [0x52ea14]
push dword [0x52ea1c]
mov eax, dword [0x52a38c]
inc eax
push eax
lea edx, [ebx + 0x1f]
push edx
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
cmp dword [0x52ea18], 1
jne 0x46d8ee
lea ecx, [ebx + 0x2d]
push ecx
push edi
call fcn.00518300
add esp, 8
jmp 0x46d910
cmp dword [0x52ea18], 2
jne 0x46d910
push 0
push 5
call fcn.004595a0
push eax
call fcn.00416431
push eax
push edi
call fcn.00518300
add esp, 8
lea eax, [ebx + 0x33]
push eax
push edi
call fcn.00518300
add esp, 8
push esi
push edi
call fcn.00518300
add esp, 8
push 0x52ffb0
push edi
lea edx, [ebx + 0x42]
push edx
lea ecx, [ebx + 0x37]
push ecx
call fcn.00486c04
push 0x52ffb0
push 0
lea eax, [ebx + 0x4c]
push eax
lea edx, [ebx + 0x46]
push edx
call fcn.00486c04
xor ecx, ecx
mov dword [ebp], ecx
push dword [ebp]
lea eax, [ebx + 0x57]
push eax
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
inc dword [ebp]
push 0x52ffb0
push 0x3e7
push esi
lea edx, [ebx + 0x67]
push edx
push edi
lea ecx, [ebx + 0x5c]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x46d98c
push esi
call fcn.0046d498
jmp 0x46d953
pop ebp
pop edi
pop esi
pop ebx
ret