joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bc3a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x103b1054], 1
jne 0x1003bc8c
cmp dword [0x33d4acc], 0x780
jg 0x1003bc8c
push 0x19
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x103b105c
call sub.mfc100.dll_Ordinal_6969
lea eax, [ebp - 0x20]
push eax
call fcn.10006d70
pop ecx
test al, al
jne 0x1003bc8c
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.10005f7d
pop ecx
pop ecx
cmp dword [0x103a99d0], 1
jne 0x1003bd3f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x102e2854]
cmp eax, 0xbb8
jb 0x1003bd3e
call esi
sub eax, dword [0x103428b0]
cmp eax, 0x7d0
jb 0x1003bd3e
mov eax, dword [0x103a83a4]
cmp eax, 1
jne 0x1003bcdd
cmp dword [0x101123b0], 2
je 0x1003bce1
cmp dword [0x10342a50], edi
jmp 0x1003bcdf
cmp eax, edi
jne 0x1003bd3e
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2984], edi
jne 0x1003bd3e
mov eax, dword [0x103a9b14]
sub eax, edi
je 0x1003bd31
dec eax
je 0x1003bd1b
dec eax
je 0x1003bd13
dec eax
je 0x1003bd0b
dec eax
jne 0x1003bd3e
push edi
push 0xf468e
jmp 0x1003bd37
push edi
push 0xf468d
jmp 0x1003bd37
push edi
push 0x92c0f
jmp 0x1003bd37
push edi
push 0x92c0e
call fcn.100396f3
pop ecx
pop ecx
call esi
mov dword [0x102e2854], eax
jmp 0x1003bd3e
push edi
push 0x92c0d
call fcn.100396f3
pop ecx
pop ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10083a34
leave
ret
Function at 0x1003beb4
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
inc ebx
cmp dword [0x103ad878], ebx
jne 0x1003bee8
mov eax, dword [0x103429f0]
cmp eax, dword [0x103ad884]
jl 0x1003bee8
push 0x10098958
call fcn.10006dd0
and dword [0x101127cc], 0
pop ecx
jmp 0x1003bfdb
cmp dword [0x103ad87c], ebx
jne 0x1003bf0f
mov eax, dword [0x103ad888]
cdq
cmp dword [0x1034288c], edx
jl 0x1003bf0f
jg 0x1003bf08
cmp dword [0x10342888], eax
jb 0x1003bf0f
push 0x10098934
jmp 0x1003bed6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, 0x10098928
cmp dword [0x103ad874], ebx
jne 0x1003bf6a
mov eax, dword [0x11f6b60]
cmp dword [eax + 0x30], 0xffffffff
je 0x1003bf37
cmp byte [0x10342a8c], bl
jne 0x1003bf47
push edi
call fcn.10006dd0
pop ecx
push ebx
push dword [0x100f3d44]
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x103428a4]
cmp eax, 0x1d4c0
jb 0x1003bf6a
push edi
call fcn.10006dd0
pop ecx
push ebx
push dword [0x100f3d44]
call esi
cmp dword [0x103ad870], ebx
jne 0x1003bfd9
cmp byte [0x10342a79], bl
jne 0x1003bf8e
mov byte [0x10342a79], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10112864], eax
jmp 0x1003bfd9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10112864]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x3c
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
test eax, eax
jns 0x1003bfba
fadd dword [0x10098924]
fild dword [0x103ad880]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1003bfd9
push edi
call fcn.10006dd0
pop ecx
push ebx
push dword [0x100f3d44]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003e211
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10342a92], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
jne 0x1003e40c
push eax
push 0xbb8
push esi
push 0x1008aec4
push str.qhlb
mov byte [0x10110c38], 0
push str.config
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x10098b98
push esi
mov esi, dword [sym.imp.MSVCR100.dll_strtok]
call esi
pop ecx
pop ecx
mov dword [ebp - 0x390], eax
test eax, eax
je 0x1003e40c
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
push edi
push dword [ebp - 0x390]
call sub.MSVCR100.dll_strlen
and dword [ebp - 0x38c], 0
mov dword [esp], 0x10093a3c
push dword [ebp - 0x390]
lea edi, [eax + 1]
call esi
pop ecx
pop ecx
test eax, eax
je 0x1003e3ec
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x394], ecx
push eax
push dword [ebp - 0x394]
call sub.MSVCR100.dll_strcpy
inc dword [ebp - 0x38c]
add dword [ebp - 0x394], 0x64
push 0x10093a3c
push 0
call esi
add esp, 0x10
test eax, eax
jne 0x1003e2be
cmp dword [ebp - 0x38c], 8
je 0x1003e2fd
cmp dword [ebp - 0x38c], 9
jne 0x1003e3ec
lea eax, [ebp - 0x388]
push eax
movzx eax, byte [0x10110c38]
lea eax, [eax*4 + 0x10110468]
push eax
call sub.MSVCR100.dll_strcpy
lea eax, [ebp - 0x324]
push eax
call ebx
movzx ecx, byte [0x10110c38]
mov byte [ecx + 0x10110be8], al
lea eax, [ebp - 0x2c0]
push eax
call ebx
movzx ecx, byte [0x10110c38]
mov byte [ecx + 0x10110530], al
lea eax, [ebp - 0x25c]
push eax
call ebx
movzx ecx, byte [0x10110c38]
mov byte [ecx + 0x10110508], al
lea eax, [ebp - 0x1f8]
push eax
call ebx
movzx ecx, byte [0x10110c38]
mov byte [ecx + 0x10110580], al
lea eax, [ebp - 0x194]
push eax
call ebx
movzx ecx, byte [0x10110c38]
mov byte [ecx + 0x10110558], al
lea eax, [ebp - 0x130]
push eax
movzx eax, byte [0x10110c38]
imul eax, eax, 0x14
add eax, 0x101105a8
push eax
call sub.MSVCR100.dll_strcpy
lea eax, [ebp - 0xcc]
push eax
call ebx
movzx ecx, byte [0x10110c38]
add esp, 0x28
cmp dword [ebp - 0x38c], 9
mov byte [ecx + 0x10110c10], al
jne 0x1003e3ca
lea eax, [ebp - 0x68]
push eax
jmp 0x1003e3cf
push 0x10098c40
movzx eax, byte [0x10110c38]
imul eax, eax, 0x14
add eax, 0x101108c8
push eax
call sub.MSVCR100.dll_strcpy
inc byte [0x10110c38]
pop ecx
pop ecx
add edi, dword [ebp - 0x390]
push 0x10098b98
push edi
call esi
pop ecx
pop ecx
mov dword [ebp - 0x390], eax
test eax, eax
jne 0x1003e284
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10083a34
leave
ret
Function at 0x1003e419
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [ebp - 0x6c], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ecx, 0x103bb484
call fcn.10001032
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xbb8
push ebx
push 0x1008aec4
push str.ZYWP
mov edi, str.config
push edi
mov byte [ebx], 0
call esi
push 0x10098b98
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_strtok]
jmp 0x1003e491
push eax
mov ecx, 0x103bb484
call fcn.1000110a
push 0x10098b98
push 0
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x1003e47f
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0x64
push eax
mov ebx, 0x1008b74c
push ebx
push str.D38CHECK1
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103b4a38], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D38CHECK3
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103b4a3c], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D38EDIT2
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103b4a34], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D38EDIT3
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll__atoi64]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x103b4a40], eax
mov dword [0x103b4a44], edx
pop ebx
call fcn.10083a34
leave
ret
Function at 0x1003e7ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [ebp - 0x6c], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
lea eax, [ebp - 0x68]
push eax
mov ebx, 0x1008b74c
push ebx
push str.D7CHECK1
mov edi, str.config
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acd8c], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7CHECK2
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acd90], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7CHECK3
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acd94], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7CHECK4
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acda0], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7CHECK5
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acdac], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7CHECK6
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acf5c], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7EDIT1
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acd98], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7EDIT2
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acd9c], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7EDIT3
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acda4], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7EDIT4
push edi
call esi
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x103acdb0
call sub.mfc100.dll_Ordinal_12868
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0x64
push eax
push ebx
push str.D7COMBO1
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103acda8], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push ebx
push str.D7COMBO2
push edi
call esi
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x103acf60
call sub.mfc100.dll_Ordinal_12868
push 0
mov ecx, 0x103accf8
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083a34
leave
ret
Function at 0x1003e9df
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [ebp - 0x6c], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D13CHECK1
mov ebx, str.config
push ebx
call esi
mov edi, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0x68]
push eax
call edi
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103b1180], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D13CHECK3
push ebx
call esi
lea eax, [ebp - 0x68]
push eax
call edi
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103b1054], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D13CHECK4
push ebx
call esi
lea eax, [ebp - 0x68]
push eax
call edi
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103b1058], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D13COMBO3
push ebx
call esi
lea eax, [ebp - 0x68]
push eax
call edi
pop ecx
push 0
mov ecx, 0x103b0fc0
mov dword [0x103b117c], eax
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083a34
leave
ret
Function at 0x10045bf2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x26c]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10045c31
or eax, 0xffffffff
jmp 0x10045d39
cmp byte [ebp - 0x26c], 1
jne 0x10045d30
mov eax, dword [ebp - 0x26c]
shr eax, 8
cmp al, 1
jne 0x10045d30
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x10045c29
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 2
mov dword [ebp - 0xd8], eax
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0xdc], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xda], ax
push 0x10
lea eax, [ebp - 0xdc]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
or esi, 0xffffffff
cmp eax, esi
jne 0x10045caf
mov eax, esi
jmp 0x10045d39
push 0
push dword [ebp - 0x270]
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push dword [ebp - 0x270]
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
je 0x10045ca8
xor eax, eax
inc eax
cmp dword [ebp + 0x14], eax
je 0x10045d39
mov esi, 0xc8
push esi
lea eax, [ebp - 0xcc]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push esi
lea eax, [ebp - 0xcc]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
lea eax, [ebp - 0xcc]
push 0x1008b754
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10045d1e
push 1
call fcn.10045b28
pop ecx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
inc eax
jmp 0x10045d39
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0xfffffffffffffffe
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10083a34
leave
ret
Function at 0x10045df8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d275c]
cmp eax, 0x64
ja 0x10045e26
mov al, 1
jmp 0x10046001
push ebx
push edi
call esi
mov dword [0x103d275c], eax
push 0x46
xor eax, eax
pop ecx
mov edi, 0x103be388
rep stosd dword es:[edi], eax
mov eax, dword [0x35f42a8]
xor ebx, ebx
mov byte [ebp - 0x25d], bl
mov dword [ebp - 0x268], ebx
lea edi, [eax + 0x53c]
mov dword [ebp - 0x264], ebx
mov eax, dword [ebp - 0x268]
cmp dword [eax*4 + 0x10112378], 1
jne 0x10045fd8
cmp byte [ebp + 8], 1
jne 0x10045f12
mov esi, dword [edi]
push 0xc8
lea eax, [ebp - 0x25c]
push ebx
push eax
call sub.MSVCR100.dll_memset
push 0x64
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
cmp esi, ebx
je 0x10045ec6
lea eax, [ebp - 0x68]
push eax
push esi
call fcn.1000be06
lea eax, [ebp - 0x68]
push eax
add esi, 0x64
push esi
lea eax, [ebp - 0x25c]
push 0x1008d81c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov esi, dword [ebp - 0x264]
lea esi, [esi + 0x101112f0]
lea eax, [ebp - 0x25c]
push esi
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x10045fd8
push esi
call fcn.10045d47
mov esi, eax
pop ecx
cmp esi, ebx
jl 0x10045fd8
mov eax, dword [ebp - 0x264]
lea eax, [eax + 0x10110d78]
push eax
lea eax, [ebp - 0x25c]
jmp 0x10045fb1
cmp byte [ebp + 8], bl
jne 0x10045fd8
mov esi, dword [edi]
push 0xc8
lea eax, [ebp - 0x194]
push ebx
push eax
call sub.MSVCR100.dll_memset
push 0x64
lea eax, [ebp - 0xcc]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
cmp esi, ebx
je 0x10045f72
lea eax, [ebp - 0xcc]
push eax
push esi
call fcn.1000be06
lea eax, [ebp - 0xcc]
push eax
add esi, 0x64
push esi
lea eax, [ebp - 0x194]
push 0x1008d81c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov esi, dword [ebp - 0x264]
lea esi, [esi + 0x10110d78]
lea eax, [ebp - 0x194]
push esi
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x10045fd8
push esi
call fcn.10045d47
mov esi, eax
pop ecx
cmp esi, ebx
jl 0x10045fd8
mov eax, dword [ebp - 0x264]
lea eax, [eax + 0x101112f0]
push eax
lea eax, [ebp - 0x194]
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10045fd8
push 1
push 1
push ebx
push dword [ebp - 0x268]
push esi
call fcn.10039630
mov byte [ebp - 0x25d], 1
add esp, 0x14
inc dword [ebp - 0x268]
add dword [ebp - 0x264], 0x64
add edi, 4
cmp dword [ebp - 0x268], 0xe
jl 0x10045e5a
cmp byte [ebp - 0x25d], 1
pop edi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10083a34
leave
ret
Function at 0x1004600e
Capabilities:
Act as tcp client
Check for time delay via gettickcount
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1b4], eax
lea eax, [ebp - 0x1b0]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10046054
or eax, 0xffffffff
jmp 0x10046154
cmp byte [ebp - 0x1b0], 1
jne 0x1004614b
mov eax, dword [ebp - 0x1b0]
shr eax, 8
cmp al, 1
jne 0x1004614b
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x10046087
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1004604c
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 2
mov dword [ebp - 0x1c], eax
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
push 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
or esi, 0xffffffff
cmp eax, esi
jne 0x100460d8
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
jmp 0x10046154
lea eax, [edi + 4]
push 0
push eax
call sub.MSVCR100.dll_strlen
pop ecx
add eax, 4
push eax
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
je 0x100460c7
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1b4]
cmp eax, 0x3a980
jb 0x10046115
push 0x14
pop esi
jmp 0x100460c7
push 0
push 0xa
pop esi
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
lea eax, [ebp - 0x10]
push 0x1008b754
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x100460c7
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x14
jmp 0x10046153
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0xfffffffffffffffe
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083a34
leave
ret
Function at 0x10051846
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [ebp - 0x6c], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b754
push str.D5CHECK1
mov edi, str.config
push edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abed8], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5CHECK2
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abba8], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5CHECK3
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abbac], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5CHECK4
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abed4], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5RADI01
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
mov dword [0x103abba4], eax
mov ebx, 0xbb8
push ebx
push 0
push dword [ebp - 0x70]
call sub.MSVCR100.dll_memset
add esp, 0x10
push dword [ebp - 0x6c]
push ebx
push dword [ebp - 0x70]
push 0x1008aec4
push str.D5LIST1
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x184
push dword [0x103abc7c]
call esi
mov edi, dword [sym.imp.MSVCR100.dll_strtok]
mov ebx, 0x10093a3c
push ebx
push dword [ebp - 0x70]
jmp 0x1005198f
push eax
push 0
push 0x180
push dword [0x103abc7c]
call esi
push ebx
push 0
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1005197c
push dword [0x103abb30]
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x100519b4
push 0
mov ecx, 0x103abb10
call sub.mfc100.dll_Ordinal_13219
mov esi, 0x103b1930
mov ecx, esi
call fcn.10013609
mov ecx, esi
call fcn.10013285
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083a34
leave
ret
Function at 0x100547c6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push str..ini
push esi
call dword [sym.imp.MSVCR100.dll_strstr]
test eax, eax
setne al
push 0x64
mov byte [0x10342a92], al
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
push 0x14c08
call sub.mfc100.dll_Ordinal_265
mov edi, eax
push edi
push esi
call fcn.1004ea3a
push edi
push esi
call fcn.1004f569
push edi
push esi
call fcn.10050874
push edi
push esi
call fcn.10050ec5
push edi
push esi
call fcn.10051846
add esp, 0x40
push edi
push esi
call fcn.10051cdc
push edi
push esi
call fcn.1003e7ac
push edi
push esi
call fcn.10052948
push edi
push esi
call fcn.10052dc2
push edi
push esi
call fcn.10053284
push edi
push esi
call fcn.1003e53b
push edi
push esi
call fcn.100519d6
push edi
push esi
call fcn.1003e419
add esp, 0x40
push edi
push esi
call fcn.1003e211
push edi
push esi
call fcn.10051f98
push edi
push esi
call fcn.10053655
push edi
push esi
call fcn.1003e9df
push edi
push esi
call fcn.10053a9b
add esp, 0x28
push esi
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D12CHECK1
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
push edi
mov dword [0x103b0ea4], eax
call sub.mfc100.dll_Ordinal_1296
pop ecx
pop ecx
push 0
mov ecx, 0x103ad018
call sub.mfc100.dll_Ordinal_13219
push 0
mov ecx, 0x103b0d28
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10083a34
leave
ret