joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457100
Capabilities:
Hash data with crc32

Disassembly:
mov eax, 0x2210
call fcn.00571390
mov edx, 0x20
mov ecx, str.02c427bb01597608s
call fcn.0041e500
cmp eax, 0x73824a00
jne 0x45712c
mov eax, 3
add esp, 0x2210
ret
mov ecx, dword [0x5b4310]
push 0x104
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45714e
add esp, 0x2210
ret
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x18]
push 0x5845a4
push edx
call fcn.00570b2c
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
je 0x45728b
push 0x5860b0
call fcn.00570543
push edi
push 0x2000
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x22c]
push 1
push eax
or ebp, 0xffffffff
xor esi, esi
call fcn.005718d3
add esp, 0x14
test eax, eax
jbe 0x457235
xor ebx, ebx
test eax, eax
jbe 0x4571fa
jmp 0x4571b0
cmp esi, dword [esp + 0x10]
jb 0x4571d7
mov ecx, str.02c427bb01597608s
lea edi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4571c0
mov edx, dword [esp + 0x10]
sub ecx, edi
mov edi, dword [esp + 0x14]
add ecx, edx
cmp esi, ecx
jb 0x4571f4
xor ecx, ecx
mov cl, byte [esp + ebx + 0x220]
xor ecx, ebp
and ecx, 0xff
mov edx, dword [ecx*4 + 0x59b510]
shr ebp, 8
xor ebp, edx
inc esi
inc ebx
cmp ebx, eax
jb 0x4571b0
cmp eax, 0x2000
jb 0x457235
push 1
push 0xffffffffffffffce
push edi
call fcn.005719ae
add esp, 0xc
test eax, eax
push edi
jne 0x457283
push 0x2000
lea eax, [esp + 0x228]
push 1
push eax
sub esi, 0x32
call fcn.005718d3
add esp, 0x10
test eax, eax
ja 0x4571a5
test byte [edi + 0xc], 0x20
push edi
jne 0x457283
call fcn.005709f9
not ebp
push ebp
lea ecx, [esp + 0x124]
push str._08lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 8
lea edx, [esp + 0x130]
push edx
push str.02c427bb01597608s
call fcn.00580a2f
add esp, 0x1c
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop esi
pop ebp
pop ebx
inc ecx
mov eax, ecx
add esp, 0x2210
ret
call fcn.005709f9
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2210
ret
Function at 0x46ef80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, ecx
push 2
mov dword [ebx], 0
mov eax, dword [0x5b4310]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x5b4310]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46f02f
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x46f02d
mov edx, dword [0x5b4314]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x46f02d
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x46effc
movzx ecx, word [esi + 0xe]
lea eax, [ecx - 1]
cmp eax, 7
ja case.0x46efea.3
movzx eax, byte [eax + 0x46f03c]
jmp dword [eax*4 + 0x46f034]
mov eax, 1
shl eax, cl
jmp 0x46effc
xor eax, eax
lea ecx, [eax*4]
movzx eax, word [esi]
movzx edx, cx
push 0
mov ecx, esi
push esi
add ecx, edx
add eax, ecx
push eax
push 4
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebx], eax
mov edx, dword [0x5b4314]
push edi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
ret
Function at 0x4709a0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5a7184]
sub esp, 0x104
test eax, eax
push esi
mov esi, ecx
jne 0x4709bc
xor eax, eax
pop esi
add esp, 0x104
ret
test esi, esi
je 0x4709d4
mov ecx, dword [esi + 0x540]
call fcn.004e2760
test eax, eax
je 0x4709b2
mov eax, dword [0x5a7184]
mov ecx, dword [eax + 0x138]
test ecx, ecx
push ebp
push edi
je 0x470aa5
test esi, esi
je 0x470a96
mov ecx, dword [esi + 0x12c]
test ecx, ecx
je 0x470a96
cmp esi, eax
je 0x470a96
lea eax, [esi + 0x64]
push eax
xor edx, edx
mov ecx, 0x7d2
call fcn.0041d620
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x14]
push ecx
call ebp
mov eax, dword [0x5a7184]
add esp, 0xc
xor ecx, ecx
test eax, eax
je 0x470a6b
mov edi, edi
mov eax, dword [eax + 0x544]
inc ecx
test eax, eax
jne 0x470a30
cmp ecx, 1
jle 0x470a6b
lea eax, [esp + 0xc]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x470a47
sub eax, edi
dec ecx
push ecx
xor edx, edx
mov ecx, 0x7d3
mov edi, eax
call fcn.0041d620
push eax
lea edx, [esp + edi + 0x14]
push edx
call ebp
add esp, 0xc
mov eax, dword [0x5a5514]
mov dword [0x59bcec], 0
mov dword [0x5ae23c], 1
mov ecx, dword [esi + 0x540]
mov ecx, dword [ecx]
push eax
lea edx, [esp + 0x10]
call fcn.00503ad0
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x104
ret
test esi, esi
jne 0x470aab
mov esi, eax
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x470b50
lea edx, [esi + 0x64]
push edx
xor edx, edx
mov ecx, 0x7d1
call fcn.0041d620
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x14]
push eax
call ebp
mov eax, dword [0x5a7184]
add esp, 0xc
xor ecx, ecx
test eax, eax
je 0x470b24
mov eax, dword [eax + 0x544]
inc ecx
test eax, eax
jne 0x470ae5
cmp ecx, 1
jle 0x470b24
lea eax, [esp + 0xc]
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x470b00
sub eax, edi
dec ecx
push ecx
xor edx, edx
mov ecx, 0x7d3
mov edi, eax
call fcn.0041d620
push eax
lea ecx, [esp + edi + 0x14]
push ecx
call ebp
add esp, 0xc
mov edx, dword [0x5a5514]
mov dword [0x59bcec], 0
mov dword [0x5ae23c], 1
mov eax, dword [esi + 0x540]
mov ecx, dword [eax]
push edx
lea edx, [esp + 0x10]
call fcn.00503ad0
mov ecx, dword [esi + 0x540]
call fcn.004e2760
test eax, eax
jne 0x470b69
pop edi
pop ebp
pop esi
add esp, 0x104
ret
lea edi, [esi + 0x64]
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x470bcf
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, eax
shr ecx, 0x10
mov edx, ecx
push 0x400
shr edx, 8
lea edi, [esi + 0x13c]
mov byte [edi], dl
movzx eax, ax
lea edx, [esi + 0x140]
push edx
push 2
mov byte [esi + 0x13d], cl
mov ecx, eax
push 4
shr ecx, 8
push edi
mov byte [esi + 0x13e], cl
mov byte [esi + 0x13f], al
mov eax, dword [0x5b4314]
push 0x800b
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByAddr]
jmp 0x470bed
mov eax, dword [0x5b4314]
push 0x400
lea edx, [esi + 0x140]
push edx
push edi
push 0x800b
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
xor ecx, ecx
test eax, eax
setne cl
pop edi
mov dword [esi + 0x138], eax
pop ebp
pop esi
mov eax, ecx
add esp, 0x104
ret
Function at 0x471970
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
push ebx
push esi
lea eax, [esp + 0xc]
push eax
mov bl, dl
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [esp + esi + 0xc]
lea eax, [esp + esi + 0xc]
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0xf], cl
mov byte [eax], bl
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4719b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x114
push esi
lea eax, [esp + 0x18]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4719e7
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
je 0x4719f1
cmp eax, 2
je 0x4719f1
xor eax, eax
pop esi
add esp, 0x114
ret
movzx eax, word [esp + 4]
pop esi
add esp, 0x114
ret
Function at 0x4795f0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, edx
mov edi, esi
mov dword [esp + 0x14], ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x479604
mov eax, 0x59b9f8
sub edi, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x479615
sub eax, edx
test ebx, ebx
mov ebp, eax
mov dword [esp + 0x10], 0
je 0x4796a7
test edi, edi
jle 0x4796a7
mov ecx, esi
call fcn.00479120
mov ecx, esi
call fcn.00479160
movzx ecx, byte [edi + esi - 1]
dec edi
sub ecx, 0x78
test ecx, ecx
jle 0x47964d
sub edi, ecx
movzx eax, byte [edi + esi - 1]
dec edi
sub eax, 0x6e
dec edi
mov dword [esp + 0x10], eax
movzx eax, byte [edi + esi]
sub eax, 0x64
add eax, ecx
cmp eax, ebp
mov byte [edi + esi], 0
jle 0x47966e
sub eax, ebp
mov edi, esi
lea edx, [edi + 1]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x479673
sub edi, edx
test eax, eax
jl 0x479744
cmp eax, ebp
jg 0x479744
xor ecx, ecx
test edi, edi
jle 0x4796a7
mov dl, byte [eax + 0x59b9f8]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x4796a2
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x479692
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4796b0
sub eax, edx
lea ecx, [eax - 1]
test ecx, ecx
jle 0x4796db
dec ecx
shr ecx, 1
lea eax, [esi + 1]
inc ecx
mov dl, byte [eax - 1]
mov bl, byte [eax]
mov byte [eax - 1], bl
mov byte [eax], dl
add eax, 2
dec ecx
jne 0x4796c7
mov ebx, dword [esp + 0x14]
mov ecx, esi
call fcn.00479160
xor eax, eax
xor ecx, ecx
test edi, edi
jle 0x479705
lea ebx, [ebx]
mov dl, byte [eax + 0x59b9f8]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x479700
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x4796f0
test ebx, ebx
je 0x479779
xor ecx, ecx
xor ebx, ebx
test edi, edi
jle 0x479730
movzx eax, byte [ebx + esi]
add ecx, eax
cmp ecx, 0x1e
jl 0x47972b
mov eax, 0x88888889
mul ecx
shr edx, 4
imul edx, edx, 0xffffffe2
add ecx, edx
inc ebx
cmp ebx, edi
jl 0x479711
cmp ecx, dword [esp + 0x10]
je 0x479779
cmp dword [esp + 0x14], 1
jne 0x479768
push 0
call fcn.00573096
cmp ebx, 1
jne 0x479750
push 0
call fcn.00573096
mov eax, dword [0x586a90]
mov dword [esi], eax
mov cl, byte [0x586a94]
pop edi
mov byte [esi + 4], cl
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [0x586a90]
mov dword [esi], ecx
mov dl, byte [0x586a94]
mov byte [esi + 4], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x481da0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
mov esi, edx
test esi, esi
push edi
mov edi, ecx
je 0x481e50
cmp byte [esi], 0
je 0x481e50
mov edx, 0x3e7
lea ecx, [esp + 8]
call fcn.0041ef30
lea edx, [esp + 8]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x481dd3
mov eax, dword [0x5b1218]
test eax, eax
je 0x481e12
mov eax, dword [edi + 0x540]
test eax, eax
je 0x481e12
mov ecx, dword [edi]
call fcn.00542c90
test eax, eax
je 0x481e12
cmp dword [eax + 0x9e4], 0x80
jne 0x481e12
mov ecx, dword [edi]
lea edx, [esp + 8]
call fcn.0051aad0
lea eax, [esp + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x481e20
mov ecx, dword [edi + 0x884]
sub eax, edx
push 0
mov esi, eax
push esi
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_send]
sub eax, esi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x3e8
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3e8
ret
Function at 0x486660
Capabilities:
Connect socket

Disassembly:
mov eax, dword [0x5a7cb8]
sub esp, 0x10
cmp ecx, eax
jne 0x486673
shr edx, 0x10
test edx, edx
je 0x48668c
mov ecx, 0x9c7
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x10
ret 4
mov dx, word [0x59bcfc]
mov cx, word [0x59bcf8]
push 0
push 0
push 2
push 0
mov dword [0x5a7cb8], 0
call fcn.005049f0
cmp eax, 0xffffffff
mov dword [0x59ba28], eax
jne 0x4866d4
mov ecx, 0x9c8
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x10
ret 4
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push 0x4f
mov dword [esp + 0x10], eax
mov word [esp + 4], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
jne 0x48670d
mov ecx, dword [0x5a7ccc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [0x5b4314]
mov edx, dword [0x59ba28]
push 0x10
push 0x8023
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov ecx, dword [0x59ba28]
push 0x10
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x486764
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x486764
mov ecx, 0x9c9
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x10
ret 4

Function at 0x486770
Capabilities:
Send data
Send data on socket

Disassembly:
shr ecx, 0x10
sub esp, 0x104
test ecx, ecx
je 0x486787
mov ecx, 0x9c9
jmp 0x4868b1
mov al, byte [0x5a7be8]
push esi
xor edx, edx
test al, al
push 0x5a7c50
je 0x4867da
push 0x5a7be8
mov ecx, 0x9ca
call fcn.0041d620
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x10]
push eax
call esi
mov ecx, dword [0x5a5508]
add esp, 0x10
push ecx
mov ecx, dword [0x5b432c]
lea edx, [esp + 8]
call fcn.00502c40
push 0x5a7be8
push 0x584748
jmp 0x486815
mov ecx, 0x9cb
call fcn.0041d620
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0xc]
push eax
call esi
mov ecx, dword [0x5a5508]
add esp, 0xc
push ecx
mov ecx, dword [0x5b432c]
lea edx, [esp + 8]
call fcn.00502c40
push 0x5a7c50
push 0x58799c
lea edx, [esp + 0xc]
push edx
call esi
mov edx, dword [0x5a5504]
mov ecx, dword [0x5b432c]
add esp, 0xc
call fcn.00502b10
mov edx, 0x64
mov ecx, 0x5a7be8
call fcn.0041ef30
mov edx, 0x64
mov ecx, 0x5a7c50
call fcn.0041ef30
mov edx, 0x3e7
mov ecx, 0x5a80c0
call fcn.0041ef30
mov eax, dword [0x5b4314]
mov ecx, dword [0x59ba28]
push 0x21
push 0x8024
push eax
push ecx
mov dword [0x5a84a8], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x486888
sub eax, edx
push 0
mov esi, eax
mov eax, dword [0x59ba28]
push esi
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
pop esi
je 0x4868bf
mov ecx, 0x9cc
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x104
ret
Function at 0x4868d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [0x5a7cb4]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x4868f4
mov ecx, 0x583b74
call fcn.004865a0
pop ebx
add esp, 0x10c
ret
mov edx, dword [0x59ba28]
push 1
push 1
mov ecx, 0x8024
call fcn.0054c250
test eax, eax
jne 0x486ac5
push ebp
push esi
push edi
mov eax, dword [0x5a84ac]
inc eax
cmp eax, 0x14
mov dword [0x5a84ac], eax
jl 0x486944
mov edx, dword [0x59ba28]
push ebx
push 1
mov ecx, 0x8024
mov dword [0x5a84ac], ebx
call fcn.0054c250
test eax, eax
jne 0x486ac2
mov ecx, dword [0x59ba28]
push ebx
push 0x103
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x486a6a
cmp edi, ebx
jle 0x486a87
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x18], bl
mov dword [esp + 0x10], ebp
jle 0x486913
mov edx, dword [0x5a84a8]
jmp 0x486990
cmp edx, 0x3b5
jae 0x486a20
mov al, byte [esp + ebp + 0x18]
cmp al, 0xd
je 0x486a58
cmp al, 0xa
jne 0x4869cb
cmp edx, ebx
jne 0x4869bc
mov byte [0x5a80c0], 0x20
mov edx, 1
mov byte [edx + 0x5a80c0], bl
mov edx, dword [0x5a550c]
push edx
jmp 0x486a3c
cmp al, 9
jne 0x486a11
xor esi, esi
cmp edx, ebx
jl 0x4869de
lea esi, [edx + 8]
shr esi, 3
shl esi, 3
sub esi, edx
cmp esi, ebx
jle 0x486a58
mov ecx, esi
mov ebp, ecx
shr ecx, 2
lea edi, [edx + 0x5a80c0]
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, ebp
mov ebp, dword [esp + 0x10]
and ecx, 3
add edx, esi
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
mov dword [0x5a84a8], edx
jmp 0x486a58
mov byte [edx + 0x5a80c0], al
inc edx
mov dword [0x5a84a8], edx
jmp 0x486a58
cmp edx, ebx
jne 0x486a30
mov byte [0x5a80c0], 0x20
mov edx, 1
mov eax, dword [0x5a550c]
mov byte [edx + 0x5a80c0], bl
push eax
mov ecx, dword [0x5b432c]
mov edx, 0x5a80c0
mov dword [0x5a84a8], ebx
call fcn.00502c40
mov edx, dword [0x5a84a8]
inc ebp
cmp ebp, edi
mov dword [esp + 0x10], ebp
jl 0x486990
jmp 0x486913
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x486ac2
xor edx, edx
mov ecx, 0x9cd
call fcn.0041d620
mov ecx, eax
jmp 0x486a8c
mov ecx, 0x583b74
call fcn.004865a0
mov edx, dword [0x5a5504]
mov ecx, dword [0x5b432c]
call fcn.00502b10
mov ecx, dword [0x5a5508]
push ecx
xor edx, edx
mov ecx, 0x9ce
call fcn.0041d620
mov ecx, dword [0x5b432c]
mov edx, eax
call fcn.00502c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x486ad0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
push edi
call fcn.004e28b0
mov edi, eax
test edi, edi
je 0x486b73
push 0x5a7c50
mov edx, 0x104
lea ecx, [esp + 0xc]
call fcn.0041ee40
lea eax, [esp + 8]
push 0x20
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x486b0f
mov byte [eax], 0
push esi
lea ecx, [esp + 0xc]
push 0x40
push ecx
call fcn.00570260
mov esi, eax
add esp, 8
test esi, esi
mov ecx, 0x5a7be8
je 0x486b52
lea edx, [esp + 0xc]
push edx
mov edx, 0x64
mov byte [esi], 0
call fcn.0041ee40
mov byte [esi], 0x40
inc esi
push esi
mov edx, 0x64
mov ecx, 0x5a7c50
call fcn.0041ee40
jmp 0x486b5c
mov edx, 0x64
call fcn.0041ef30
mov edx, 0xf
lea ecx, [esp + 0xc]
call fcn.00524b30
mov al, byte [esp + 0xc]
test al, al
pop esi
jne 0x486b84
xor ecx, ecx
call fcn.0041d520
xor eax, eax
pop edi
add esp, 0x108
ret
push 0
push 0x5a98a0
push 0
mov edx, 0x583d84
mov ecx, str.finger
call fcn.004b2210
push 0
push 1
lea edx, [esp + 0x10]
mov ecx, eax
mov dword [esp + 0xc], eax
call fcn.004c8960
test eax, eax
je 0x486bcf
push 0x5a98a0
push 0x14
push 0x583d84
mov edx, str.finger
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.004b23b0
lea ecx, [esp + 4]
call fcn.004c8280
mov ecx, dword [0x5b432c]
test ecx, ecx
je 0x486c6b
mov edx, dword [0x5a5504]
call fcn.00502b10
mov dword [0x5a7cb4], 1
call fcn.00531c20
push 0x5a7c50
xor edx, edx
mov ecx, 0x9c5
call fcn.0041d620
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x5a5508]
mov ecx, dword [0x5b432c]
add esp, 0xc
push edx
lea edx, [esp + 0xc]
call fcn.00502c40
push 0x5a7c50
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x486cce
push eax
xor edx, edx
xor ecx, ecx
mov dword [0x5a7cb8], 0
call fcn.00486660
mov eax, 1
pop edi
add esp, 0x108
ret
mov eax, dword [str.Finger_Window]
mov ecx, dword [0x5879a8]
mov edx, dword [0x5879ac]
push edi
mov dword [esp + 0xc], eax
mov ax, word [0x5879b0]
push 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
push 0
mov edx, 5
lea ecx, [esp + 0x14]
mov word [esp + 0x20], ax
call fcn.00548f10
test eax, eax
mov dword [0x5b432c], eax
jne 0x486bf1
xor ecx, ecx
call fcn.0041d520
mov ecx, 0x583b74
call fcn.004865a0
xor eax, eax
pop edi
add esp, 0x108
ret
mov edx, 0x400
mov ecx, 0x5a7cc0
call fcn.0041ef30
mov eax, dword [0x5b4314]
push 0x400
push 0x5a7cc0
push 0x5a7c50
push 0x8022
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [0x5a7cb8], eax
jne 0x486c5e
xor edx, edx
mov ecx, 0x9c7
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
xor eax, eax
pop edi
add esp, 0x108
ret
Function at 0x4872d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x5a84b0]
test eax, eax
mov edx, ecx
mov ecx, dword [0x5b4314]
je 0x4872e8
xor ecx, ecx
jmp fcn.0041d520
mov eax, dword [0x5a7cb4]
test eax, eax
mov dword [0x5a84b0], 1
je 0x487338
mov eax, dword [0x5b432c]
test eax, eax
je 0x487323
mov eax, dword [0x5a5500]
push eax
xor edx, edx
mov ecx, 0x2f3
call fcn.0041d620
mov ecx, dword [0x5b432c]
mov edx, eax
call fcn.00502c40
mov ecx, 0x583b74
call fcn.004865a0
mov dword [0x5a84b0], 0
ret
mov eax, dword [0x5b4320]
test eax, eax
mov dword [0x5aa5ec], edx
je 0x487362
cmp eax, dword [0x5b432c]
jne 0x48735b
mov dword [0x5aa5ec], 2
jmp 0x487360
cmp edx, 2
jne 0x487362
mov ecx, eax
push 0
push 0x486ee0
mov edx, 0x1b8
call fcn.004675d0
mov dword [0x5aa5ec], 0
mov dword [0x5a84b0], 0
ret

Function at 0x487440
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x59ba30], 0xffffffff
mov dword [0x59ba2c], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x59ba2c], eax
je 0x48748c
mov edx, 0x4f
mov ecx, eax
call fcn.00504920
test eax, eax
je 0x48748c
mov eax, dword [0x59ba2c]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x487493
xor ecx, ecx
jmp fcn.00487390
mov ecx, dword [0x5b4314]
mov edx, dword [0x59ba2c]
push 8
push 0x802e
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x487a60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov eax, ecx
shr eax, 0x10
test eax, eax
push esi
push edi
jne 0x487c9f
cmp cx, 0x20
je 0x487c9f
mov edx, dword [0x59ba30]
cmp edx, 0xffffffff
je 0x487c9f
cmp dword [0x59ba2c], 0xffffffff
je 0x487c9f
push 1
push 2
mov ecx, 0x8030
call fcn.0054c250
test eax, eax
jne 0x487cad
mov ebp, dword [sym.imp.WSOCK32.dll_send]
xor ebx, ebx
mov eax, dword [0x5a8a18]
inc eax
cmp eax, 0x14
mov dword [0x5a8a18], eax
jl 0x487ae6
mov edx, dword [0x59ba30]
push ebx
push 2
mov ecx, 0x8030
mov dword [0x5a8a18], ebx
call fcn.0054c250
test eax, eax
jne 0x487cad
cmp byte [0x5a8630], bl
jne 0x487c16
mov ecx, dword [0x5a85c4]
push ecx
push 0x3e7
push 0x5a8630
call fcn.00570a4a
add esp, 0xc
test eax, eax
je 0x487c9f
mov ecx, 0x5a8630
call fcn.004b21c0
test eax, eax
jne 0x487c9f
mov ecx, 0x5a8630
call fcn.00487550
test eax, eax
je 0x487c7e
push 0xa
push 0x5a8630
call fcn.00570260
add esp, 8
test eax, eax
jne 0x487b62
mov edi, 0x5a8630
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x487b50
mov dx, word [0x58445c]
mov word [edi], dx
push 0x58445c
push 0x5a8630
call fcn.005809c6
add esp, 8
test eax, eax
jne 0x487c16
mov eax, dword [0x5a85c4]
push eax
call fcn.005727b6
mov ecx, dword [0x5a85c4]
push ecx
push 0x3e7
push 0x5a8630
mov edi, eax
mov esi, 1
call fcn.00570a4a
add esp, 0x10
test eax, eax
je 0x487bf5
jmp 0x487bb0
mov ecx, 0x5a8630
call fcn.004b21c0
test eax, eax
jne 0x487bf5
push 0x58445c
push 0x5a8630
call fcn.005809c6
add esp, 8
test eax, eax
jne 0x487bf3
mov edx, dword [0x5a85c4]
push edx
push 0x3e7
push 0x5a8630
call fcn.00570a4a
add esp, 0xc
test eax, eax
jne 0x487bb0
jmp 0x487bf5
xor esi, esi
mov eax, dword [0x5a85c4]
push ebx
push edi
push eax
call fcn.005719ae
add esp, 0xc
cmp esi, ebx
jne 0x487c7e
mov byte [0x5a8630], 0xa
mov byte [0x5a8631], bl
mov eax, 0x5a8630
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x487c20
sub eax, edx
mov esi, eax
mov eax, 0x5a8630
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x487c33
mov ecx, dword [0x59ba30]
push ebx
sub eax, edx
push eax
push 0x5a8630
push ecx
call ebp
cmp eax, 0xffffffff
je 0x487c92
cmp eax, esi
jge 0x487c7e
lea edx, [eax + 0x5a8630]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x487c60
sub eax, esi
inc eax
push eax
push edx
push 0x5a8630
call fcn.00571040
add esp, 0xc
jmp 0x487ab5
mov edx, 0x3e7
mov ecx, 0x5a8630
call fcn.0041ef30
jmp 0x487ab5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x487cad
pop edi
pop esi
pop ebp
mov ecx, 2
pop ebx
jmp fcn.00487390
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x48ae60
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [0x5a8b70]
test edx, edx
push esi
mov esi, ecx
je 0x48aeb6
lea ecx, [ecx]
cmp dword [edx], esi
je 0x48ae80
mov edx, dword [edx + 0x218]
test edx, edx
jne 0x48ae70
pop esi
ret
mov ecx, esi
call fcn.0048add0
cmp esi, dword [0x5b4314]
jne 0x48aead
mov ecx, 4
call fcn.00537e30
mov eax, dword [0x5b4314]
push 0
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
pop esi
jmp fcn.0041dc00
push 0
push esi
call dword [sym.imp.USER32.dll_FlashWindow]
pop esi
ret