joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x462014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x46662c
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ecx
call fcn.0041c79c
add esp, 4
test eax, eax
jne 0x40ef1b
mov ecx, dword [0x4665e0]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
mov dword [ebp - 0xc], ecx
xor esi, esi
mov edi, 4
push 0
push edi
lea eax, [ebp - 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40ee71
mov ecx, dword [ebp - 0xc]
add esi, eax
sub edi, eax
cmp esi, 4
jl 0x40ee54
xor ecx, ecx
mov edi, 8
cmp eax, 0xffffffff
setne cl
dec ecx
xor esi, esi
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x4665e0]
mov dword [ebp - 0x10], ecx
nop dword [eax]
push 0
push edi
lea eax, [ebp + 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40eead
mov ecx, dword [ebp - 0x10]
add esi, eax
sub edi, eax
cmp esi, 8
jl 0x40ee90
mov edi, dword [ebp - 0xc]
or ecx, 0xffffffff
cmp eax, ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmove edi, ecx
mov ecx, dword [0x4665e0]
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], ecx
test eax, eax
jle 0x40eef7
mov edi, eax
mov eax, dword [ebp - 0x14]
push 0
push edi
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40eef4
mov ecx, dword [ebp - 0x18]
add esi, eax
sub edi, eax
cmp esi, dword [ebp - 0x10]
jl 0x40eed2
mov edi, dword [ebp - 0xc]
jmp 0x40eef7
or edi, 0xffffffff
push 0x46662c
call fcn.0041c7c1
add esp, 4
test eax, eax
jne 0x40ef21
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d0e1
mov esp, ebp
pop ebp
ret
push eax
call fcn.0041c35a
push eax
call fcn.0041c35a
int3
Function at 0x40f590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x20f8
call fcn.0041e240
mov eax, dword [0x462014]
xor eax, esp
mov dword [esp + 0x20f4], eax
push esi
push edi
call fcn.004375d0
cmp dword [0x463144], 0x10
mov edi, eax
push 0xa
lea eax, [esp + 0x10]
mov esi, 0x463130
cmovae esi, dword [0x463130]
push eax
push esi
mov dword [edi], 0
call fcn.00438b06
add esp, 0xc
cmp esi, dword [esp + 0xc]
je 0x40f724
cmp dword [edi], 0x22
je 0x40f71a
movzx edi, ax
lea eax, [esp + 0x28]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40f703
cmp dword [0x4634d4], 0x10
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
mov esi, 0x4634c0
mov word [esp + 0x10], ax
cmovae esi, dword [0x4634c0]
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x14]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x4665e0], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x40f6b3
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
push 0xbb8
call edi
push dword [0x4665e0]
call esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x4665e0], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40f680
lea ecx, [esp + 0x1b8]
call fcn.0040f2f0
cmp eax, 0xffffffff
je 0x40f703
cmp byte [0x4664dc], 1
je 0x40f6f4
lea ecx, [esp + 0x1b8]
call fcn.0040f2f0
cmp eax, 0xffffffff
jne 0x40f6c4
or eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x20f4]
xor ecx, esp
call fcn.0041d0e1
mov esp, ebp
pop ebp
ret
push dword [0x4665e0]
call esi
mov byte [0x4664dc], 0
mov ecx, dword [esp + 0x20fc]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.0041d0e1
mov esp, ebp
pop ebp
ret
push str.stoi_argument_out_of_range
call fcn.0041c2c9
push str.invalid_stoi_argument
call fcn.0041c289
int3
Function at 0x417120
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x417090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0x7530
call esi
jmp 0x417140

Function at 0x41fc7d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b63
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406b9a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b74
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b6f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bcb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bad
pop edi
not eax
pop esi
ret 0xc

Function at 0x401058
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x7c
push edi
mov edi, esp
push 0x7c
push edi
call 0x401090
push edi
add edi, eax
mov eax, 0x7265705c
stosd dword es:[edi], eax
mov eax, 0x2e737466
stosd dword es:[edi], eax
mov eax, 0x6c6c64
stosd dword es:[edi], eax
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0x7c
pop edi
inc eax
je 0x40108d
jmp fcn.004012f4
add byte [eax], al
add bh, bh
and eax, sym.imp.KERNEL32.dll_GetSystemDirectoryA
nop
nop
jmp dword [sym.imp.USER32.dll_GetCursorPos]

Function at 0x40138c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
lea ecx, [0x403158]
push ecx
push edi
mov ebx, esp
push ebx
mov edi, 0x2b
push edi
add dword [esp], 0x15
mov edx, 0xfffffe68
push edx
add dword [esp], 0xaec
push section..data
push sym.imp.KERNEL32.dll_VirtualProtect
pop edi
call dword [edi]
pop edx
pop ecx
mov esi, 0x403400
mov dword [ecx + 0x14], esi
mov ebx, esi
sub ebx, 0x1a3
push 0x402529
pop edi
xor eax, eax
sub edi, 0xfffffffc
mov edx, dword [edi - 4]
mov dword [ebx + 0x1a3], edx
add ebx, 4
xor dword [ebx + 0x19f], 0x99a32157
add dword [ebx + 0x19f], 0x5ae34687
add eax, 4
cmp eax, 0x554
jne 0x4013d8
push ecx
mov ebx, 0
push ebx
call sub.KERNEL32.dll_CloseHandle
pop ecx
pop ebp
ret 0xc

Function at 0x4017b8
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
push eax
push edx
push edi
push esi
push ebx
call fcn.00401550
pop eax
push eax
call sub.KERNEL32.dll_GetCommandLineA
pop eax
push eax
push 0x16
call sub.KERNEL32.dll_Sleep
pop eax
pop ebp
ret 0x10
Function at 0x411b54
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x41fd30
test eax, 0xeb0c5d89
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41fd54
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41fd72
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41fdd0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41fdb7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41fdc0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41fdca
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41fdac
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x41fd36
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40ce00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov eax, dword [ebp + 0x40054]
mov esi, dword [eax]
lea ebx, [ebp + 0x40050]
mov edi, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
test edi, edi
mov eax, ebx
mov ecx, dword [eax + 4]
je 0x40cea9
cmp edi, eax
jne 0x40cea9
cmp esi, ecx
je 0x40ceae
cmp esi, dword [edi + 4]
je 0x40cea4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jb 0x40ce91
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x10], eax
cmp esi, dword [edi + 4]
je 0x40cea4
movzx ecx, byte [esi + 0xc]
mov edx, dword [esi + 0x18]
push ecx
mov ecx, ebp
call edx
test al, al
jne 0x40ce91
lea edx, [esp + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
call fcn.0040ed60
push esi
push edi
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.0040def0
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jmp 0x40ce1f
lea edx, [esp + 0x10]
call fcn.0040ed60
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
jmp 0x40ce27
call fcn.0040ec20
call fcn.0040ec90
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43d750
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x4d14d0]
test eax, eax
je 0x43d794
mov eax, dword [eax + 0xbc]
push 0
push 0
push 0
push 0
mov dword [0x4d14c0], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0x43d890
push 0
push 0
mov dword [0x4d14c8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4d14c4], eax
pop ecx
ret

Function at 0x43f600
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0x18
sub eax, 0
je 0x43f626
sub eax, 1
je 0x43f61f
sub eax, 1
jne 0x43f626
mov eax, 1
jmp 0x43f62b
mov eax, 2
jmp 0x43f62b
mov eax, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
mov eax, dword [0x4d14dc]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
xor eax, eax
ret
Function at 0x442040
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
mov ebx, ecx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [ebx + 0xa0]
mov edi, dword [ecx]
lea eax, [ebx + 0x9c]
mov edx, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], edx
jmp 0x442084
mov edi, dword [esp + 0x14]
lea ecx, [ebx + 0x9c]
cmp eax, ecx
jne 0x4421fa
cmp edi, dword [esp + 0x2c]
je 0x442204
test eax, eax
je 0x4421fa
cmp edi, dword [eax + 4]
je 0x4421ff
mov eax, dword [edi + 0x10]
movzx ecx, word [eax + 4]
push ecx
mov eax, ebx
call fcn.00442210
mov edx, dword [edi + 0x10]
mov esi, eax
movzx eax, word [edx + 6]
push eax
mov eax, ebx
call fcn.00442210
test esi, esi
mov edi, eax
je 0x4421e5
test edi, edi
je 0x4421e5
mov eax, dword [esi + 8]
add eax, dword [esi]
lea ebx, [esp + 0x30]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
mov esi, dword [esp + 0xc]
cdq
sub eax, edx
sar eax, 1
sar ecx, 1
push eax
push ecx
call fcn.004428a0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [edi + 8]
add eax, dword [edi]
mov dword [esp + 0x1c], edx
cdq
sub eax, edx
mov dword [esp + 0x18], ecx
mov ecx, eax
mov eax, dword [edi + 0xc]
add eax, dword [edi + 4]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
lea ebx, [esp + 0x40]
call fcn.004428a0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x10]
mov eax, dword [edx + 9]
lea ebx, [eax + eax*2]
mov eax, dword [esp + 0x18]
add eax, ecx
cdq
sub eax, edx
mov edi, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esi + ecx]
cdq
sub eax, edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x24], esi
mov esi, eax
sar edi, 1
sar esi, 1
cmp byte [edx + 0xbb], 0
lea ebx, [ebx*4 + 0x4cfe80]
je 0x4421b8
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
cmp byte [eax + 8], 0
je 0x4421a1
mov eax, dword [eax]
push eax
push str._02dP
jmp 0x4421a9
mov ecx, dword [eax]
push ecx
push str._02d
push 0
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.0044e780
add esp, 0x14
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebx + 8]
call fcn.0044ebd0
mov ebx, dword [esp + 0x24]
add esp, 0x18
lea edx, [esp + 0x10]
call fcn.004451e0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x442080
call fcn.00445050
call fcn.00444fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x446bd0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov edi, ecx
mov ebx, eax
mov eax, dword [edi + 0xb4]
push 0
push eax
call esi
mov eax, dword [ebx + 0x14]
push 5
push eax
mov dword [edi + 0xb4], eax
call esi
mov ecx, dword [edi + 0x14]
push 0
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
push 2
push eax
call esi
push 2
push eax
call esi
cmp ebx, dword [edi + 0xc0]
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, eax
jne 0x446c42
push 8
push 0xbb9
push esi
call ebx
push 0
push 0xbba
push esi
call ebx
call fcn.00446a30
pop edi
pop esi
pop ebx
ret
push 0
push 0xbb9
push esi
call ebx
push 8
push 0xbba
push esi
call ebx
call fcn.00446a30
pop edi
pop esi
pop ebx
ret

Function at 0x446c60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, dword [ebp + 0xa8]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [ebp + 0xa8]
mov dword [ecx + 4], ecx
cmp eax, dword [ebp + 0xa8]
mov dword [ebp + 0xac], 0
je 0x446ca9
mov esi, dword [eax]
push eax
call fcn.004804d5
add esp, 4
cmp esi, dword [ebp + 0xa8]
mov eax, esi
jne 0x446c94
mov eax, dword [ebp + 0x94]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp + 0x9c]
mov ebx, dword [ecx]
lea esi, [ebp + 0x98]
mov edx, ecx
mov dword [esp + 0x14], edx
lea esp, [esp]
cmp esi, esi
jne 0x446d50
cmp ebx, dword [esp + 0x14]
je 0x446d03
cmp ebx, dword [esi + 4]
je 0x446cfe
mov edi, dword [ebx + 8]
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
cmp ebx, dword [esi + 4]
je 0x446cfe
mov ebx, dword [ebx]
jmp 0x446cd0
jmp fcn.00447bc0
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esi + 4]
mov dword [ecx + 4], ecx
cmp eax, dword [esi + 4]
mov dword [esi + 8], 0
je 0x446d32
lea esp, [esp]
mov edi, dword [eax]
push eax
call fcn.004804d5
add esp, 4
cmp edi, dword [esi + 4]
mov eax, edi
jne 0x446d20
mov eax, dword [ebp + 0x90]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, ebp
call fcn.00448600
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x447c30
push 0xffffffffffffffff
push 0x4a9288
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4cd094]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 0x18
push str.invalid_list_T__argument
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00401e60
mov dword [esp + 0x50], 0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x24]
call fcn.00408600
push 0x4bca90
lea ecx, [esp + 0x24]
push ecx
call fcn.0048313b
int3
Function at 0x448da0
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x104
mov eax, dword [0x4cd094]
xor eax, esp
mov dword [esp + 0x100], eax
push 0xfe
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00484950
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp eax, 0x412
jg 0x448e14
je 0x448e03
sub eax, 0x404
je 0x448dfc
sub eax, 0xd
jne 0x448e1b
push str.MS_Gothic
push 0xff
lea ecx, [esp + 8]
push ecx
jmp 0x448e3b
push str.PMingliu
jmp 0x448e31
push str.Gulim
push 0xff
lea eax, [esp + 8]
push eax
jmp 0x448e3b
cmp eax, 0x804
je 0x448e2c
push str.Gulim
push 0xff
lea ecx, [esp + 8]
push ecx
jmp 0x448e3b
push str.SimSun
push 0xff
lea edx, [esp + 8]
push edx
call fcn.004819ec
add esp, 0xc
mov ecx, dword [esp + 0x108]
lea eax, [esp]
push eax
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.004804c6
add esp, 0x104
ret
Function at 0x457840
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4578c1
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x457857
push esi
sub eax, edx
push edi
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x457883
sub eax, edi
lea ecx, [eax + 1]
cmp ecx, 0x7fffffff
ja 0x4578a4
mov eax, ebx
call fcn.00408a70
test eax, eax
je 0x4578a9
call fcn.00458bc0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret
Function at 0x459880
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x4cd094]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push 0x10
push eax
push 0
push 0x10
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x19], 0x45
mov byte [esp + 0x1a], 0x51
mov byte [esp + 0x1b], 0
mov dword [esp + 0x24], edx
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004804c6
add esp, 0x14
ret

Function at 0x4598e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4cd094]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push 0x10
push eax
push 0
push 0x10
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], 0x43
mov byte [esp + 0x1a], 0x4b
mov byte [esp + 0x1b], 0
mov dword [esp + 0x24], edx
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004804c6
add esp, 0x1c
ret

Function at 0x459cb0
Capabilities:
Resume thread

Disassembly:
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x459cb8
ret
cmp dword [edi + 0x10], 0
push ebx
push ebp
lea ebp, [edi + 0x10]
je 0x459cf8
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x459cd6
pop ebp
xor eax, eax
pop ebx
ret
cmp eax, 1
jbe 0x459cef
push esi
lea esi, [eax - 1]
test esi, esi
jbe 0x459cee
mov eax, dword [edi + 0xc]
push eax
call ebx
sub esi, 1
jne 0x459ce3
pop esi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x459d50
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1120
call fcn.0049ff30
mov eax, dword [0x4cd094]
xor eax, esp
mov dword [esp + 0x111c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov edi, dword [sym.imp.WS2_32.dll_recvfrom]
lea esp, [esp]
push 0x1000
lea eax, [esp + 0x124]
push 0
push eax
mov dword [esp + 0x18], 0x10
call fcn.00484950
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x14]
push edx
push 0
push 0x1000
lea eax, [esp + 0x130]
push eax
push ecx
call edi
cmp eax, 0xffffffff
jne 0x459dd9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x459e34
push str.unreachable_host__n
call ebx
jmp 0x459d80
cmp byte [esp + 0x120], 0x52
jne 0x459d80
cmp byte [esp + 0x121], 0x45
jne 0x459d80
cmp byte [esp + 0x122], 0x51
jne 0x459d80
push str.REQ_received__n
call ebx
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
push edx
mov edx, dword [esi + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.004598e0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x459d80
push str.failed_to_send_ack__n
call ebx
jmp 0x459d80
push eax
push str.recvfrom_failed___err:__d__n
mov eax, 0xff
lea edi, [esp + 0x28]
call fcn.00408ae0
add esp, 8
test eax, eax
je 0x459e54
mov eax, edi
push eax
call ebx
mov ecx, dword [esp + 0x1124]
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004804c6
mov esp, ebp
pop ebp
ret