joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448dd6
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4bec74
call fcn.00483820
sub esp, 0x220
mov eax, dword [0x4eec8c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
mov byte [ebp - 0x22c], bl
dec eax
je 0x448eab
dec eax
je 0x448e86
dec eax
je 0x448e2d
dec eax
je 0x448e23
dec eax
je 0x448e86
jmp 0x448ebe
push str.CD_ROM
jmp 0x448eb0
lea eax, [ebp + 8]
push 2
push eax
mov ecx, esi
call fcn.00493848
lea eax, [ebp - 0x22c]
push 0x200
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push dword [esi]
lea eax, [ebp - 0x22c]
push eax
call fcn.00484860
pop ecx
cmp eax, ebx
pop ecx
je 0x448e7c
add eax, 2
mov byte [ebp - 0x22c], 0x5c
push eax
lea eax, [ebp - 0x22b]
push eax
call fcn.004838f0
pop ecx
pop ecx
lea ecx, [ebp + 8]
call fcn.0049b7ff
jmp 0x448ebe
push ebx
lea ecx, [ebp - 0x24]
push ebx
mov eax, dword [esi]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x22c]
push 0x200
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
jmp 0x448ebe
push str.FLOPPY
lea eax, [ebp - 0x22c]
push eax
call fcn.004838f0
pop ecx
pop ecx
push 0x4ebd6c
lea ecx, [ebp - 0x18]
call fcn.0049b86d
mov edi, eax
lea eax, [ebp - 0x1c]
push 2
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00493848
push edi
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
call fcn.0049b9e2
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 3
push ecx
push eax
lea eax, [ebp + 8]
push eax
call fcn.0049ba48
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0049b8ec
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0049b7ff
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0049b7ff
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0049b7ff
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0049b7ff
mov ecx, dword [ebp - 0x14]
push 0x199
call fcn.0049acac
push dword [ebp - 0x10]
push ebx
push 0x143
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x44b0ff
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4bef54
call fcn.00483820
sub esp, 0x804
cmp dword [0x4ebd08], 0
push edi
mov edi, ecx
jne 0x44b1a8
push esi
call fcn.004b563d
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x10]
add eax, 0x1a8
push eax
call fcn.0049b574
and dword [ebp - 4], 0
mov esi, 0x4f1070
push esi
push dword [ebp - 0x10]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
jne 0x44b164
call fcn.004b563d
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x10]
push dword [eax + 0x90]
call fcn.0049b93c
push dword [ebp - 0x10]
lea eax, [ebp - 0x810]
push 0x800
push eax
push esi
push str.Current_Select
push str.File_View
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x810], 0
pop esi
je 0x44b19c
lea eax, [ebp - 0x810]
mov ecx, edi
push eax
call fcn.0044a86f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x44c585
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push dword [ebp + 8]
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44c5ae
xor eax, eax
jmp 0x44c5d5
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push eax
and byte [eax], 0
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret 0x14
Function at 0x44d2fc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp ebx, edi
je 0x44d398
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x44d398
lea eax, [ebp + 0xc]
push eax
push 0x10008
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x44d39d
push edi
push edi
push edi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 4], 0x100
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x44d381
cmp esi, edi
jne 0x44d38d
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call fcn.0044d2fc
mov esi, eax
pop ecx
cmp esi, edi
pop ecx
je 0x44d33a
jmp 0x44d38d
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44d39d
mov esi, 0x3f2
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x452a77
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4bf6cc
call fcn.00483820
sub esp, 0x108
push ebx
push esi
push edi
push str.sdfkh_we_34u__jwef
lea ecx, [ebp - 0x10]
call fcn.0049b86d
push dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00483b20
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push dword [esi]
call fcn.00483b20
pop ecx
lea edi, [eax - 1]
pop ecx
xor ecx, ecx
test edi, edi
jle 0x452b1e
mov esi, dword [esi]
mov dl, byte [ebp + 0xb]
mov al, byte [esi + ecx]
cmp al, 0x30
jl 0x452ad1
cmp al, 0x39
jg 0x452ad1
shl al, 4
jmp 0x452ae6
cmp al, 0x61
jl 0x452ad9
cmp al, 0x66
jle 0x452ae1
cmp al, 0x41
jl 0x452ae8
cmp al, 0x46
jg 0x452ae8
add al, 9
shl al, 4
mov dl, al
mov al, byte [esi + ecx + 1]
inc ecx
cmp al, 0x30
jl 0x452af9
cmp al, 0x39
jg 0x452af9
sub al, 0x30
jmp 0x452b0f
cmp al, 0x61
jl 0x452b05
cmp al, 0x66
jg 0x452b05
sub al, 0x57
jmp 0x452b0f
cmp al, 0x41
jl 0x452b11
cmp al, 0x46
jg 0x452b11
sub al, 0x37
add dl, al
mov byte [ebp + ebx - 0x114], dl
inc ebx
inc ecx
cmp ecx, edi
jl 0x452ac1
mov ecx, dword [ebp + 8]
push 0x4f1070
call fcn.0049b93c
xor esi, esi
test ebx, ebx
jle 0x452b54
mov eax, esi
mov ecx, dword [ebp + 8]
cdq
idiv dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dl, byte [edx + eax]
mov al, byte [ebp + esi - 0x114]
xor al, dl
push eax
call fcn.0049bbb6
inc esi
cmp esi, ebx
jl 0x452b31
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x460fcd
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xe06], 0
jne 0x461090
mov eax, dword [esi + 0xfa2]
mov edi, dword [esi + 0xf96]
test eax, eax
jle 0x461058
mov ebx, dword [esp + 0x10]
lea eax, [eax + eax*8]
cmp byte [edi + eax*2 - 0x12], 0x4b
lea eax, [edi + eax*2]
jne 0x461021
cmp dword [eax - 0x10], ebx
jne 0x461021
push 2
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
je 0x461021
add dword [esi + 0xfaa], 0xffffffee
dec dword [esi + 0xfa2]
jmp 0x46106a
cmp ebx, 8
jne 0x46102f
cmp dword [esi + 0xfae], 0
je 0x461090
mov eax, dword [esi + 0xfa2]
lea ecx, [eax + eax*8]
cmp byte [edi + ecx*2 - 0x12], 0x4b
lea ecx, [edi + ecx*2]
jne 0x46106a
cmp dword [ecx - 0x10], 0x10
jne 0x46106a
add dword [esi + 0xfaa], 0xffffffee
dec eax
mov dword [esi + 0xfa2], eax
jmp 0x46106a
mov ebx, dword [esp + 0x10]
cmp ebx, 8
jne 0x46106a
cmp dword [esi + 0xfae], 0
je 0x461090
mov ecx, dword [esi + 0xfaa]
lea eax, [esi + 0xfaa]
mov edx, dword [esp + 0x14]
mov byte [ecx], 0x43
mov ecx, dword [eax]
mov dword [ecx + 2], ebx
mov ecx, dword [eax]
mov dword [ecx + 6], edx
add dword [eax], 0x12
inc dword [esi + 0xfa2]
pop edi
pop esi
pop ebx
ret 8
Function at 0x46c3dd
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
mov edi, ecx
call fcn.004b563d
call fcn.004b563d
mov eax, dword [eax + 0xc]
push 2
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov esi, eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [0x4f52b4]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x40]
push 0x4ec30c
push eax
mov dword [ebp - 0x58], 0x58
mov dword [ebp - 0x50], 0x12aff
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x44], esi
call fcn.004838f0
pop ecx
lea eax, [ebp - 0x58]
pop ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
test esi, esi
mov edi, eax
je 0x46c44e
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x473641
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4c2340
call fcn.00483820
sub esp, 0x82c
mov eax, dword [0x4eec8c]
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
and byte [ebp - 0x38], 0
push 0x4e9bbc
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.0049b93c
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push esi
push 0x14b
push dword [edi + 0x78]
call ebx
mov esi, 0x4f1070
push esi
push dword [ebp - 0x10]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x473703
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 0xa
push ecx
push eax
call fcn.004850a3
add esp, 0xc
lea eax, [ebp - 0x838]
push dword [edi + 0xdc]
push 0x800
push eax
lea eax, [ebp - 0x38]
push esi
push eax
push 0x4ee4f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x838]
lea ecx, [ebp - 0x10]
push eax
call fcn.0049b93c
push esi
push dword [ebp - 0x10]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x47368e
push dword [ebp - 0x10]
push 0
push 0x143
push dword [edi + 0x78]
call ebx
jmp 0x47368e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x473896
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4c2390
call fcn.00483820
sub esp, 0x830
mov eax, dword [0x4eec8c]
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
lea eax, [edi + 0xe0]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x18]
push str.Tag_Group__
push eax
call fcn.0049babc
and byte [ebp - 0x3c], 0
push 0x4e9bbc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0049b93c
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push esi
push 0x184
push dword [edi + 0xb4]
call ebx
mov esi, 0x4f1070
push esi
push dword [ebp - 0x10]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x47398a
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x3c]
push 0xa
push ecx
push eax
call fcn.004850a3
add esp, 0xc
lea eax, [ebp - 0x83c]
push dword [edi + 0xdc]
push 0x800
push eax
lea eax, [ebp - 0x3c]
push esi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x83c]
lea ecx, [ebp - 0x10]
push eax
call fcn.0049b93c
push esi
push dword [ebp - 0x10]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x4738ff
push 0x4eb784
push str._:UEDS:
lea ecx, [ebp - 0x10]
call fcn.004935b0
push dword [ebp - 0x10]
push 0
push 0x180
push dword [edi + 0xb4]
call ebx
jmp 0x4738ff
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0049b7ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x473de5
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4c23f8
call fcn.00483820
sub esp, 0x804
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi + 0x11c], edi
call fcn.004b563d
mov eax, dword [eax + 4]
push edi
mov ebx, str.TagList
push str.TagListFilename
lea ecx, [ebp - 0x10]
push ebx
push ecx
mov ecx, eax
call fcn.004b588e
lea ecx, [esi + 0x104]
push eax
mov dword [ebp - 4], edi
call fcn.0049b8ec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
push dword [esi + 0x104]
lea eax, [ebp - 0x810]
push 0x800
push eax
push 0x4f1070
push str.ActiveGroup
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x810]
lea ecx, [esi + 0x100]
push eax
call fcn.0049b93c
push dword [ebp + 0x14]
mov ecx, esi
movzx eax, word [ebp + 0xc]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0047e297
test eax, eax
je 0x473f99
lea ebx, [esi + 0xac]
push str.Tag_List_Dock
lea eax, [esi + 0x78]
push ebx
push eax
lea eax, [esi + 0x88]
push eax
lea eax, [esi + 0x80]
push eax
call fcn.004749e1
add esp, 0x14
mov dword [ebp + 0x14], eax
call fcn.004b563d
mov eax, dword [eax + 4]
push 1
push str.Show_Tag_Descriptions
push 0x4e9d14
mov ecx, eax
call fcn.004b5822
cmp dword [ebp + 0x14], edi
mov dword [0x4f5448], eax
je 0x473f0c
push 0x216
mov ecx, esi
push dword [esi + 0xb0]
push dword [ebx]
push edi
push edi
push edi
call fcn.0049af0f
lea eax, [esi + 0xa8]
xor ecx, ecx
mov dword [esi + 0xa0], 0xffff
cmp dword [eax], edi
sete cl
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
or dword [esi + 0x12c], 0xffffffff
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0x1770
push 0x194
mov dword [esi + 0x118], eax
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
push dword [esi + 0xe0]
call ebx
mov eax, dword [esi + 0xb0]
push 0x10
sub eax, 9
lea ecx, [esi + 0xc4]
push eax
mov eax, dword [esi + 0xac]
sub eax, 9
push eax
push 3
push 3
push edi
call fcn.0049af0f
push edi
push 0x1770
push 0x194
mov dword [esi + 0x130], 1
push dword [esi + 0xe0]
call ebx
push 0x16e
mov ecx, esi
call fcn.0049acac
push 1
mov dword [esi + 0xc0], eax
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x4743b5
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4c2444
call fcn.00483820
sub esp, 0x834
mov eax, dword [0x4eec8c]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x100]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x18]
push str.Tag_Group__
push eax
call fcn.0049babc
and byte [ebp - 0x40], 0
push 0x4e9bbc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0049b93c
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x184
push dword [esi + 0xe0]
call edi
mov ebx, 0x4f1070
push ebx
push dword [ebp - 0x10]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x4744f3
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
push 0xa
push ecx
push eax
call fcn.004850a3
add esp, 0xc
lea eax, [ebp - 0x840]
push dword [esi + 0x104]
push 0x800
push eax
lea eax, [ebp - 0x40]
push ebx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x840]
lea ecx, [ebp - 0x10]
push eax
call fcn.0049b93c
push ebx
push dword [ebp - 0x10]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x47441e
cmp dword [0x4f5448], 0
je 0x4744a1
push 0x4eb784
push str._:UEDS:
lea ecx, [ebp - 0x10]
call fcn.004935b0
jmp 0x4744dc
push str._:UEDS:
lea ecx, [ebp - 0x10]
call fcn.004938e2
cmp eax, 0xffffffff
je 0x4744dc
add eax, 7
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00493713
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0049b8ec
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0049b7ff
push dword [ebp - 0x10]
push 0
push 0x180
push dword [esi + 0xe0]
call edi
jmp 0x47441e
xor ebx, ebx
push ebx
push ebx
push 0x18b
push dword [esi + 0xe0]
call edi
push 0x169
mov ecx, esi
mov edi, eax
call fcn.0049acac
cmp eax, ebx
je 0x474527
cmp edi, 1
jge 0x47451e
push ebx
jmp 0x474520
push 1
mov ecx, eax
call fcn.0049afa0
push ebx
mov ecx, esi
call fcn.0049a257
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0049b7ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x474556
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4c2460
call fcn.00483820
sub esp, 0x830
mov eax, dword [0x4eec8c]
or dword [ebp - 0x18], 0xffffffff
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
and byte [ebp - 0x3c], 0
push 0x4e9bbc
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.0049b93c
push 0x16e
mov ecx, esi
call fcn.0049acac
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x14b
mov dword [esi + 0xc0], eax
push dword [eax + 0x1c]
call edi
mov ebx, 0x4f1070
push ebx
push dword [ebp - 0x14]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x47466a
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
push 0xa
push ecx
push eax
call fcn.004850a3
add esp, 0xc
lea eax, [ebp - 0x83c]
push dword [esi + 0x104]
push 0x800
push eax
lea eax, [ebp - 0x3c]
push ebx
push eax
push str.Group_List
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x83c]
lea ecx, [ebp - 0x14]
push eax
call fcn.0049b93c
push ebx
push dword [ebp - 0x14]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
je 0x474651
push dword [ebp - 0x14]
mov eax, dword [esi + 0xc0]
push 0
push 0x143
push dword [eax + 0x1c]
call edi
push dword [esi + 0x100]
push dword [ebp - 0x14]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
jne 0x474651
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x18], eax
push ebx
push dword [ebp - 0x14]
call fcn.0048383f
pop ecx
test eax, eax
pop ecx
jne 0x4745cc
cmp dword [ebp - 0x10], 1
jg 0x4746b6
mov eax, dword [0x4eec8c]
mov dword [ebp - 0x10], eax
push 0x80d5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0049be1e
push dword [ebp - 0x10]
mov eax, dword [esi + 0xc0]
xor ebx, ebx
push ebx
push 0x143
push dword [eax + 0x1c]
call edi
mov eax, dword [esi + 0xc0]
push ebx
push ebx
push 0x14e
push dword [eax + 0x1c]
call edi
and byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.0049b7ff
cmp dword [ebp - 0x18], 0xffffffff
je 0x4746d1
mov esi, dword [esi + 0xc0]
push 0
push dword [ebp - 0x18]
push 0x14e
push dword [esi + 0x1c]
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0049b7ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x480bc8
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c0], 0xffffffff
je 0x480be0
push 1
pop eax
jmp 0x480c61
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
lea edi, [esi + 0x1c4]
push 0x10
push 0
push edi
mov dword [esi + 0x2a], ebx
mov dword [esi + 0x2e], eax
call fcn.004843d0
add esp, 0xc
push dword [ebp + 8]
call sub.WSOCK32.dll_htons
push dword [ebp + 0xc]
mov word [esi + 0x1c6], ax
mov word [edi], bx
call sub.WSOCK32.dll_inet_addr
push 0
mov dword [esi + 0x1c8], eax
push dword [ebp + 0x14]
push ebx
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x1c0], eax
pop ebx
jne 0x480c4e
push 2
jmp 0x480bda
push 0x10
push edi
push eax
call sub.WSOCK32.dll_connect
inc eax
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x480c89
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1d4], 0xffffffff
je 0x480ca7
push 1
pop eax
jmp 0x480d8a
push ebx
lea edi, [esi + 0x1d8]
push 0x10
push 0
push edi
call fcn.004843d0
add esp, 0xc
push dword [ebp + 8]
call sub.WSOCK32.dll_htons
mov word [esi + 0x1da], ax
mov ax, word [ebp + 0x10]
push 0
mov word [edi], ax
call sub.WSOCK32.dll_htonl
mov ebx, dword [ebp + 0x14]
cmp ebx, eax
jne 0x480d35
cmp dword [ebp + 0x18], 0xffffffff
je 0x480d35
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x10
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x480d35
push 0xff
push dword [ebp - 0xc]
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00487180
and byte [ebp - 0x11], 0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [esi + 0x1dc], eax
jmp 0x480d3b
mov dword [esi + 0x1dc], ebx
push dword [esi + 0x26]
movsx eax, word [ebp + 0x10]
push 1
push eax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x1d4], eax
pop ebx
jne 0x480d5d
push 2
jmp 0x480ca1
push 0x10
push edi
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x480d72
push 3
jmp 0x480ca1
push dword [ebp + 0xc]
push dword [esi + 0x1d4]
call sub.WSOCK32.dll_listen
inc eax
neg eax
sbb eax, eax
and al, 0xfc
add eax, 4
pop edi
pop esi
leave
ret 0x14

Function at 0x480fc9
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [esp + 0xc], 0
push esi
mov esi, ecx
jle 0x480fe6
push 0
push dword [esp + 0x14]
call fcn.00480f6b
test eax, eax
je 0x480fe6
xor eax, eax
jmp 0x480ffb
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esi + 0x1c0]
call sub.WSOCK32.dll_recv
pop esi
ret 0xc
Function at 0x48107c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
dec dword [ebp + 0xc]
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp dword [ebp + 0xc], 0
jle 0x481142
xor esi, esi
cmp dword [ebp + 0x10], esi
jle 0x4810b3
push esi
mov ecx, ebx
push dword [ebp + 0x10]
call fcn.00480f6b
test eax, eax
jne 0x481142
push 2
push dword [ebp + 0xc]
push edi
push dword [ebx + 0x1c0]
call sub.WSOCK32.dll_recv
cmp eax, 1
jl 0x481142
xor edx, edx
cmp eax, edx
jle 0x4810e8
mov cl, byte [esi + edi]
cmp cl, 0xd
jne 0x4810de
cmp byte [esi + edi + 1], 0xa
je 0x481104
cmp cl, 0xa
je 0x481123
inc esi
cmp esi, eax
jl 0x4810cf
push edx
push eax
push edi
push dword [ebx + 0x1c0]
call sub.WSOCK32.dll_recv
add dword [ebp - 4], eax
and byte [edi + eax], 0
add edi, eax
sub dword [ebp + 0xc], eax
jmp 0x48108f
lea eax, [esi + 2]
push edx
push eax
push edi
push dword [ebx + 0x1c0]
call sub.WSOCK32.dll_recv
mov eax, dword [ebp - 4]
and byte [esi + edi + 2], 0
lea eax, [esi + eax + 2]
jmp 0x481145
lea eax, [esi + 1]
push edx
push eax
push edi
push dword [ebx + 0x1c0]
call sub.WSOCK32.dll_recv
mov eax, dword [ebp - 4]
and byte [esi + edi + 1], 0
lea eax, [esi + eax + 1]
jmp 0x481145
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4812fb
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jle 0x48131a
cmp byte [eax + esi], 0x40
je 0x481319
dec eax
jmp 0x48130c
inc eax
add eax, esi
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x48132a
push 2
jmp 0x48135f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov cl, byte [eax]
mov byte [ebp + 8], cl
mov cl, byte [eax + 1]
mov byte [ebp + 9], cl
mov cl, byte [eax + 2]
mov al, byte [eax + 3]
mov byte [ebp + 0xa], cl
mov byte [ebp + 0xb], al
push dword [ebp + 8]
call sub.WSOCK32.dll_inet_ntoa
mov esi, eax
test esi, esi
je 0x481326
push esi
call edi
inc eax
cmp eax, dword [ebp + 0x10]
jle 0x481362
push 1
pop eax
jmp 0x48136e
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc