joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f5a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x4b6966
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0049d698
mov eax, dword [ebx + 0x1a5]
cmp eax, 5
je 0x42f5dd
cmp eax, 7
je 0x42f5dd
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, edx
jmp 0x42f7d5
cmp dword [ebp + 0xc], 0
je 0x42f636
cmp dword [ebx + 0x1a5], 5
jne 0x42f611
push 0
push 0x40a
push 1
push 1
push ebx
call fcn.0042e3ca
add esp, 0x14
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x42f7d5
push 0
push 0x40c
push 0
push 1
push ebx
call fcn.0042e3ca
add esp, 0x14
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, edx
jmp 0x42f7d5
cmp dword [ebx + 0x1a5], 7
jne 0x42f737
cmp dword [ebx + 0x74], 0
jne 0x42f66e
push 0
push 0x40d
push 0
push 0
push ebx
call fcn.0042e3ca
add esp, 0x14
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x42f7d5
cmp byte [0x4b6955], 0
jne 0x42f694
mov word [ebp - 0x14], 8
push 0x4d2d8e
call fcn.004aa26c
pop ecx
inc dword [ebp - 8]
dec dword [ebp - 8]
inc byte [0x4b6955]
push 0x4d2d8e
lea edx, [ebx + 0x64]
push edx
call fcn.004076e8
mov eax, dword [0x4d2d8e]
add esp, 8
cmp dword [0x4c0168], 0
mov edi, dword [ebx + 0x34]
mov esi, dword [eax + 2]
jne 0x42f6c5
push esi
push edi
call fcn.0045704d
add esp, 8
jmp 0x42f6cf
push esi
push edi
call fcn.0045bfdc
add esp, 8
test eax, eax
je 0x42f700
cmp eax, 0x10
je 0x42f700
cmp eax, 0x1a
je 0x42f700
push 0
push 0x40c
push 0
push 1
push ebx
call fcn.0042e3ca
add esp, 0x14
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x42f7d5
test eax, eax
je 0x42f709
cmp eax, 0x1a
jne 0x42f729
mov ecx, dword [0x4d2d8e]
mov eax, dword [ecx + 6]
add eax, 2
add dword [ebx + 0x90], eax
push 0
add ebx, 0x64
push ebx
call fcn.004074a0
add esp, 8
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
jmp 0x42f7d5
mov edx, dword [ebx + 0x9c]
lea eax, [ebp - 0x28]
add dword [ebx + 0x90], edx
xor ecx, ecx
mov dword [ebx + 0x9c], ecx
push 0
push eax
push 0x8000
push dword [ebx + 0x84]
push dword [ebx + 0x98]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 0x28], 0
je 0x42f7ab
mov eax, dword [ebx + 0x84]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea esi, [ebx + 0x9c]
cmp dword [0x4c0168], 0
mov ebx, dword [ebx + 0x34]
jne 0x42f79b
push esi
push edi
push dword [ebp - 0x2c]
push ebx
call fcn.00456d2f
add esp, 0x10
jmp 0x42f7cb
push esi
push edi
push dword [ebp - 0x2c]
push ebx
call fcn.0045be98
add esp, 0x10
jmp 0x42f7cb
push 0
push 0x40b
push 1
push 0
push ebx
call fcn.0042e3ca
add esp, 0x14
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x42f7d5
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433d33
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff784
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x5ad]
mov esi, dword [ebx + 0x17d]
cmp dword [esi], 0
je 0x433d7d
add esi, 0x34
mov eax, esi
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edi, [ebx + 0x5ad]
lea esi, [ebx + 0x7ad]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call sub.KERNEL32.dll_lstrcmpiA
test eax, eax
je 0x433dcf
push esi
call fcn.00454714
pop ecx
test eax, eax
je 0x433dcf
push esi
push dword [ebx + 0x179]
call fcn.0044ee57
add esp, 8
push esi
call fcn.004a1210
pop ecx
test eax, eax
je 0x433dcf
push dword [ebx + 0x179]
call fcn.0044ee15
pop ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
je 0x433e56
push esi
push edi
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x433e56
push 0xa0
lea eax, [ebp - 0x214]
push eax
push 0x432
push dword [ebx + 0x3c]
call sub.USER32.dll_LoadStringA
cmp dword [ebx + 0x195], 0
setne dl
and edx, 1
lea ecx, [ebx + 0x3ad]
push edx
push ecx
push esi
lea eax, [ebp - 1]
push eax
call fcn.0040559f
add esp, 0x10
push eax
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x414]
push ecx
call fcn.004a00a0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.0042d216
add esp, 8
jmp 0x433f2c
push 0xa0
lea edx, [ebp - 0x214]
push edx
push 0x433
push dword [ebx + 0x3c]
call sub.USER32.dll_LoadStringA
lea ecx, [ebp - 0x214]
push ecx
push ebx
call fcn.0042d216
add esp, 8
mov edx, edi
mov eax, dword [ebx + 0x17d]
cmp dword [eax], 0
je 0x433ea1
push pe_nt_image_headers32
push edx
mov ecx, dword [eax + 4]
add ecx, 0x68
push ecx
call fcn.0049ad4c
add esp, 0xc
mov edx, esi
mov eax, dword [ebx + 0x17d]
cmp dword [eax], 0
je 0x433ec6
push pe_nt_image_headers32
push edx
mov ecx, dword [eax + 4]
add ecx, 0x268
push ecx
call fcn.0049ad4c
add esp, 0xc
mov ebx, dword [ebx + 0x17d]
cmp dword [ebx], 0
je 0x433f2c
mov esi, dword [ebx + 4]
mov dword [esi], 0xf
xor eax, eax
mov dword [esi + 4], eax
push 0x468
push esi
lea edx, [ebp - 0x87c]
push edx
call fcn.0049ad4c
add esp, 0xc
lea ecx, [ebp - 0x87c]
push ecx
push dword [0x4bfb98]
call fcn.00453a33
add esp, 8
mov edi, eax
mov eax, dword [ebp - 0x818]
lea edx, [ebp - 0x814]
mov dword [ebx + 8], eax
push pe_nt_image_headers32
push edx
add ebx, 0x34
push ebx
call fcn.0049ad4c
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b328
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x64
push 0
lea eax, [ebp - 0x17c]
push eax
call fcn.0049adbc
add esp, 0xc
add edi, 0x4b
lea eax, [ebp - 0x118]
push edi
push 0xfa
push eax
push 0x4b810a
push str.LogFont
push 0x4b8115
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
je 0x43b40b
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x18]
push edx
push ecx
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x10]
push eax
push edx
lea ecx, [ebp - 0xc]
lea eax, [ebp - 8]
push ecx
push eax
lea edx, [ebp - 4]
lea ecx, [ebp - 0x118]
push edx
push str._d__d__d__d__d__d__98c
push ecx
call fcn.004a0114
add esp, 0x24
cmp eax, 6
jl 0x43b40b
cmp byte [ebp - 0x17c], 0
je 0x43b40b
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x17c]
mov dword [esi], eax
mov bl, 1
mov edx, dword [ebp - 8]
mov dword [esi + 0x10], edx
mov cl, byte [ebp - 0xc]
mov byte [esi + 0x14], cl
mov al, byte [ebp - 0x10]
mov byte [esi + 0x15], al
lea eax, [esi + 0x1c]
mov dl, byte [ebp - 0x14]
mov byte [esi + 0x16], dl
mov cl, byte [ebp - 0x18]
mov byte [esi + 0x17], cl
push esi
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
test bl, bl
jne 0x43b47e
push 0
push 0
push 0
push 0x4b82ff
call sub.GDI32.dll_CreateICA
mov ebx, eax
push 0x5a
push ebx
call sub.GDI32.dll_GetDeviceCaps
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x180]
fld xword [0x43b4a0]
fmulp st(1)
fstp dword [ebp - 0x1c]
push ebx
call sub.GDI32.dll_DeleteDC
fld dword [0x43b4ac]
fmul dword [ebp - 0x1c]
call fcn.004a56c0
mov dword [esi], eax
lea edx, [esi + 0x1c]
mov dword [esi + 0x10], 0x1f4
mov byte [esi + 0x14], 0
mov byte [esi + 0x15], 0
mov byte [esi + 0x16], 0
mov byte [esi + 0x17], 0
push esi
mov edi, edx
mov eax, edi
mov esi, 0x4b810f
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
xor edx, edx
mov dword [esi + 0xc], edx
mov dword [esi + 8], edx
mov dword [esi + 4], edx
mov byte [esi + 0x18], 4
mov byte [esi + 0x19], 0
mov byte [esi + 0x1a], 0
mov byte [esi + 0x1b], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f7d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc8c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x21]
mov ecx, dword [edx]
push dword [ecx + 0xc]
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x200]
push eax
call fcn.00454478
pop ecx
lea edx, [ebp - 0x200]
push edx
call fcn.0049af74
pop ecx
cmp eax, 2
jne 0x43f853
movsx ecx, byte [ebp - 0x1ff]
cmp ecx, 0x3a
jne 0x43f853
push 0x4b9bc5
lea eax, [ebp - 0x200]
push eax
call fcn.0049ae68
add esp, 8
lea edx, [ebp - 0x200]
push edx
mov ecx, dword [ebx + 0x21]
mov eax, dword [ecx]
push dword [eax + 0xc]
call sub.USER32.dll_SetWindowTextA
lea edx, [ebp - 0x200]
push edx
call fcn.0049af74
pop ecx
cmp eax, 3
jbe 0x43f8a8
lea ecx, [ebp - 0x200]
push ecx
call fcn.0049af74
pop ecx
movsx eax, byte [ebp + eax - 0x201]
cmp eax, 0x5c
jne 0x43f8a8
lea edx, [ebp - 0x200]
push edx
call fcn.0049af74
pop ecx
mov byte [ebp + eax - 0x201], 0
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x21]
mov edx, dword [eax]
push dword [edx + 0xc]
call sub.USER32.dll_SetWindowTextA
mov ecx, dword [ebx + 0x25]
push ecx
mov eax, dword [ecx + 0xc]
call dword [eax + 0x54]
pop ecx
lea edx, [ebp - 0x200]
push edx
call fcn.0049af74
pop ecx
movsx ecx, byte [ebp + eax - 0x201]
cmp ecx, 0x5c
je 0x43f8e1
push 0x4b9bc5
lea eax, [ebp - 0x200]
push eax
call fcn.0049ae68
add esp, 8
push 0x4b9c6b
lea edx, [ebp - 0x200]
push edx
call fcn.0049ae68
add esp, 8
mov edi, 0x10
lea esi, [ebp - 0x374]
lea eax, [ebp - 0x200]
push edi
push esi
push eax
call fcn.0049e4a8
add esp, 0xc
test eax, eax
jne 0x43f953
lea edi, [esi + 0x10]
push 0x4b9c6f
push edi
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
je 0x43f948
test byte [esi + 8], 0x10
je 0x43f948
lea eax, [esi + 0x10]
push eax
call fcn.004a5388
pop ecx
lea edx, [esi + 0x10]
push edx
mov ecx, dword [ebx + 0x25]
push ecx
mov eax, dword [ecx + 0xc]
call dword [eax + 0x5c]
add esp, 8
push esi
call fcn.0049e568
pop ecx
test eax, eax
je 0x43f915
push str.dontexis.ttt
push 0x4000
push 0x18d
mov edx, dword [ebx + 0x25]
mov ecx, dword [edx]
push dword [ecx + 0xc]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebx + 0x21]
mov edx, dword [eax]
push dword [edx + 0xc]
call sub.USER32.dll_GetWindowTextLengthA
push eax
push eax
push 0xb1
mov ecx, dword [ebx + 0x21]
mov eax, dword [ecx]
push dword [eax + 0xc]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
mov edx, dword [ebx + 0x21]
mov ecx, dword [edx]
push dword [ecx + 0xc]
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fdb4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
mov eax, 0x4b990c
push ebx
mov ebx, dword [ebp + 8]
call fcn.0049d698
push 0x4f
lea edx, [ebp - 0x78]
push edx
mov ecx, dword [ebx + 0x21]
mov eax, dword [ecx]
push dword [eax + 0xc]
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x78]
push edx
call fcn.00454478
pop ecx
mov word [ebp - 0x18], 8
lea ecx, [ebp - 0x78]
push ecx
lea eax, [ebp - 4]
push eax
call fcn.004aa30c
add esp, 8
lea edx, [ebp - 4]
inc dword [ebp - 0xc]
push 0xffffffffffffffff
push 0
push edx
push dword [ebx + 0x1d]
call fcn.004a9f54
add esp, 0x10
dec dword [ebp - 0xc]
push 2
lea ecx, [ebp - 4]
push ecx
call fcn.004aac40
add esp, 8
push ebx
call fcn.0048b0bf
pop ecx
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4429ee
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov ebx, 1
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.00442719
pop ecx
push ebx
push 0x4bb27d
push 0x4bb278
lea eax, [ebp - 0x120]
push eax
call fcn.004a00a0
add esp, 0x10
push dword [esi + 0x1e]
lea edx, [ebp - 0x104]
push 0xff
push edx
lea ecx, [ebp - 0x120]
push 0x4bb1d4
push ecx
push edi
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
je 0x442abb
movsx eax, byte [ebp - 0x104]
cmp eax, 0x44
je 0x442a5c
cmp eax, 0x41
jne 0x442ab5
movsx edx, byte [ebp - 0x103]
cmp edx, 0x2c
jne 0x442ab5
push 0x100
call fcn.004a78f4
pop ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push esi
push edi
mov esi, ecx
xor eax, eax
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push eax
lea edx, [esi + 0x27f]
push edx
call fcn.00403b78
add esp, 8
inc ebx
jmp 0x442a0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453a90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc9c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, str._s_d
push ebx
call fcn.00453bc1
pop ecx
mov esi, 1
push esi
lea eax, [edi + 5]
push eax
push edi
lea edx, [ebp - 0x24]
push edx
call fcn.004a00a0
add esp, 0x10
lea ecx, [ebx + 0x24]
lea eax, [ebp - 0xc4]
lea edx, [edi + 4]
push ecx
push 0xa0
push eax
push edx
lea ecx, [ebp - 0x24]
lea eax, [edi + 0x12]
push ecx
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
je 0x453bba
inc esi
lea edx, [ebp - 0xc4]
push edx
call sub.KERNEL32.dll_LoadLibraryA
mov dword [ebp - 8], eax
test eax, eax
jne 0x453b1d
push 0xa0
lea edx, [ebp - 0x164]
push edx
push 0x7ff
push dword [ebx + 0x123]
call sub.USER32.dll_LoadStringA
jmp 0x453b7f
lea ecx, [edi + 0x1b]
push ecx
push dword [ebp - 8]
call sub.KERNEL32.dll_GetProcAddress
mov dword [ebp - 4], eax
test eax, eax
jne 0x453b56
push 0xa0
lea edx, [ebp - 0x164]
push edx
push 0x800
push dword [ebx + 0x123]
call sub.USER32.dll_LoadStringA
push dword [ebp - 8]
call sub.KERNEL32.dll_FreeLibrary
jmp 0x453b7f
push 0xa0
lea ecx, [ebp - 0x164]
push ecx
push 0x7fe
push dword [ebx + 0x123]
call sub.USER32.dll_LoadStringA
lea eax, [ebp - 8]
push eax
push ebx
call fcn.00453e60
add esp, 8
lea edx, [ebp - 0xc4]
push edx
lea ecx, [ebp - 0x164]
push ecx
lea eax, [ebp - 0x364]
push eax
call fcn.004a00a0
add esp, 0xc
lea edx, [ebp - 0x364]
push edx
push 0x12
push 0x403
push dword [ebx + 0x127]
call sub.USER32.dll_SendMessageA
jmp 0x453ab0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45497c
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], pe_nt_image_headers32
mov byte [ebp - 0x20c], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.txtfile_shellopencommand
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x454aa2
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x20c]
push ecx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x454a9a
cmp dword [ebp - 0xc], 2
jne 0x454a21
push pe_nt_image_headers32
lea edx, [ebp - 0x40c]
push edx
lea ecx, [ebp - 0x20c]
push ecx
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
xor eax, eax
lea edi, [ebp - 0x40c]
or ecx, 0xffffffff
lea esi, [ebp - 0x20c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4c0067
lea eax, [ebp - 0x20c]
push eax
call fcn.0049b091
add esp, 8
mov esi, eax
test eax, eax
je 0x454a9a
lea edi, [esi + 2]
push edi
call fcn.0049af74
pop ecx
inc eax
push eax
push edi
push esi
call fcn.0049ad70
add esp, 0xc
push esi
call fcn.0049af74
pop ecx
inc eax
push eax
push esi
push dword [ebp + 8]
call fcn.0049af74
pop ecx
add eax, esi
push eax
call fcn.0049ad70
add esp, 0xc
push dword [ebp + 8]
call fcn.0049af74
pop ecx
push eax
push dword [ebp + 8]
push esi
call fcn.0049ad4c
add esp, 0xc
push 1
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jbe 0x454a9a
mov bl, 1
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45512e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
lea ebx, [ebp + 8]
mov eax, 0x4c01b8
call fcn.0049d698
mov word [ebp - 0x14], 8
mov edx, dword [ebx]
mov dword [edx], 0x4c19f8
mov ecx, dword [ebx]
mov eax, dword [0x4c014c]
test eax, eax
mov dword [ecx + 0x64], eax
mov edx, dword [ebx]
mov dword [0x4c014c], edx
je 0x45516b
mov ecx, dword [ebx]
mov dword [eax + 0x68], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x68], edx
xor ecx, ecx
mov dword [0x4c0150], ecx
mov eax, dword [ebx]
mov edx, dword [ebp + 0x1c]
mov dword [eax + 8], edx
cmp dword [0x4c0158], 0
jne 0x455194
push dword [ebp + 0xc]
call fcn.004553c4
pop ecx
mov ecx, dword [ebx]
mov eax, dword [0x4c0160]
mov dword [ecx + 4], eax
inc dword [0x4c0160]
inc dword [0x4c015c]
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x4c], ecx
mov eax, dword [ebx]
mov dword [eax + 0x48], ecx
mov edx, dword [ebx]
mov dword [edx + 0x44], 1
mov eax, dword [ebx]
mov dword [eax + 0x1c], 0xffffffff
mov edx, dword [ebx]
mov dword [edx + 0x20], 0x78
mov ecx, dword [ebx]
mov dword [ecx + 0x24], 0x78
mov eax, dword [ebx]
mov dword [eax + 0x28], 0xffffffff
mov edx, dword [ebx]
mov dword [edx + 0x2c], 0x78
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x30], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x34], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x38], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x3c], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x40], ecx
mov eax, dword [ebx]
mov dword [eax + 0xc], 0xffffffff
mov edx, dword [ebx]
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0x10], ecx
mov eax, dword [ebx]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x18], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x94], ecx
mov eax, dword [ebx]
mov dword [eax + 0x90], ecx
mov eax, dword [ebx]
mov dword [eax + 0x106], ecx
mov eax, dword [ebx]
mov dword [eax + 0xde], ecx
mov eax, dword [ebx]
mov dword [eax + 0xba], ecx
mov eax, dword [ebx]
mov dword [eax + 0x80], ecx
mov edx, dword [ebx]
xor eax, eax
mov dword [edx + 0x10a], eax
mov edx, dword [ebx]
mov dword [edx + 0xe2], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x12a], eax
mov edx, dword [ebx]
mov dword [edx + 0xfa], eax
mov ecx, dword [ebx]
mov eax, 0x1000
mov dword [ecx + 0x132], eax
mov edx, dword [ebx]
mov dword [edx + 0x102], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0xb6], eax
mov edx, dword [ebx]
mov dword [edx + 0xc2], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0xd2], eax
mov edx, dword [ebx]
mov dword [edx + 0xce], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x74], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x6c], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x7c], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x54], eax
mov edx, dword [ebx]
mov dword [edx + 0x50], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x58], eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4553c4
Capabilities:
Hide graphical window
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x4c0154], ebx
cmp dword [0x4c0168], 0
jne 0x4553ee
push 0x4d3058
push 0x101
call sub.WSOCK32.dll_WSAStartup
jmp 0x4553ff
push 0x4d3058
push 0x101
push 0
call fcn.0045aca4
test eax, eax
jne 0x4554f0
cmp word [0x4d3058], 0x101
jne 0x45541e
mov dword [0x4c0158], 1
jmp 0x45543d
cmp dword [0x4c0168], 0
jne 0x455431
call sub.WSOCK32.dll_WSACleanup
jmp 0x4554f0
push 0
call fcn.0045ad3c
jmp 0x4554f0
xor eax, eax
xor edx, edx
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x24], sym.serv_u32.exe__RWinSocket_DispatchProc_qqsp6HWND__uiuil
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x28]
mov dword [ebp - 4], str.RSockWin
push edx
call sub.USER32.dll_RegisterClassA
push 0
push dword [0x4c0154]
push 0
push 0
push 1
push 1
push 0x80000000
push 0x80000000
push 0x400000
push str.RWinSocket
push str.RSockWin
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov dword [0x4c0164], ebx
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 0x45933f
push 0x3e8
push 0
push 0
call sub.USER32.dll_SetTimer
mov dword [0x4d3054], eax
push 1
push 0x4d31e6
call fcn.00403dc0
add esp, 8
push 1
push 0x4d3206
call fcn.00403a98
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456e27
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
cmp dword [0x4c0158], 0
jne 0x456e48
mov eax, 8
jmp 0x456f78
cmp dword [ebx + 0x94], 0
je 0x456e5b
mov eax, 0x10
jmp 0x456f78
cmp dword [ebx + 0x106], 0
je 0x456e6e
mov eax, 0x10
jmp 0x456f78
cmp dword [ebx + 0x80], 0
je 0x456e87
cmp dword [ebx + 0x10], 7
jne 0x456e87
mov eax, 0x10
jmp 0x456f78
cmp dword [ebx + 0x90], 0
jne 0x456e9a
mov eax, 0x11
jmp 0x456f78
test eax, eax
jg 0x456ea5
xor eax, eax
jmp 0x456f78
cmp dword [ebx + 0xc], 0xffffffff
jne 0x456eb5
mov eax, 0x11
jmp 0x456f78
mov ecx, edx
and ecx, 1
mov dword [ebx + 0x10e], ecx
mov dword [ebx + 0x106], 1
cmp dword [ebx + 0x44], 0
je 0x456eda
xor ecx, ecx
mov dword [ebx + 0x48], ecx
xor ecx, ecx
mov dword [ebx + 0x3c], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x11e], ecx
mov dword [ebx + 0x11a], ecx
mov dword [ebx + 0x126], eax
mov dword [ebx + 0x122], eax
mov dword [ebp - 4], 1
test dl, 2
je 0x456f3e
cmp dword [ebx + 0x10], 7
jne 0x456f3e
mov eax, dword [ebx + 0xc]
mov edx, ebx
cmp dword [0x4c0168], 0
jne 0x456f2a
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x456f3e
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
push edx
call fcn.0045a663
xor eax, eax
mov dword [ebx + 0x12a], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x12e], eax
test eax, eax
je 0x456f57
xor edx, edx
mov dword [eax], edx
mov dword [ebx + 0x116], 2
push 1
push dword [ebx + 0xc]
push 0x400
push dword [0x4c0164]
call sub.USER32.dll_PostMessageA
xor eax, eax
pop ebx
pop ecx
pop ebp
ret
Function at 0x45714a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x4c0158], 0
jne 0x45716a
mov eax, 8
jmp 0x45729e
cmp dword [ebx + 0x10], 7
je 0x45717a
mov eax, 7
jmp 0x45729e
cmp dword [ebx + 0x94], 0
je 0x45718d
mov eax, 0x10
jmp 0x45729e
cmp dword [ebx + 0x80], 0
je 0x4571a0
mov eax, 0x10
jmp 0x45729e
cmp dword [ebx + 0x106], 0
je 0x4571b3
mov eax, 0x10
jmp 0x45729e
cmp dword [ebx + 0x90], 0
jne 0x4571c6
mov eax, 0x11
jmp 0x45729e
cmp esi, 3
jge 0x4571d5
mov eax, 0x14
jmp 0x45729e
cmp dword [ebx + 0xc], 0xffffffff
jne 0x4571e5
mov eax, 0x11
jmp 0x45729e
push esi
call fcn.004a78f4
mov edi, eax
pop ecx
mov dword [ebx + 0x11a], edi
mov dword [ebx + 0x11e], edi
mov dword [ebx + 0x126], esi
xor eax, eax
mov dword [ebx + 0x122], esi
mov dword [ebx + 0x12a], eax
mov dword [ebx + 0x106], 1
mov dword [ebx + 0x10a], 1
xor edx, edx
xor ecx, ecx
mov dword [ebx + 0x112], edx
mov dword [ebx + 0x10e], ecx
cmp dword [ebx + 0x44], 0
je 0x45723d
xor eax, eax
mov dword [ebx + 0x3c], eax
mov dword [ebp - 4], 1
test byte [ebp + 0x10], 2
je 0x457287
cmp dword [ebx + 0x10], 7
jne 0x457287
mov eax, dword [ebx + 0xc]
mov edx, ebx
cmp dword [0x4c0168], 0
jne 0x457273
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x457287
push 4
lea ecx, [ebp - 4]
push ecx
push 8
push 0xffff
push eax
push edx
call fcn.0045a663
push 1
push dword [ebx + 0xc]
push 0x400
push dword [0x4c0164]
call sub.USER32.dll_PostMessageA
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret