joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421840
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, ecx
call fcn.005366c0
mov esi, eax
test esi, esi
je 0x421924
mov ecx, dword [esi + 0xbb4]
call fcn.004dbea0
test eax, eax
je 0x421924
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
mov eax, dword [esi + 0x864]
cmp edi, eax
je 0x421889
cmp edi, dword [esi + 0x868]
jne 0x421923
cmp edi, eax
jne 0x421891
mov eax, dword [esi + 0x6d0]
jmp 0x421897
mov eax, dword [esi + 0x6d4]
test eax, eax
mov ecx, dword [esi + 0xbb4]
mov dword [ecx + 0x1fa8], 0
je 0x4218be
jmp 0x4218b0
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jne 0x421923
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x4218b0
push 0x5994c8
push 0x3e6
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x574b28
push 0x5994c8
call fcn.00563db0
add esp, 8
test eax, eax
je 0x4218ea
mov byte [eax], 0
mov al, byte [0x5994c8]
test al, al
je 0x421923
mov edx, 0x5994c8
mov ecx, ebx
call fcn.00421450
cmp edi, dword [esi + 0x864]
jne 0x42190f
mov esi, dword [esi + 0x6d0]
jmp 0x421915
mov esi, dword [esi + 0x6d4]
test esi, esi
je 0x421923
mov edx, dword [esi + 0x44]
mov dword [edx + 0x1c], 1
pop edi
pop esi
pop ebx
ret
Function at 0x429160
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, edx
call fcn.005366c0
mov edi, eax
test edi, edi
mov dword [esp + 0xc], edi
je 0x4293a0
push ebp
push 0x180
push 0x40
push 0x4301
push esi
call fcn.0056d6d9
mov ebp, eax
add esp, 0x10
test ebp, ebp
jge 0x4291a4
xor ecx, ecx
call fcn.0041c8e0
pop ebp
pop edi
pop esi
add esp, 0xc
ret
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x180
mov dword [esp + 0x18], eax
mov eax, dword [edi]
push 0x5990e0
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor edx, edx
mov ecx, 0x57c
call fcn.0041c9e0
push eax
push 0x5990e0
call fcn.00563db0
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
je 0x429221
add eax, 4
mov ecx, eax
mov dword [esp + 0xc], eax
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x429200
sub ecx, esi
push ecx
push eax
push ebp
call fcn.0056cc84
push 1
push 0x575404
push ebp
call fcn.0056cc84
add esp, 0x18
mov edx, dword [edi + 0x86c]
push ebx
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
push ebx
push 0x189
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x42938a
jmp 0x429250
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42938a
mov edx, 0x5990e0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x429263
cmp byte [0x5990e0], 0x20
mov eax, 0x5990e0
mov dword [esp + 0x10], eax
jne 0x42928a
nop
inc eax
mov dword [esp + 0x10], eax
cmp byte [eax], 0x20
je 0x429280
cmp byte [eax], 0
je 0x429368
push 9
push eax
call fcn.00563730
mov esi, eax
add esp, 8
test esi, esi
je 0x429368
mov byte [esi], 0
mov edx, dword [esp + 0x10]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4292b4
sub eax, edi
push eax
push edx
push ebp
call fcn.0056cc84
mov al, byte [esi + 1]
add esp, 0xc
inc esi
test al, al
je 0x429354
push 9
push esi
mov dword [esp + 0x18], esi
call fcn.00563730
mov esi, eax
add esp, 8
test esi, esi
je 0x4292ec
mov byte [esi], 0
push 1
push 0x575258
push ebp
call fcn.0056cc84
mov edx, dword [esp + 0x1c]
mov eax, edx
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429305
sub eax, edi
push eax
push edx
push ebp
call fcn.0056cc84
add esp, 0xc
test esi, esi
je 0x429354
mov al, byte [esi + 1]
inc esi
test al, al
je 0x429354
push 1
push 0x575258
push ebp
call fcn.0056cc84
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429340
sub eax, edx
push eax
push esi
push ebp
call fcn.0056cc84
add esp, 0xc
push 1
push 0x575404
push ebp
call fcn.0056cc84
mov edi, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [edi + 0x86c]
lea eax, [esp + 0x10]
push eax
inc ebx
push ebx
push 0x189
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x429250
push ebp
call fcn.00569e00
mov edx, dword [esp + 0x1c]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_SetCursor]
pop ebx
pop ebp
pop edi
pop esi
add esp, 0xc
ret
Function at 0x429880
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3f0
push esi
mov esi, ecx
call fcn.004dbea0
test eax, eax
je 0x429a97
mov eax, dword [esi + 0x184c]
push ebx
xor ebx, ebx
push ebp
xor ebp, ebp
cmp eax, ebx
push edi
mov dword [esi + 0x1850], 2
mov dword [esi + 0x196c], ebx
mov dword [esi + 0x1b90], ebx
mov dword [esi + 0x1b94], ebx
mov dword [esi + 0x1960], ebx
mov dword [esi + 0x1964], ebx
mov dword [esi + 0x1968], ebx
jne 0x4298f2
push esi
push ebx
push ebx
mov edx, 4
mov ecx, str.Channels_List
call fcn.0053c810
mov dword [esi + 0x184c], eax
mov ebp, 1
mov ecx, dword [esi + 0x184c]
call fcn.005366c0
mov edi, eax
cmp edi, ebx
je 0x429a94
mov eax, dword [edi + 0x86c]
push ebx
push ebx
push 0x184
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [edi + 0x6c8]
call fcn.004c29d0
lea ecx, [edi + 0x6b4]
mov dword [esp + 0x10], ecx
call fcn.004c29d0
cmp ebp, ebx
je 0x429945
mov ecx, dword [edi]
mov edx, 4
call fcn.00492410
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x42995f
mov edx, dword [edi]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42996c
mov ecx, edi
mov dword [edi + 0x708], ebx
call fcn.0051c6d0
xor edx, edx
mov ecx, 0xdd0
call fcn.0041c9e0
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x594094]
mov ecx, dword [esi]
call fcn.004fb620
mov ecx, dword [0x59409c]
push ecx
xor edx, edx
mov ecx, 0xdd1
call fcn.0041c9e0
mov ecx, dword [esi]
mov edx, eax
call fcn.004fb730
mov edx, dword [0x594094]
mov ecx, dword [esi]
call fcn.004fb620
cmp dword [esi + 0x1858], ebx
je 0x429a94
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esi + 0x185c]
push edx
push 0x5924f8
lea eax, [esp + 0x20]
push 0x574904
push eax
call edi
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x1854], eax
je 0x429a94
push ebx
call fcn.00563e36
add esp, 4
mov ecx, eax
call fcn.00520af0
push eax
lea edx, [esi + 0x10c2]
push edx
lea eax, [esp + 0x20]
push 0x5755a8
push eax
call edi
mov edi, dword [esp + 0x20]
mov ecx, dword [edi]
add esp, 0x10
push ebx
lea edx, [esp + 0x1c]
call fcn.004c2560
mov dword [edi], eax
lea edi, [esp + 0x18]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x429a50
mov cx, word [0x574b0c]
mov dl, byte [0x574b0e]
mov word [edi], cx
lea eax, [esp + 0x18]
mov byte [edi + 2], dl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x429a72
push ebx
sub eax, edx
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi + 0x1854]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x3f0
ret
Function at 0x42ac50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x5925fc]
test eax, eax
push esi
mov esi, ecx
jne 0x42ac6f
call fcn.004dbf30
test eax, eax
je 0x42ac6f
mov ecx, dword [eax + 0x1850]
test ecx, ecx
je 0x42ac77
xor ecx, ecx
pop esi
jmp fcn.0041c8e0
test esi, esi
mov ecx, dword [0x5a1b00]
jl 0x42ac86
cmp esi, 3
jle 0x42ac88
xor esi, esi
cmp esi, 1
mov dword [0x599094], esi
je 0x42acb1
mov edx, dword [0x5a1b0c]
test edx, edx
je 0x42acb1
cmp edx, dword [eax + 0x184c]
jne 0x42acb1
mov ecx, edx
mov dword [0x599094], 2
push eax
push 0x42a050
mov edx, 0x8c
call fcn.00464b70
mov dword [0x5925fc], 0
mov dword [0x599094], 0
pop esi
ret

Function at 0x42af90
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x592640]
sub esp, 0x3e8
test eax, eax
push ebx
push esi
mov ebx, edx
mov esi, ecx
je 0x42b10c
lea esp, [esp]
cmp esi, eax
je 0x42afc9
mov eax, dword [eax + 0x88c]
test eax, eax
jne 0x42afb0
pop esi
pop ebx
add esp, 0x3e8
ret 8
mov ecx, dword [esi]
push ebp
call fcn.004dbfb0
mov ebp, eax
test ebp, ebp
je 0x42b10b
mov al, byte [esp + 0x3fc]
test al, 1
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x42b034
mov eax, dword [esi + 0x540]
test eax, eax
push ebx
je 0x42b00b
lea eax, [esi + 0x3f0]
push eax
push str.NOTICE__s_:DCC_Fserve___s__n
lea ecx, [esp + 0x1c]
push ecx
jmp 0x42b01c
lea edx, [esi + 0x3f0]
push edx
push str.NOTICE__s_:DCC_Chat___s__n
lea eax, [esp + 0x1c]
push eax
call edi
add esp, 0x10
push ebp
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.0053ec90
mov al, byte [esp + 0x400]
test al, 2
je 0x42b060
movzx ecx, word [esi + 0x51c]
mov edx, dword [esp + 0x3fc]
push ecx
push edx
lea eax, [esi + 0x3f0]
push eax
lea ecx, [esp + 0x1c]
push 0x575a34
push ecx
call edi
add esp, 0x14
jmp 0x42b0d9
test al, 4
je 0x42b09b
mov edx, dword [esi + 0x52c]
movzx eax, word [esi + 0x51c]
push edx
push eax
lea ecx, [esi + 0x4b8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea edx, [esi + 0x3f0]
push edx
push 0x575a0c
lea eax, [esp + 0x24]
push eax
jmp 0x42b0d4
test al, 8
je 0x42b0e5
mov ecx, dword [esi + 0x530]
movzx edx, word [esi + 0x51c]
push ecx
push edx
lea eax, [esi + 0x4b8]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea ecx, [esi + 0x3f0]
push ecx
push 0x575a0c
lea edx, [esp + 0x24]
push edx
call edi
add esp, 0x18
lea ecx, [esp + 0x10]
xor edx, edx
push ebp
call fcn.0053ec90
mov eax, dword [0x594090]
push eax
xor edx, edx
mov ecx, 0x517
mov dword [0x589b90], 0
call fcn.0041c9e0
mov ecx, dword [esi]
mov edx, eax
call fcn.004fb730
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x3e8
ret 8
Function at 0x42be40
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
push edi
mov edi, edx
test edi, edi
mov esi, ecx
je 0x42bf5c
cmp byte [edi], 0
je 0x42bf5c
call fcn.0042ae80
test eax, eax
je 0x42bf51
mov edx, 0x3e7
lea ecx, [esp + 8]
call fcn.0041e210
lea edx, [esp + 8]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42be80
mov eax, dword [0x59f668]
test eax, eax
je 0x42be9c
lea ecx, [esp + 8]
call fcn.00512d60
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42bea3
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x884]
cmp eax, 0xffffffff
mov dword [esi + 0x878], 0
mov dword [esi + 0x87c], 0
je 0x42bf51
push 0
push edi
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, edi
je 0x42bf5c
mov eax, dword [esi + 0x540]
test eax, eax
jne 0x42bf51
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42bf3c
mov ecx, dword [esi + 0x874]
push 0
lea edx, [esp + 0xc]
call fcn.004c2560
test eax, eax
je 0x42bf16
mov dword [esi + 0x874], eax
mov edx, dword [0x5a1b00]
mov eax, dword [esi + 0x884]
push 0x23
push 0x801d
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
xor edx, edx
mov ecx, 0x528
call fcn.0041c9e0
mov edx, eax
mov ecx, esi
call fcn.0042b4a0
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3e8
ret
Function at 0x42cb90
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x3e8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x42cd1a
cmp dword [esi + 0x520], 3
je 0x42cbba
cmp dword [esi + 0x534], 2
jne 0x42cd1a
mov edx, dword [esi + 0x884]
push 1
push 1
mov ecx, 0x801d
mov dword [esi + 0x878], ebx
mov dword [esi + 0x87c], ebx
call fcn.0053f9b0
test eax, eax
jne 0x42cd1a
push ebp
push edi
mov ecx, dword [esi + 0x880]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x880], ecx
jl 0x42cc19
mov edx, dword [esi + 0x884]
push ebx
push 1
mov ecx, 0x801d
mov dword [esi + 0x880], ebx
call fcn.0053f9b0
test eax, eax
jne 0x42cd18
mov ecx, dword [esi + 0x884]
push ebx
push 0x3e6
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x42ccdd
cmp edi, ebx
jle 0x42cd0c
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x10], bl
jle 0x42cbe4
mov edi, edi
mov al, byte [esp + ebp + 0x10]
cmp al, 9
je 0x42cc9d
cmp al, 0xd
je 0x42cc9d
cmp al, 0xa
jne 0x42cc6c
mov edx, dword [esi + 0x3ec]
mov byte [edx + esi + 4], bl
jmp 0x42cc90
mov ecx, dword [esi + 0x3ec]
mov byte [ecx + esi + 4], al
mov edx, dword [esi + 0x3ec]
inc edx
mov eax, edx
cmp eax, 0x3b5
mov dword [esi + 0x3ec], edx
jl 0x42cc9d
mov byte [eax + esi + 4], bl
mov ecx, esi
mov dword [esi + 0x3ec], ebx
call fcn.0042c840
mov eax, dword [0x592640]
cmp eax, ebx
je 0x42cbe4
lea ebx, [ebx]
cmp esi, eax
je 0x42ccc3
mov eax, dword [eax + 0x88c]
cmp eax, ebx
jne 0x42ccb0
jmp 0x42cbe4
cmp dword [esi + 0x520], ebx
je 0x42cbe4
inc ebp
cmp ebp, edi
jl 0x42cc50
jmp 0x42cbe4
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x42cd18
xor edx, edx
mov ecx, 0x527
call fcn.0041c9e0
mov edx, eax
mov ecx, esi
call fcn.0042b4a0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
mov edx, 0x574b10
mov ecx, esi
call fcn.0042b4a0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
Function at 0x42e800
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ecx
push 1
mov dword [esi], 0
call edi
test ah, ah
jns 0x42e81b
or dword [esi], 1
push 2
call edi
test ah, ah
jns 0x42e826
or dword [esi], 2
push 4
call edi
test ah, ah
jns 0x42e831
or dword [esi], 0x10
push 0x11
call edi
test ah, ah
jns 0x42e83c
or dword [esi], 8
push 0x10
call edi
test ah, ah
jns 0x42e847
or dword [esi], 4
pop edi
pop esi
ret

Function at 0x42e850
Capabilities:
Log keystrokes via polling

Disassembly:
movzx eax, dx
shr edx, 0x10
cmp ecx, 7
mov dword [0x5894e8], eax
mov dword [0x5894ec], edx
mov dword [0x592ccc], 0
ja 0x42e877
mov dword [0x592ccc], ecx
ret
mov ecx, 0x592ccc
jmp fcn.0042e800
Function at 0x433ca0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5941f4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5941f4]
test eax, eax
je 0x433cbe
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x5941f4], 0
ret

Function at 0x434e10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5941f4]
test eax, eax
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x434e24
pop edi
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call ebx
mov eax, dword [0x5941f4]
test eax, eax
je 0x434e41
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x433cd0
push esi
mov dword [0x5941f4], 0
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [0x5a1afc]
push 0xb4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp edi, 1
mov ecx, eax
mov dword [0x5941f4], ecx
jne 0x434e81
mov edx, esi
call fcn.00433a90
jmp 0x434e8b
mov edx, 0x1e
call fcn.00422290
mov ecx, dword [0x5941f4]
push 8
push ecx
call ebx
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
pop edi
mov dword [0x5941f8], esi
mov eax, 1
pop esi
ret
Function at 0x448140
Capabilities:
Get hostname
Set socket configuration

Disassembly:
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 4]
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, edx
je 0x448169
cmp byte [eax], 0x2d
jne 0x448229
push 0x68
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x4481c3
push 0x5a
push edi
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x4482de
mov esi, dword [esp + 0x14]
lea ebp, [esi + 0x840]
mov edx, ebp
mov dword [esi + 0x908], ebx
mov byte [esi + 0x8a4], bl
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x448196
mov ecx, ebp
call fcn.005191e0
mov ecx, dword [esi]
push 0x33
push ebx
push ebp
mov edx, 0x574b10
call fcn.0046d660
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
mov eax, dword [ebp + 4]
push 0x75
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x448229
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.004dc0f0
test eax, eax
jne 0x4481f8
mov edx, dword [ebp]
push 0xc
push ebx
xor ecx, ecx
call fcn.00475f10
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov edx, dword [esi + 0xf28]
mov ecx, dword [esi]
imul edx, edx, 0x64
push ebx
push ebx
push 0xa
push ebx
push ecx
push ebx
push 5
push ebx
lea ecx, [edx + esi + 0xdfc]
push ebx
xor edx, edx
call fcn.0052fff0
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
ret 4
mov edx, dword [ebp + 4]
cmp edx, ebx
je 0x4482de
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x448240
sub eax, esi
cmp eax, 0x5a
jbe 0x448251
mov byte [edx + 0x5a], bl
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + 4]
lea ecx, [edi + 0x840]
mov esi, ecx
mov al, byte [edx]
inc edx
mov byte [esi], al
inc esi
cmp al, bl
jne 0x448260
call fcn.005191e0
mov edx, dword [ebp + 8]
cmp edx, ebx
je 0x4482de
mov eax, edx
lea esi, [eax + 1]
jmp 0x448280
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x448280
sub eax, esi
cmp eax, 0x5a
jbe 0x448291
mov byte [edx + 0x5a], bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [edi + 0x908], eax
jne 0x4482be
mov dword [edi + 0x908], ebx
mov byte [edi + 0x8a4], bl
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [edi + 0x908], eax
mov ecx, dword [ebp + 8]
lea edx, [edi + 0x8a4]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x4482d4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x44ee20
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x44f066
cmp byte [eax], 0x2d
jne 0x44f066
push 0x6f
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x44ee4d
mov edx, 1
jmp 0x44ee61
mov eax, dword [esi + 4]
push 0x70
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x44ee6c
xor edx, edx
mov ecx, dword [0x5a1b00]
call fcn.00536a60
mov ecx, dword [esi + 4]
push 0x6d
push ecx
call fcn.00563730
add esp, 8
test eax, eax
je 0x44ee93
mov edx, dword [0x5a13f4]
test edx, edx
sete dl
dec dl
and dl, 6
add dl, 0x6e
mov byte [eax], dl
mov eax, dword [esi + 4]
push 0x6e
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x44eef3
mov ecx, dword [0x5a1b00]
mov esi, dword [0x5a13f4]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 7
push ecx
mov dword [0x5a13f4], 0
call edi
mov eax, dword [0x5a13f0]
test eax, eax
je 0x44eee5
mov ecx, 2
call fcn.0052b760
mov edx, dword [0x5a1b00]
push 8
push edx
call edi
pop edi
mov dword [0x5a13f4], esi
mov eax, 1
pop esi
ret
mov eax, dword [esi + 4]
push 0x78
push eax
call fcn.00563730
add esp, 8
test eax, eax
je 0x44ef4b
mov ecx, 2
call fcn.0052b760
mov ecx, dword [0x5a1b00]
push 3
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x5a1b00]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x5a1b00]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [0x5a1b00]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
pop esi
ret
mov edx, dword [esi + 4]
push 0x73
push edx
call fcn.00563730
add esp, 8
test eax, eax
je 0x44efa2
mov ecx, 2
call fcn.0052b760
mov eax, dword [0x5a1b00]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x5a1b00]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x5a1b00]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5a1b00]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 4]
push 0x72
push ecx
call fcn.00563730
add esp, 8
test eax, eax
je 0x44f006
mov ecx, 2
call fcn.0052b760
mov edx, dword [0x5a1b00]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push edx
call esi
mov eax, dword [0x5a1b00]
push 9
push eax
call esi
mov ecx, dword [0x5a1b00]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x5a1b00]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5a1b00]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 4]
push 0x74
push ecx
call fcn.00563730
add esp, 8
test eax, eax
je 0x44f066
mov esi, dword [0x5a13f4]
mov ecx, 1
mov dword [0x5a13f4], 1
call fcn.0052b760
test eax, eax
je 0x44f052
mov edx, dword [0x5a1b00]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x5a13f4], esi
mov eax, 1
pop esi
ret
mov eax, dword [0x5a1b00]
push 7
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x5a13f4], esi
mov eax, 1
pop esi
ret
Function at 0x450150
Capabilities:
Get graphical window text

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
test ecx, ecx
mov esi, edx
je 0x4502af
cmp byte [ecx], 0x40
jne 0x450257
mov edx, dword [esp + 0x14]
call fcn.004dc5a0
mov ebp, eax
test ebp, ebp
jne 0x45018c
mov edx, dword [edi]
push 7
push eax
xor ecx, ecx
call fcn.00475f10
pop edi
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 0x744]
test ecx, ecx
lea eax, [ebp + 8]
je 0x45019a
inc eax
push eax
push 0x575534
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
mov edx, esi
mov ecx, 2
call fcn.004ed300
mov edx, 0xf
mov ecx, esi
call fcn.00518d60
mov dl, 0xa
mov ecx, esi
call fcn.00518f70
mov dl, 0xd
mov ecx, esi
call fcn.00518f70
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4501e0
sub eax, edx
mov edi, eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, edi
jne 0x450241
mov edi, dword [esp + 0x10]
mov ecx, dword [ebp]
push 0x3b5
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, esi
nop
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x450234
test cl, cl
je 0x450230
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x450234
add eax, 2
add edi, 2
test cl, cl
jne 0x450210
xor eax, eax
jmp 0x450239
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4502ca
mov eax, dword [ebp]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
push 0x576880
push ecx
call fcn.00572b46
add esp, 8
neg eax
sbb eax, eax
mov ecx, dword [edi + eax*4 + 8]
add eax, 2
test ecx, ecx
je 0x4502af
push edi
mov edx, esi
mov ecx, eax
mov byte [esi], 0
call fcn.004ed300
mov dl, 0xa
mov ecx, esi
mov byte [esi + 0xfa], 0
call fcn.00518f70
mov dl, 0xd
mov ecx, esi
call fcn.00518f70
mov edx, 0x59bb90
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4502a3
jmp 0x4502b6
mov byte [0x59bb90], 0
mov ecx, dword [0x5a1b00]
call fcn.00486db0
test eax, eax
jne 0x4502ca
call fcn.0041cfc0
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
Function at 0x453640
Capabilities:
Extract resource via kernel32 functions
Get hostname
Log keystrokes via polling
Set socket configuration

Disassembly:
push esi
mov esi, ecx
call fcn.004dbea0
test eax, eax
jne 0x45365f
call fcn.004dbf30
mov esi, eax
test esi, esi
jne 0x45365f
xor ecx, ecx
pop esi
jmp fcn.0041c8e0
mov ecx, esi
call fcn.004dc0f0
test eax, eax
jne 0x45367f
mov ecx, esi
call fcn.004dc1a0
test eax, eax
jne 0x45367f
mov edx, esi
xor ecx, ecx
pop esi
jmp fcn.00453380
push esi
mov edx, 0xf
mov ecx, 0x574b10
call fcn.00452800
pop esi
ret