joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61725d
Capabilities:
Capture screenshot

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, pe_nt_image_headers32
mov byte [esi + 0x85], 1
mov eax, dword [esi + 0x44]
sub eax, dword [esi + 0x40]
cdq
idiv edi
mov ecx, dword [esi + 0x4c]
dec eax
cmp ecx, eax
jae 0x61729b
lea eax, [ecx + 1]
mov ecx, esi
mov dword [esi + 0x4c], eax
call fcn.00616eab
mov ecx, esi
call fcn.0059b749
pop edi
mov ecx, esi
pop esi
jmp fcn.00617ce7
pop edi
pop esi
ret

Function at 0x617ce7
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x20]
push edi
mov ebx, ecx
push eax
push dword [ebx + 0x50]
call esi
lea eax, [esp + 0x54]
push eax
push dword [ebx + 4]
call esi
lea eax, [esp + 0x54]
push eax
push dword [ebx + 0x50]
call fcn.0059f8c9
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
push dword [ebx + 0x50]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [ebx + 0x38], 0
mov ebp, eax
jne 0x617d42
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebx + 0x38], eax
push dword [ebx + 0x3c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
push esi
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebx + 0x38]
mov dword [ebx + 0x3c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push ebp
push edi
push esi
xor ebp, ebp
mov dword [esp + 0x28], eax
push ebp
push ebp
push dword [ebx + 0x38]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x44]
mov edi, pe_nt_image_headers32
mov ecx, dword [ebx + 0x40]
sub eax, ecx
cdq
idiv edi
mov esi, dword [ebx + 0x4c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
cmp eax, esi
jbe 0x617de8
imul eax, esi, 0x158
lea edi, [esp + 0x34]
lea esi, [ecx + 0x54]
add esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x34]
lea esi, [esp + 0x44]
mov eax, dword [esp + 0x3c]
lea edi, [esp + 0x14]
mov edx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x44], ecx
sub eax, edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x50], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fld dword [0x73ddd4]
lea esi, [esp + 0x14]
sub esp, 0x10
mov edi, esp
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fstp dword [esp]
push dword [ebx + 0x3c]
push dword [ebx + 0x38]
call fcn.0059c598
push dword [esp + 0x10]
push dword [ebx + 0x38]
call dword [sym.imp.GDI32.dll_SelectObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x618b8b
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x460
push esi
push 0
push 2
mov dword [esp + 0x38], 0x22c
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x618c86
push edi
lea eax, [esp + 0x34]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x618c82
push ebp
mov ebp, dword [esp + 0x474]
add ebp, 0x208
push ebx
lea eax, [esp + 0x60]
push eax
call fcn.00618b55
test eax, eax
jne 0x618c61
push dword [esp + 0x44]
push eax
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x618c01
push eax
call edi
jmp 0x618c61
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x26c]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_QueryFullProcessImageNameW]
test eax, eax
lea eax, [esp + 0x268]
jne 0x618c2e
lea eax, [esp + 0x60]
push 0x104
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00428ea2
push 0x28
lea eax, [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.DLL_K32GetProcessMemoryInfo
neg eax
push ebx
sbb eax, eax
and eax, dword [esp + 0x24]
mov dword [ebp], eax
call edi
add ebp, 0x20c
lea eax, [ebp + 4]
cmp eax, dword [esp + 0x474]
jae 0x618c80
lea eax, [esp + 0x3c]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x618bd7
pop ebx
pop ebp
push esi
call edi
pop edi
pop esi
add esp, 0x460
ret 8
Function at 0x6273f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push dword [esp + 0x14]
mov ebp, ecx
xor bl, bl
push dword [esp + 0x14]
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x62741b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor al, al
jmp 0x627480
push edi
push esi
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
jne 0x627430
xor al, al
jmp 0x62747f
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [esp + 0x18], eax
test eax, eax
je 0x627476
push esi
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
cmp dword [esp + 0x1c], 0
jne 0x627458
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x627474
mov ecx, eax
mov eax, dword [esp + 0x20]
cmp dword [eax], ecx
jl 0x627476
push dword [eax]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call fcn.006661f0
add esp, 0xc
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x627800
Capabilities:
Hide graphical window

Disassembly:
push 0x6b0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x627899
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov eax, dword [edx + 8]
sub eax, 0x6b0
je 0x627910
sub eax, 1
je 0x6278c7
dec eax
sub eax, 1
je 0x6278c7
sub eax, 0x95
je 0x6278eb
sub eax, 1
je 0x6278c7
sub eax, 1
je 0x6278c7
sub eax, 1
jne 0x627933
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x627933
cmp dword [ecx + 8], 0x701
jne 0x627933
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov dword [esi + 0x60], eax
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x10]
mov dword [esi + 0x64], eax
jmp 0x627933
mov eax, dword [edx + 0xc]
test eax, eax
je 0x627933
cmp dword [eax + 8], 0xfffffffe
jne 0x627933
push 5
xor ecx, ecx
add eax, 0x7c
push ecx
push ecx
push eax
push 0x6ce504
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x627933
mov eax, dword [edx + 0xc]
test eax, eax
je 0x627933
cmp dword [eax + 8], 0xfffffffe
jne 0x627933
xor ecx, ecx
mov dword [esi + 0x5c], 2
push ecx
push ecx
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret 4
Function at 0x62ae31
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6c49e5
call fcn.00664608
sub esp, 0x4c
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
sub eax, 1
je 0x62ae6b
sub eax, 1
je 0x62ae6b
sub eax, 0x76a
je 0x62ae6b
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0062a51c
jmp 0x62afcd
cmp dword [ebp + 8], 0x76c
push edi
jne 0x62af81
and dword [ebp - 0x40], 0
and dword [ebp - 0x30], 0
push 0xf
pop edi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x40], 0
mov eax, dword [esi + 0x88]
mov byte [ebp - 4], 1
sub eax, 0
je 0x62aea8
sub eax, 1
jne 0x62aeb7
push 9
push str.lrecBadAd
jmp 0x62aeaf
push 7
push str.ftBadAd
lea ecx, [ebp - 0x40]
call fcn.00410407
and dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x18], 0
push 0xa
push str.BAdSendBtn
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], 0
call fcn.00410407
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0048a61f
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 4
cmp eax, 0x10
jb 0x62af23
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x62af1a
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x14], edi
push eax
push eax
push eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
push 0x14
call fcn.004745de
lea ecx, [ebp - 0x58]
call fcn.00410858
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x62af81
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x62af78
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0
call fcn.0062b366
cmp dword [ebp + 0x24], 8
lea eax, [ebp + 0x10]
jb 0x62afa3
mov eax, dword [ebp + 0x10]
lea edi, [esi + 0x8c]
push eax
mov ecx, edi
call fcn.00427ba3
cmp dword [edi + 0x14], 8
jb 0x62afb9
mov edi, dword [edi]
push edi
push dword [ebp + 8]
push dword [esi + 0x40]
push dword [esi + 0x84]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
lea ecx, [ebp + 0x10]
call fcn.00427afc
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x20
Function at 0x62b5a1
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6c4a35
call fcn.00664608
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0059ac1b
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
mov dword [edi + 0x40], eax
xor eax, eax
mov dword [edi], 0x73f578
mov byte [edi + 0x38], cl
mov dword [edi + 0x3c], esi
mov dword [edi + 0x44], ecx
push 7
pop ebx
mov dword [edi + 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], ebx
mov word [edi + 0x48], ax
push dword [ebp + 0x18]
lea ecx, [edi + 0x60]
mov byte [ebp - 4], 1
call fcn.0041046f
push dword [ebp + 0x10]
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 2
call fcn.004294b0
and dword [edi + 0xc0], 0
xor eax, eax
and dword [edi + 0xc4], 0
and dword [edi + 0xd4], 0
mov dword [edi + 0xd8], ebx
mov word [edi + 0xc4], ax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
or dword [edi + 0x10], 0x84
mov ecx, edi
push 1
push esi
push dword [ebp + 8]
mov byte [ebp - 4], 4
mov dword [edi + 0xdc], eax
mov byte [edi + 0xe0], bl
call fcn.0059ad67
push 0x200
push ebx
push dword [edi + 4]
call fcn.0059ad22
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x62b679
sub ecx, edx
push ecx
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
call fcn.00410407
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.005bd9b6
mov ecx, dword [ebp - 0x14]
mov bl, al
cmp ecx, 0x10
jb 0x62b6d3
mov edx, dword [ebp - 0x28]
inc ecx
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0xc], edx
cmp ecx, 0x1000
jb 0x62b6ca
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004279ae
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
push ecx
push edx
call fcn.006643a9
pop ecx
pop ecx
test bl, bl
je 0x62b6de
mov byte [edi + 0xe0], 1
cmp byte [ebp + 0x20], 0
je 0x62b6f1
cmp byte [edi + 0xe0], 0
jne 0x62b6f1
push 5
jmp 0x62b6f3
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x63488c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x6349b5
push ebx
mov ebx, dword [esp + 0x5c]
lea eax, [esi + 0x1a8]
push edi
push 1
push eax
movzx eax, byte [0x7b6000]
mov ecx, ebx
mov edx, dword [ebx]
push eax
push 1
call dword [edx + 0x11c]
xor edi, edi
lea ecx, [ebx + 0x19c]
mov dword [esp + 0xc], edi
cmp dword [ebx + 0x1ac], edi
jbe 0x6349b3
push ebp
lea ebp, [esi + 0x1a0]
mov dword [esp + 0x14], ebp
mov eax, dword [ebx + 0x1a8]
add eax, edi
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.00425182
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.0048139d
lea ecx, [eax + 0x7f]
call fcn.004578d7
push eax
lea eax, [esp + 0x34]
mov ecx, ebp
push eax
call fcn.0063377c
lea ecx, [ebx + 0x19c]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov ebp, dword [eax]
mov eax, dword [ebx + 0x1a8]
add eax, edi
mov dword [esp + 0x24], eax
call fcn.00425182
mov ecx, eax
call fcn.0048139d
mov ebx, eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [ebx + 0x7f]
call fcn.004578d7
mov esi, eax
lea edi, [ebp + 0x24]
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebx + 0x5d]
shr al, 5
xor al, byte [ebp + 0x39]
and al, 4
mov edi, dword [esp + 0x10]
xor byte [ebp + 0x39], al
mov cl, byte [ebx + 0x5c]
mov al, byte [ebp + 0x39]
and al, 0xfe
shr cl, 7
or cl, al
mov byte [ebp + 0x39], cl
mov al, byte [ebx + 0x5f]
shr al, 5
xor al, cl
and al, 2
xor al, cl
mov byte [ebp + 0x39], al
mov al, byte [ebx + 0x5c]
mov ebx, dword [esp + 0x64]
and al, 0x1f
inc edi
mov byte [ebp + 0x38], al
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], edi
lea ecx, [ebx + 0x19c]
cmp edi, dword [ebx + 0x1ac]
jb 0x6348df
pop ebp
pop edi
pop ebx
pop esi
add esp, 0x50
ret 4
Function at 0x6361dd
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6aa9b3
call fcn.00664608
sub esp, 0x34
push ebx
mov bl, byte [ebp + 8]
push esi
mov esi, ecx
push edi
push 0x767
push dword [esi + 4]
mov byte [esi + 0x88], bl
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x216
push dword [esi + 0x90]
push dword [esi + 0x8c]
push 0
push 0
push dword [esi + 0x84]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esi + 0x90]
mov ecx, esi
push dword [esi + 0x8c]
call fcn.0059b46e
xor eax, eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x94]
push eax
call fcn.00410794
and dword [ebp - 4], 0
test bl, bl
je 0x63626c
push 8
push str._prefs1
lea ecx, [ebp - 0x40]
call fcn.004105af
mov ecx, dword [esi + 0x38]
call fcn.00571ebf
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x28]
push 0x7526ce
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00410407
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push 0
push 1
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00572920
mov eax, dword [ebp - 0x14]
mov edi, 0x1000
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x6362e7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, edi
jb 0x6362de
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004279ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
test bl, bl
jne 0x6362f0
cmp byte [ebp + 0xc], bl
je 0x63632e
mov ecx, esi
call fcn.0059b5ec
movzx eax, byte [esi + 0x80]
push eax
push dword [esi + 4]
push dword [esi + 0x84]
call fcn.0062b366
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x38]
call fcn.0057609c
push 0
push dword [0x7c8a28]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x636360
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp eax, edi
jb 0x636357
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004279ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x638051
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, 0x7f1e14
mov dword [0x7f1e10], eax
mov eax, dword [ebp + 8]
cmp eax, ecx
je 0x638075
push dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
call fcn.0056e200
mov al, byte [ebp + 0x10]
mov byte [0x7f1e20], al
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push 0x7f1e10
push 0x638a13
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x7f1e0c], eax
pop ebp
ret 0xc
Function at 0x63a10a
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, ecx
lea eax, [esp + 0x18]
push edi
push eax
mov dword [esp + 0x1c], esi
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
sub ebx, dword [esp + 0x20]
push dword [esi + 0x3c]
sub edi, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [esi + 0x68], 0
mov ebp, eax
mov dword [esp + 0x10], ebp
jne 0x63a153
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0x68], eax
push dword [esi + 0x6c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push edi
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [esi + 0x68]
mov dword [esi + 0x6c], eax
call ebp
push 0xcc0020
push 0
push 0
push dword [esp + 0x1c]
mov ebx, eax
push dword [esp + 0x24]
push edi
xor edi, edi
push edi
push edi
push dword [esi + 0x68]
call dword [sym.imp.GDI32.dll_BitBlt]
fld dword [0x73ddd4]
lea esi, [esp + 0x2c]
sub esp, 0x10
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
mov edi, esp
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x2c]
fstp dword [esp]
push dword [esi + 0x6c]
push dword [esi + 0x68]
call fcn.0059c598
push ebx
push dword [esi + 0x68]
call ebp
push dword [esp + 0x10]
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x63b0f8
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 5
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x68]
sub eax, dword [esi + 0x60]
push 0x254
push eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
push eax
push dword [esi + 0x60]
push dword [esi + 0x5c]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
ret
Function at 0x641a85
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x44
mov eax, 0x6c60da
call fcn.00664608
sub esp, 0x44
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x1c], edi
je 0x641c47
cmp dword [esi + 0x34], edi
je 0x641c47
push ebx
lea ebx, [esi + 0xc]
mov dword [ebp + 0x10], edi
push ebx
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
call fcn.00427a37
push 0x6ce7dc
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], edi
call fcn.00437714
cmp dword [esi + 0x38], 8
lea ecx, [esi + 0x24]
jb 0x641ae0
mov ecx, dword [esi + 0x24]
push dword [esi + 0x34]
push ecx
lea ecx, [ebp + 0x10]
call fcn.00427b45
xor eax, eax
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x38], edi
mov dword [ebp + 0x3c], 7
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 1
cmp dword [esi + 0x4c], edi
je 0x641b45
cmp dword [ebp + 0x24], 8
lea eax, [ebp + 0x10]
jb 0x641b14
mov eax, dword [ebp + 0x10]
push dword [ebp + 0x20]
lea ecx, [ebp + 0x28]
push eax
call fcn.00427bc8
push 0x6cdce8
lea ecx, [ebp + 0x28]
call fcn.00437714
cmp dword [esi + 0x50], 8
lea ecx, [esi + 0x3c]
jb 0x641b39
mov ecx, dword [esi + 0x3c]
push dword [esi + 0x4c]
push ecx
lea ecx, [ebp + 0x28]
call fcn.00427b45
xor eax, eax
lea edi, [ebp]
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
pop edi
push edi
push 0
push eax
call fcn.006678b0
or dword [esi + 0x54], 0xffffffff
add esp, 0xc
mov dword [ebp - 0x50], edi
push 8
pop edi
cmp dword [ebx + 0x14], edi
jb 0x641b71
mov ebx, dword [ebx]
lea ecx, [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jb 0x641b7c
mov ecx, dword [ebp + 0x28]
lea eax, [ebp + 0x10]
cmp dword [ebp + 0x24], edi
jb 0x641b87
mov eax, dword [ebp + 0x10]
lea edx, [ebp]
push edx
lea edx, [ebp - 0x50]
push edx
push ebx
xor ebx, ebx
push ebx
push 0x4008
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x641bbb
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp]
cmp eax, 0xffffffff
je 0x641bbb
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x3c]
mov esi, dword [esi + 0x54]
cmp eax, edi
jb 0x641bf8
mov ecx, dword [ebp + 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x40], ecx
cmp eax, 0x1000
jb 0x641bef
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0x44]
mov ecx, dword [ebp + 0x40]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x38], ebx
mov word [ebp + 0x28], ax
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x3c], 7
pop ebx
cmp eax, edi
jb 0x641c43
mov ecx, dword [ebp + 0x10]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x44], ecx
cmp eax, 0x1000
jb 0x641c3a
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x44]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x44]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
mov eax, esi
jmp 0x641c4a
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add ebp, 0x48
leave
ret
Function at 0x642ebc
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push esi
push edi
push 0
mov esi, ecx
lea ecx, [ebp - 0x28]
push 0
call fcn.004bfece
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [ebp + 8]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x642ef3
push 0xfffffffffffffffe
pop eax
jmp 0x642f88
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push edi
call fcn.00642e87
test eax, eax
je 0x642f1c
push 0xa
push 0x568
call fcn.00599084
push eax
mov ecx, esi
call fcn.00643755
or eax, 0xffffffff
jmp 0x642f88
lea ecx, [ebp - 0x14]
call fcn.004bff34
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.006430b6
test eax, eax
jne 0x642f88
lea ecx, [ebp - 0x14]
call fcn.0045a954
test al, al
je 0x642f4e
push 0xa
push 0x580
jmp 0x642f0a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0046d685
lea eax, [ebp - 0x14]
push eax
push 0x6dc204
lea eax, [ebp - 0x38]
push 0x10
push eax
call fcn.00456bfe
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push dword [ebp + 0x14]
push eax
push dword [edi]
call fcn.00642f8e
pop edi
pop esi
leave
ret 0x10

Function at 0x642f8e
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 0x6c6169
call fcn.00664608
sub esp, 0x8c
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0x8004667e
push dword [ebp + 8]
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x642fc6
or eax, eax
jmp 0x6430a7
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0046d685
mov byte [ebp - 0xd], 1
call fcn.0046bca7
push dword [ebp - 0x18]
and dword [ebp - 4], 0
lea eax, [ebp - 0x98]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x64303b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
je 0x643033
cmp esi, 0x2734
je 0x643033
push esi
push 0x4a1
call fcn.00599084
push eax
mov ecx, ebx
call fcn.00643687
mov dword [ebp - 4], 1
jmp 0x64309f
push dword [ebp + 0xc]
call fcn.00469d6b
mov dword [ebp - 4], 2
call fcn.0046bce8
push dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push dword [ebp + 8]
call fcn.00643483
mov esi, eax
mov byte [ebp + 0x13], 1
call fcn.0046bca7
mov dword [ebp - 4], 3
test esi, esi
je 0x643090
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x578
call fcn.00599084
push eax
mov ecx, ebx
call fcn.00643687
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp + 0xc]
call fcn.0046b8ec
mov dword [ebp - 4], 4
call fcn.0046bce8
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc