joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e368
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40000080
push dword [ebp + 0xc]
push 0x458b7d
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e3a8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40010000
push dword [ebp + 0xc]
push 0x458b84
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e3e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40010000
push dword [ebp + 0xc]
push 0x458b8b
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
push dword [0x4512a0]
push 0x30
push ebx
call sub.USER32.dll_SendMessageA
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e438
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40012000
push dword [ebp + 0xc]
push 0x458b92
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
push dword [0x4512a0]
push 0x30
push ebx
call sub.USER32.dll_SendMessageA
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x41f14e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push 9
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x64]
push edx
call fcn.004470f4
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x42522c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov esi, dword [ebp + 0x10]
cmp dword [0x16e231a], 0
je 0x425297
push 0xa
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x50]
push edx
call fcn.0043d9d4
pop ecx
mov ebx, eax
push 0xa
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0xc]
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x50]
push edx
call fcn.0043d9d4
pop ecx
mov ecx, eax
sub ecx, ebx
mov ebx, ecx
test eax, eax
je 0x42528c
push ebx
call fcn.004036e5
pop ecx
push eax
push esi
call sub.USER32.dll_SetWindowTextA
jmp 0x425297
push 0x459d9d
push esi
call sub.USER32.dll_SetWindowTextA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427515
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x451314
push esi
call fcn.00401764
pop ecx
test eax, eax
je 0x4276cc
push 0x50
lea eax, [ebp - 0x64]
push eax
mov edx, esi
sub edx, dword [0x450a4c]
imul ecx, edx, 0xb
push dword [ecx*4 + 0x1713c24]
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x64]
push eax
call fcn.00441094
pop ecx
test eax, eax
jne 0x427574
imul edx, esi, 0xcd
xor ecx, ecx
mov dword [edx*4 + 0x16f8d4c], ecx
jmp 0x4276cc
cmp dword [0x16e3f10], 2
jne 0x4275e1
xor ebx, ebx
jmp 0x4275a7
lea eax, [ebp - 0x64]
push eax
call fcn.00441094
pop ecx
push eax
mov edx, dword [edi + 4]
mov ecx, dword [edx + ebx*4]
add ecx, 4
push ecx
lea eax, [ebp - 0x64]
push eax
call fcn.00441288
add esp, 0xc
test eax, eax
je 0x4275ab
inc ebx
cmp ebx, dword [edi]
jl 0x427581
cmp ebx, dword [edi]
jge 0x4276cc
imul edx, esi, 0xcd
mov dword [edx*4 + 0x16f8d4c], ebx
lea ecx, [ebp - 0x64]
push ecx
sub esi, dword [0x450a4c]
imul eax, esi, 0xb
push dword [eax*4 + 0x1713c24]
call fcn.004274ec
add esp, 8
jmp 0x4276cc
push 0x16d88ac
lea edx, [ebp - 0x64]
push edx
call fcn.004411f0
add esp, 8
test eax, eax
jne 0x427629
imul ecx, esi, 0xcd
mov eax, dword [0x16d89d8]
mov dword [ecx*4 + 0x16f8d4c], eax
lea edx, [ebp - 0x64]
push edx
sub esi, dword [0x450a4c]
imul ecx, esi, 0xb
push dword [ecx*4 + 0x1713c24]
call fcn.004274ec
add esp, 8
jmp 0x4276cc
push 0x16d8910
lea eax, [ebp - 0x64]
push eax
call fcn.004411f0
add esp, 8
test eax, eax
jne 0x42766f
imul edx, esi, 0xcd
mov ecx, dword [0x16d89dc]
mov dword [edx*4 + 0x16f8d4c], ecx
lea eax, [ebp - 0x64]
push eax
sub esi, dword [0x450a4c]
imul edx, esi, 0xb
push dword [edx*4 + 0x1713c24]
call fcn.004274ec
add esp, 8
jmp 0x4276cc
push 0x16d8974
lea ecx, [ebp - 0x64]
push ecx
call fcn.004411f0
add esp, 8
test eax, eax
jne 0x4276b5
imul eax, esi, 0xcd
mov edx, dword [0x16d89e0]
mov dword [eax*4 + 0x16f8d4c], edx
lea ecx, [ebp - 0x64]
push ecx
sub esi, dword [0x450a4c]
imul eax, esi, 0xb
push dword [eax*4 + 0x1713c24]
call fcn.004274ec
add esp, 8
jmp 0x4276cc
lea edx, [ebp - 0x64]
push edx
call fcn.004470f4
pop ecx
imul ecx, esi, 0xcd
mov dword [ecx*4 + 0x16f8d4c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427877
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0
push ebx
call sub.KERNEL32.dll_WinExec
mov edx, eax
sub edx, 1
jb 0x42789a
dec edx
je 0x4278cc
dec edx
je 0x4278e5
sub edx, 8
je 0x4278b3
jmp 0x4278fe
push ebx
push 0x459f46
push dword [0x171d168]
call fcn.00402062
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
ret
push ebx
push 0x459f81
push dword [0x171d168]
call fcn.00402062
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
ret
push ebx
push 0x459fcd
push dword [0x171d168]
call fcn.00402062
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
ret
push ebx
push 0x459fe9
push dword [0x171d168]
call fcn.00402062
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 0x1f
jg 0x42791c
push ebx
push 0x45a00d
push dword [0x171d168]
call fcn.00402062
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
ret
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x4288fd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x64]
mov edi, 0x16f78b0
push 8
push esi
push 0xf0
push ebx
call sub.USER32.dll_GetDlgItemTextA
push esi
call fcn.0043d9d4
pop ecx
mov dword [0x16e3efc], eax
push 8
push esi
push 0xf2
push ebx
call sub.USER32.dll_GetDlgItemTextA
push esi
call fcn.0043d9d4
pop ecx
mov dword [0x16e3f00], eax
xor ebx, ebx
push 8
push esi
lea eax, [ebx + ebx*2]
push dword [eax*8 + 0x16f7fb8]
call sub.USER32.dll_GetWindowTextA
push esi
call fcn.0042870d
pop ecx
lea edx, [ebx + ebx*4]
mov dword [edi + edx*4], eax
push 8
push esi
lea ecx, [ebx + ebx*2]
push dword [ecx*8 + 0x16f7fbc]
call sub.USER32.dll_GetWindowTextA
push esi
call fcn.004286d7
pop ecx
lea edx, [ebx + ebx*4]
mov dword [edi + edx*4 + 4], eax
push 8
push esi
lea eax, [ebx + ebx*2]
push dword [eax*8 + 0x16f7fc0]
call sub.USER32.dll_GetWindowTextA
push esi
call fcn.00428743
pop ecx
lea ecx, [ebx + ebx*4]
mov dword [edi + ecx*4 + 8], eax
push 8
push esi
lea eax, [ebx + ebx*2]
push dword [eax*8 + 0x16f7fc4]
call sub.USER32.dll_GetWindowTextA
push esi
call fcn.004470f4
pop ecx
lea edx, [ebx + ebx*4]
mov dword [edi + edx*4 + 0xc], eax
push 8
push esi
lea ecx, [ebx + ebx*2]
push dword [ecx*8 + 0x16f7fc8]
call sub.USER32.dll_GetWindowTextA
push esi
call fcn.0043d9d4
pop ecx
lea edx, [ebx + ebx*4]
mov dword [edi + edx*4 + 0x10], eax
inc ebx
cmp ebx, 0xa
jl 0x428947
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c2e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, 0x16f7c98
lea eax, [ebp - 0x64]
push eax
push dword [0x1713c00]
call fcn.00403387
add esp, 8
lea edx, [ebp - 0x64]
push edx
push 0x66
push ebx
call sub.USER32.dll_SetDlgItemTextA
lea ecx, [ebp - 0x64]
push ecx
push dword [0x1713c04]
call fcn.00403387
add esp, 8
lea eax, [ebp - 0x64]
push eax
push 0x67
push ebx
call sub.USER32.dll_SetDlgItemTextA
cmp dword [0x1713c08], 0
je 0x42c34a
push 1
push 0x68
push ebx
call sub.USER32.dll_CheckDlgButton
push dword [0x16e3f00]
call fcn.004036e5
pop ecx
push eax
lea edx, [ebp - 0x64]
push edx
call fcn.00441064
add esp, 8
lea ecx, [ebp - 0x64]
push ecx
push 0xf2
push ebx
call sub.USER32.dll_SetDlgItemTextA
push dword [0x16e3f00]
call fcn.0040393d
pop ecx
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00441064
add esp, 8
lea edx, [ebp - 0x64]
push edx
push 0xb4
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0xa
lea ecx, [ebp - 0x64]
push ecx
push dword [0x16e3f0c]
call fcn.00447350
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
push 0xf3
push ebx
call sub.USER32.dll_SetDlgItemTextA
xor ebx, ebx
lea eax, [ebp - 0x64]
push eax
lea edx, [esi + ebx]
push dword [edi + edx*8]
call fcn.00403387
add esp, 8
lea ecx, [ebp - 0x64]
push ecx
lea eax, [ebx + ebx*2]
push dword [eax*4 + 0x16f80a8]
call sub.USER32.dll_SetWindowTextA
lea edx, [esi + ebx]
cmp dword [edi + edx*8 + 4], 0
jne 0x42c415
push 0x45ad39
lea ecx, [ebp - 0x64]
push ecx
call fcn.00441064
add esp, 8
push 0x45ad3a
lea eax, [ebp - 0xc8]
push eax
call fcn.00441064
add esp, 8
jmp 0x42c44c
lea edx, [esi + ebx]
push dword [edi + edx*8 + 4]
call fcn.004036e5
pop ecx
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00441064
add esp, 8
lea eax, [esi + ebx]
push dword [edi + eax*8 + 4]
call fcn.0040393d
pop ecx
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.00441064
add esp, 8
lea ecx, [ebp - 0x64]
push ecx
lea eax, [ebx + ebx*2]
push dword [eax*4 + 0x16f80ac]
call sub.USER32.dll_SetWindowTextA
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebx + ebx*2]
push dword [ecx*4 + 0x16f80b0]
call sub.USER32.dll_SetWindowTextA
inc ebx
cmp ebx, 0xa
jl 0x42c3bf
push 0xa
lea eax, [ebp - 0x12c]
push eax
push dword [0x16d8898]
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x12c]
push edx
call fcn.00428743
pop ecx
mov ebx, eax
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.00403387
add esp, 8
lea edx, [ebp - 0x12c]
push edx
push dword [0x16d8898]
call sub.USER32.dll_SetWindowTextA
push edi
call fcn.00405fd6
pop ecx
push 0x16edb58
push edi
call fcn.004065ae
add esp, 8
imul ecx, dword [0x16e3f04], 0x3c
sub ebx, ecx
push ebx
push edi
call fcn.0040651b
add esp, 8
mov ebx, eax
push ebx
call fcn.004036e5
pop ecx
push eax
push dword [0x16d889c]
call sub.USER32.dll_SetWindowTextA
push ebx
call fcn.0040393d
pop ecx
push eax
push dword [0x16d88a0]
call sub.USER32.dll_SetWindowTextA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c51b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x64]
push 8
push edi
push 0x66
push ebx
call sub.USER32.dll_GetDlgItemTextA
push edi
call fcn.00428743
pop ecx
mov dword [0x1713c00], eax
push 8
push edi
push 0x67
push ebx
call sub.USER32.dll_GetDlgItemTextA
push edi
call fcn.00428743
pop ecx
mov dword [0x1713c04], eax
push 0x68
push ebx
call sub.USER32.dll_IsDlgButtonChecked
mov dword [0x1713c08], eax
push 8
push edi
push 0xf2
push ebx
call sub.USER32.dll_GetDlgItemTextA
push edi
call fcn.0043d9d4
pop ecx
mov dword [0x16e3f00], eax
push 8
push edi
push 0xf3
push ebx
call sub.USER32.dll_GetDlgItemTextA
push edi
call fcn.004470f4
pop ecx
mov dword [0x16e3f0c], eax
xor ebx, ebx
push 8
push edi
lea eax, [ebx + ebx*2]
push dword [eax*4 + 0x16f80a8]
call sub.USER32.dll_GetWindowTextA
push edi
call fcn.00428743
pop ecx
lea edx, [esi + ebx]
mov dword [edx*8 + 0x16f7c98], eax
push 8
push edi
lea ecx, [ebx + ebx*2]
push dword [ecx*4 + 0x16f80ac]
call sub.USER32.dll_GetWindowTextA
push edi
call fcn.0043d9d4
pop ecx
lea edx, [esi + ebx]
mov dword [edx*8 + 0x16f7c9c], eax
inc ebx
cmp ebx, 0xa
jl 0x42c59e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c5f1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, 0x16f7978
push dword [0x16e3f00]
call fcn.004036e5
pop ecx
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00441064
add esp, 8
lea edx, [ebp - 0x64]
push edx
push 0xf2
push ebx
call sub.USER32.dll_SetDlgItemTextA
push dword [0x16e3f00]
call fcn.0040393d
pop ecx
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00441064
add esp, 8
lea eax, [ebp - 0x64]
push eax
push 0xb4
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0xa
lea edx, [ebp - 0x64]
push edx
push dword [0x16e3f04]
call fcn.00447350
add esp, 0xc
lea ecx, [ebp - 0x64]
push ecx
push 0xf3
push ebx
call sub.USER32.dll_SetDlgItemTextA
cmp dword [0x45131c], 0
je 0x42c69b
push 1
push dword [0x16d8894]
call fcn.00409ca7
add esp, 8
xor eax, eax
mov dword [0x451320], eax
cmp dword [0x451320], 0
je 0x42c6b6
push 1
push dword [0x16d8890]
call fcn.00409ca7
add esp, 8
jmp 0x42c6c6
push 0
push dword [0x16d8890]
call fcn.00409ca7
add esp, 8
xor ebx, ebx
lea eax, [ebp - 0x64]
push eax
lea edx, [esi + ebx]
push dword [edi + edx*8]
call fcn.00403387
add esp, 8
lea ecx, [ebp - 0x64]
push ecx
lea eax, [ebx + ebx*2]
push dword [eax*4 + 0x16f80a8]
call sub.USER32.dll_SetWindowTextA
lea edx, [esi + ebx]
cmp dword [edi + edx*8 + 4], 0
jne 0x42c71e
push 0x45ad3b
lea ecx, [ebp - 0x64]
push ecx
call fcn.00441064
add esp, 8
push 0x45ad3c
lea eax, [ebp - 0xc8]
push eax
call fcn.00441064
add esp, 8
jmp 0x42c755
lea edx, [esi + ebx]
push dword [edi + edx*8 + 4]
call fcn.004036e5
pop ecx
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00441064
add esp, 8
lea eax, [esi + ebx]
push dword [edi + eax*8 + 4]
call fcn.0040393d
pop ecx
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.00441064
add esp, 8
lea ecx, [ebp - 0x64]
push ecx
lea eax, [ebx + ebx*2]
push dword [eax*4 + 0x16f80ac]
call sub.USER32.dll_SetWindowTextA
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebx + ebx*2]
push dword [ecx*4 + 0x16f80b0]
call sub.USER32.dll_SetWindowTextA
inc ebx
cmp ebx, 0xa
jl 0x42c6c8
push 0xa
lea eax, [ebp - 0x12c]
push eax
push dword [0x16d8898]
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x12c]
push edx
call fcn.00428743
pop ecx
mov ebx, eax
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.00403387
add esp, 8
lea edx, [ebp - 0x12c]
push edx
push dword [0x16d8898]
call sub.USER32.dll_SetWindowTextA
push edi
call fcn.00405fd6
pop ecx
push 0x16e3f18
push edi
call fcn.004065ae
add esp, 8
imul ecx, dword [0x16e3f04], 0x3c
sub ebx, ecx
push ebx
push edi
call fcn.0040651b
add esp, 8
mov ebx, eax
push ebx
call fcn.004036e5
pop ecx
push eax
push dword [0x16d889c]
call sub.USER32.dll_SetWindowTextA
push ebx
call fcn.0040393d
pop ecx
push eax
push dword [0x16d88a0]
call sub.USER32.dll_SetWindowTextA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c824
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x64]
push 8
push edi
push 0xf2
push ebx
call sub.USER32.dll_GetDlgItemTextA
push edi
call fcn.0043d9d4
pop ecx
mov dword [0x16e3f00], eax
push 8
push edi
push 0xf3
push ebx
call sub.USER32.dll_GetDlgItemTextA
push edi
call fcn.004470f4
pop ecx
mov dword [0x16e3f04], eax
push dword [0x16d8894]
call fcn.00409cbe
pop ecx
mov dword [0x45131c], eax
push dword [0x16d8890]
call fcn.00409cbe
pop ecx
mov dword [0x451320], eax
xor ebx, ebx
push 8
push edi
lea eax, [ebx + ebx*2]
push dword [eax*4 + 0x16f80a8]
call sub.USER32.dll_GetWindowTextA
push edi
call fcn.00428743
pop ecx
lea edx, [esi + ebx]
mov dword [edx*8 + 0x16f7978], eax
push 8
push edi
lea ecx, [ebx + ebx*2]
push dword [ecx*4 + 0x16f80ac]
call sub.USER32.dll_GetWindowTextA
push edi
call fcn.0043d9d4
pop ecx
lea edx, [esi + ebx]
mov dword [edx*8 + 0x16f797c], eax
inc ebx
cmp ebx, 0xa
jl 0x42c88e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42df99
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
mov edi, 0x45259d
cmp dword [0x44fa38], 0
je 0x42dfb4
mov eax, 1
jmp 0x42e0a3
call fcn.0040166c
lea edx, [edi + 0x89d9]
push edx
call fcn.0042df74
pop ecx
lea ecx, [edi + 0x89f1]
push ecx
lea eax, [edi + 0x89e5]
push eax
call fcn.00443f30
add esp, 8
mov esi, eax
test esi, esi
ja 0x42dff6
lea eax, [edi + 0x89f4]
push eax
call fcn.00401fde
pop ecx
xor eax, eax
jmp 0x42e0a3
push esi
push 0x14050
push 1
push 0x16f8cc0
call fcn.004443d4
add esp, 0x10
push esi
push 0x6400
push 1
push 0x170cd10
call fcn.004443d4
add esp, 0x10
xor ebx, ebx
push esi
mov eax, ebx
shl eax, 3
sub eax, ebx
push dword [eax*4 + 0x1713118]
call fcn.0043e771
add esp, 8
inc ebx
cmp ebx, 0x64
jl 0x42e022
push esi
call fcn.00443c44
pop ecx
push esi
call fcn.00443ba0
pop ecx
lea edx, [edi + 0x8a15]
push edx
call fcn.00443b10
pop ecx
call fcn.00430029
call fcn.0042defb
lea ecx, [edi + 0x8a21]
push ecx
call fcn.0042df74
pop ecx
lea eax, [edi + 0x8a2c]
push eax
call fcn.00443b10
pop ecx
lea edx, [edi + 0x8a43]
push edx
lea ecx, [edi + 0x8a37]
push ecx
call sub.KERNEL32.dll_MoveFileA
lea eax, [edi + 0x8a4e]
push eax
call fcn.00443b10
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x430b38
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
mov ebx, 0x451264
cmp dword [0x44fa38], 0
jne 0x430c28
cmp dword [0x16d88a8], 0
jne 0x430b6c
cmp dword [ebx], 0xffffffff
je 0x430c28
push dword [ebx]
call sub.WSOCK32.dll_closesocket
mov dword [ebx], 0xffffffff
pop ebx
ret
cmp dword [ebx], 0xffffffff
je 0x430b7e
push dword [ebx]
call sub.WSOCK32.dll_closesocket
mov dword [ebx], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x430bb4
cmp dword [0x4521dc], 0
jne 0x430c28
push 0x45b4fd
call fcn.00401fde
pop ecx
mov dword [0x4521dc], 1
pop ebx
ret
mov word [0x464f84], 2
xor eax, eax
mov dword [0x464f88], eax
mov dx, word [0x16d88a8]
push edx
call sub.WSOCK32.dll_htons
mov word [0x464f86], ax
push 0x10
push 0x464f84
push dword [ebx]
call sub.WSOCK32.dll_bind
test eax, eax
je 0x430c09
cmp dword [0x4521e0], 0
jne 0x430c28
push 0x45b52b
call fcn.00401fde
pop ecx
mov dword [0x4521e0], 1
pop ebx
ret
push 1
push dword [ebx]
call sub.WSOCK32.dll_listen
test eax, eax
push 0x28
push 0x8002
push dword [0x171d168]
push dword [ebx]
call sub.WSOCK32.dll_WSAAsyncSelect
pop ebx
ret

Function at 0x430c2a
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, 0x451268
cmp dword [0x44fa34], 0
je 0x430cda
test ebx, ebx
jne 0x430c60
cmp dword [esi], 0xffffffff
je 0x430cda
push dword [esi]
call sub.WSOCK32.dll_closesocket
mov dword [esi], 0xffffffff
jmp 0x430cda
cmp dword [esi], 0xffffffff
je 0x430c72
push dword [esi]
call sub.WSOCK32.dll_closesocket
mov dword [esi], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [esi], eax
cmp dword [esi], 0xffffffff
je 0x430cda
mov word [0x464f84], 2
push 0x45b60d
call fcn.0043b988
pop ecx
mov dword [0x464f88], eax
push ebx
call sub.WSOCK32.dll_htons
mov word [0x464f86], ax
push 0x10
push 0x464f84
push dword [esi]
call sub.WSOCK32.dll_bind
test eax, eax
jne 0x430cda
push 1
push dword [esi]
call sub.WSOCK32.dll_listen
test eax, eax
push 0x28
push 0x8005
push dword [0x171d168]
push dword [esi]
call sub.WSOCK32.dll_WSAAsyncSelect
pop esi
pop ebx
pop ebp
ret
Function at 0x4321eb
Capabilities:
Create thread
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4321f4
mov eax, dword [ebp - 4]
add esp, 0xfffff8a0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x16b722c], 0
jne 0x43224f
lea edx, [ebp - 4]
push edx
push 0
push ebx
push 0x4321c1
push 0
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
je 0x432317
jmp 0x432242
push 0x64
call sub.KERNEL32.dll_Sleep
lea ecx, [ebx + ebx*2]
cmp dword [ecx*4 + 0x16b722c], 0
je 0x43223b
test esi, esi
je 0x432317
push esi
call fcn.0043d6b3
pop ecx
push 0x2710
lea eax, [ebp - 0x2714]
push eax
lea edx, [ebx + ebx*2]
push dword [edx*4 + 0x16b7224]
call sub.USER32.dll_GetWindowTextA
lea ecx, [ebp - 0x2714]
push ecx
call fcn.00441094
pop ecx
cmp eax, 0x1f40
jbe 0x4322a8
push 0x1f40
lea eax, [ebp - 0x1f44]
push eax
lea edx, [ebp - 0x2714]
push edx
call fcn.00440f58
add esp, 0xc
lea ecx, [ebx + 1]
push ecx
push 0x45bba9
lea eax, [ebp - 0x2764]
push eax
call fcn.004452e0
add esp, 0xc
lea edx, [ebp - 0x2764]
push edx
lea ecx, [ebp - 0x2714]
push ecx
call fcn.00440fd4
add esp, 8
push esi
lea eax, [ebp - 0x2714]
push eax
call fcn.00440fd4
add esp, 8
lea edx, [ebp - 0x2714]
push edx
lea ecx, [ebx + ebx*2]
push dword [ecx*4 + 0x16b7224]
call sub.USER32.dll_SetWindowTextA
push 0x2710
push 0
push 0xb6
lea eax, [ebx + ebx*2]
push dword [eax*4 + 0x16b7224]
call sub.USER32.dll_SendMessageA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43378d
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.00433741
pop ecx
call fcn.0043376c
push ebx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4337b9
call fcn.00433786
or eax, 0xffffffff
jmp 0x4337d3
mov esi, eax
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ebx, dword [edx]
call fcn.00433786
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret