joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4283c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x428474
mov eax, dword [esp + 0xc]
push 2
mov dword [ebx], 0
mov ecx, dword [0x645320]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, dword [0x645320]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x428474
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x428472
mov eax, dword [0x645324]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x428472
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x428446
movzx ecx, word [esi + 0xe]
lea eax, [ecx - 1]
cmp eax, 7
ja case.0x428434.3
movzx edx, byte [eax + 0x428480]
jmp dword [edx*4 + 0x428478]
mov eax, 1
shl eax, cl
jmp 0x428446
xor eax, eax
shl eax, 2
movzx ecx, ax
movzx eax, word [esi]
push 0
mov edx, esi
push esi
add edx, ecx
add eax, edx
push eax
push 4
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebx], eax
mov eax, dword [0x645324]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
ret

Function at 0x428490
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebp
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x42857f
lea eax, [esp + 0x10]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x42857f
push edi
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
mov dword [esp + 0x30], edi
je 0x428575
push ebx
push esi
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x42856a
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call ebp
push edi
mov dword [esp + 0x1c], eax
call esi
mov esi, eax
test esi, esi
je 0x42855b
mov edi, dword [esp + 0x3c]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x10], eax
je 0x428550
push eax
push esi
call ebp
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push 0xcc0020
push ecx
mov ecx, dword [edi + 8]
push edx
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0xc]
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x14]
push edx
push esi
call ebp
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
push eax
push ebx
call ebp
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
pop ebx
mov eax, dword [esp + 8]
pop edi
pop ebp
add esp, 0x24
ret
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x428df0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x28
push edi
mov edi, dword [esp + 0x30]
mov edx, dword [edi + 4]
test edx, edx
jne 0x428e06
xor eax, eax
pop edi
add esp, 0x28
ret
mov ecx, dword [edi + 8]
cmp dword [esp + 0x34], ecx
jge 0x428e13
mov dword [esp + 0x34], ecx
mov eax, dword [edi + 0xc]
push ebx
push ebp
push esi
cmp dword [esp + 0x44], eax
jge 0x428e23
mov dword [esp + 0x44], eax
cmp edi, 0x643ff8
jne 0x428e33
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov esi, dword [esp + 0x40]
cmp esi, 1
jl 0x428eaf
mov ebx, dword [esp + 0x44]
cmp ebx, 1
jl 0x428eaf
lea eax, [esp + 0x20]
push eax
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp dword [esp + 0x24], esi
jne 0x428e63
cmp dword [esp + 0x28], ebx
je 0x428fb5
mov ecx, dword [0x645324]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
je 0x428eaf
mov ebp, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
call ebp
mov ebx, eax
test ebx, ebx
push esi
jne 0x428e93
mov edx, dword [0x645324]
push edx
jmp 0x428ea9
call ebp
mov ebp, eax
test ebp, ebp
jne 0x428edc
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x645324]
push esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [edi + 4]
test eax, eax
je 0x428ebd
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
mov dword [edi + 4], 0
mov byte [edi + 0x10], 0
call fcn.00421c80
add esp, 4
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x28
ret
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x428f03
push ebp
mov ebp, dword [sym.imp.GDI32.dll_DeleteDC]
call ebp
push ebx
call ebp
jmp 0x428ea2
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
call esi
mov ecx, dword [edi + 4]
push ecx
push ebp
mov dword [esp + 0x18], eax
call esi
mov dword [esp + 0x14], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x3c], 0
jmp 0x428f30
xor esi, esi
mov edx, dword [edi + 0xc]
push 0xcc0020
push 0
push 0
push ebp
push edx
push eax
mov eax, dword [esp + 0x54]
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x40]
add esi, eax
cmp esi, ecx
jl 0x428f32
mov ecx, dword [esp + 0x3c]
mov esi, dword [edi + 0xc]
mov edx, dword [esp + 0x44]
add ecx, esi
cmp ecx, edx
mov dword [esp + 0x3c], ecx
jl 0x428f30
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push ebx
call esi
mov edx, dword [esp + 0x14]
push edx
push ebp
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebp
call esi
push ebx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [0x645324]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], eax
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x28
ret
Function at 0x429ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push edi
push eax
call fcn.005827d0
mov edi, eax
add esp, 4
test edi, edi
je 0x429b80
mov ecx, dword [edi + 0xbf4]
push ecx
call fcn.00502a60
add esp, 4
test eax, eax
je 0x429b80
push ebx
push esi
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
mov eax, dword [edi + 0x884]
cmp esi, eax
je 0x429b1f
cmp esi, dword [edi + 0x888]
jne 0x429b7e
cmp esi, eax
jne 0x429b27
mov ecx, dword [edi + 0x6d4]
jmp 0x429b2d
mov ecx, dword [edi + 0x6d8]
test ecx, ecx
mov edx, dword [edi + 0xbf4]
mov dword [edx + 0x21c4], 0
je 0x429ba8
mov eax, ecx
mov ebx, 1
cmp dword [eax + 0x1c], ebx
je 0x429b82
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x429b48
mov eax, dword [ecx + 0x44]
mov dword [eax + 0x1c], ebx
mov eax, dword [eax]
mov ecx, dword [edi + 0x8b0]
push eax
push ecx
push esi
call fcn.004889d0
push 0x7d000
push 0x7d000
push ebx
push esi
call fcn.00488690
add esp, 0x1c
pop esi
pop ebx
pop edi
ret
cmp eax, ecx
je 0x429ba8
mov ecx, dword [eax + 0x44]
test ecx, ecx
je 0x429ba8
cmp dword [ecx], 0
je 0x429ba8
mov dword [eax + 0x1c], 0
mov edx, dword [ecx]
mov dword [ecx + 0x1c], ebx
mov eax, dword [edi + 0x8b0]
push edx
push eax
jmp 0x429b64
pop esi
pop ebx
pop edi
mov dword [esp + 4], 0
jmp fcn.00421c80
Function at 0x432690
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push edi
push eax
call fcn.005827d0
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 8], edi
je 0x4328d1
mov ecx, dword [esp + 0x18]
push ebp
push 0x180
push 0x40
push 0x4301
push ecx
call fcn.005e1bf4
mov ebp, eax
add esp, 0x10
test ebp, ebp
jge 0x4326df
push 0
call fcn.00421c80
add esp, 4
pop ebp
pop edi
add esp, 0xc
ret
push ebx
push esi
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [edi]
push 0x180
push 0x63b6f0
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0x57c
call fcn.00421db0
push eax
push 0x63b6f0
call fcn.005ccdf0
add esp, 0x10
test eax, eax
mov dword [esp + 0x10], eax
je 0x432761
add eax, 4
mov ecx, eax
mov dword [esp + 0x10], eax
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x432740
sub ecx, esi
push ecx
push eax
push ebp
call fcn.005d805f
push 1
push 0x5e75fc
push ebp
call fcn.005d805f
add esp, 0x18
mov ecx, dword [edi + 0x88c]
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
push ebx
push 0x189
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x4328ba
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4328ba
mov edx, 0x63b6f0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432797
cmp byte [0x63b6f0], 0x20
mov eax, 0x63b6f0
mov dword [esp + 0x10], eax
jne 0x4327bd
inc eax
mov dword [esp + 0x10], eax
cmp byte [eax], 0x20
je 0x4327b3
cmp byte [eax], 0
je 0x432898
push 9
push eax
call fcn.005cbf10
mov esi, eax
add esp, 8
test esi, esi
je 0x432898
mov byte [esi], 0
mov edx, dword [esp + 0x10]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4327e7
sub eax, edi
push eax
push edx
push ebp
call fcn.005d805f
mov al, byte [esi + 1]
add esp, 0xc
inc esi
test al, al
je 0x432884
push 9
push esi
mov dword [esp + 0x18], esi
call fcn.005cbf10
mov esi, eax
add esp, 8
test esi, esi
je 0x43281f
mov byte [esi], 0
push 1
push 0x5e7420
push ebp
call fcn.005d805f
mov edx, dword [esp + 0x1c]
mov eax, edx
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432838
sub eax, edi
push eax
push edx
push ebp
call fcn.005d805f
add esp, 0xc
test esi, esi
je 0x432884
mov al, byte [esi + 1]
inc esi
test al, al
je 0x432884
push 1
push 0x5e7420
push ebp
call fcn.005d805f
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432870
sub eax, edx
push eax
push esi
push ebp
call fcn.005d805f
add esp, 0xc
push 1
push 0x5e75fc
push ebp
call fcn.005d805f
mov edi, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [edi + 0x88c]
lea edx, [esp + 0x10]
push edx
inc ebx
push ebx
push 0x189
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x432784
push ebp
call fcn.005d4c77
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
pop ebx
pop ebp
pop edi
add esp, 0xc
ret
Function at 0x432dd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3f0
push esi
mov esi, dword [esp + 0x3f8]
push esi
call fcn.00502a60
add esp, 4
test eax, eax
je 0x433006
mov eax, dword [esi + 0x1914]
push ebx
push ebp
xor ebx, ebx
push edi
lea edi, [esi + 0x1914]
xor ebp, ebp
cmp eax, ebx
mov dword [esi + 0x1918], 2
mov dword [esi + 0x1a34], ebx
mov dword [esi + 0x1c58], ebx
mov dword [esi + 0x1c5c], ebx
mov dword [esi + 0x1a28], ebx
mov dword [esi + 0x1a2c], ebx
mov dword [esi + 0x1a30], ebx
jne 0x432e4e
push edi
push esi
push ebx
push ebx
push 4
push str.Channels_List
call fcn.005899d0
add esp, 0x18
mov dword [edi], eax
mov ebp, 1
mov eax, dword [edi]
push eax
call fcn.005827d0
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x433003
mov ecx, dword [edi + 0x88c]
push ebx
push ebx
push 0x184
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [edi + 0x6cc]
push edx
call fcn.004e33a0
lea eax, [edi + 0x6b8]
push eax
mov dword [esp + 0x18], eax
call fcn.004e33a0
add esp, 8
cmp ebp, ebx
je 0x432ea7
mov eax, dword [edi]
push 4
push eax
call fcn.004a57d0
add esp, 8
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x432ec1
mov edx, dword [edi]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x432ed0
push ebx
mov dword [edi + 0x724], ebx
call fcn.005562e0
add esp, 4
push ebx
push 0xdd0
call fcn.00421db0
add esp, 8
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [0x61369c]
mov edx, dword [esi]
push ecx
push edx
call fcn.00526700
mov eax, dword [0x6136a4]
add esp, 8
push eax
push ebx
push 0xdd1
call fcn.00421db0
mov ecx, dword [esi]
add esp, 8
push eax
push ecx
call fcn.00526870
mov edx, dword [0x61369c]
mov eax, dword [esi]
push edx
push eax
call fcn.00526700
mov eax, dword [esi + 0x1920]
add esp, 0x14
cmp eax, ebx
je 0x433003
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esi + 0x1924]
push ecx
push 0x6117b8
lea edx, [esp + 0x20]
push 0x5e6a64
push edx
call edi
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x191c], eax
je 0x433003
push ebx
call fcn.005cce76
push eax
call fcn.0055a8d0
push eax
lea ecx, [esi + 0x1124]
push ecx
lea edx, [esp + 0x28]
push 0x5e7598
push edx
call edi
mov edi, dword [esp + 0x28]
mov ecx, dword [edi]
push ebx
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.004e2f90
mov dword [edi], eax
lea edi, [esp + 0x3c]
add esp, 0x24
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x432fc0
mov dx, word [0x5e6c94]
mov al, byte [0x5e6c96]
mov word [edi], dx
mov byte [edi + 2], al
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x432fe1
push ebx
sub eax, edx
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi + 0x191c]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x3f0
ret
Function at 0x4341e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x6118bc]
test eax, eax
jne 0x434200
push esi
call fcn.00502b30
mov esi, eax
test esi, esi
je 0x4341ff
mov eax, dword [esi + 0x1918]
test eax, eax
je 0x43420d
pop esi
mov dword [esp + 4], 0
jmp fcn.00421c80
mov eax, dword [esp + 8]
cmp eax, 5
push ebx
mov ebx, dword [0x645324]
mov dword [0x63b684], eax
je 0x43422c
cmp eax, 6
je 0x43422c
cmp eax, 8
jne 0x434260
mov eax, dword [esi + 0x1914]
test eax, eax
je 0x434260
push edi
mov edi, eax
call fcn.00582a20
cmp edi, eax
jne 0x43425f
push edi
call fcn.00582c10
add esp, 4
test eax, eax
jne 0x434255
mov ebx, dword [esi + 0x1914]
mov dword [0x63b684], 5
pop edi
push esi
push 0x433580
push 0x8c
push ebx
call fcn.00475160
add esp, 0x10
pop ebx
mov dword [0x6118bc], 0
mov dword [0x63b684], 0
pop esi
ret

Function at 0x4344b0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x611900]
sub esp, 0x3e8
test eax, eax
je 0x434612
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3f8]
push edi
mov edi, edi
cmp esi, eax
je 0x4344e9
mov eax, dword [eax + 0x890]
test eax, eax
jne 0x4344d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e8
ret
mov eax, dword [esi]
push eax
call fcn.00502af0
mov edi, eax
add esp, 4
test edi, edi
je 0x43460e
mov bl, byte [esp + 0x408]
test bl, 1
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
je 0x43454f
mov eax, dword [esi + 0x540]
mov ecx, dword [esp + 0x400]
lea edx, [esi + 0x3f0]
push ecx
test eax, eax
push edx
lea eax, [esp + 0x18]
je 0x434534
push str.NOTICE__s_:DCC_Fserve___s__n
jmp 0x434539
push str.NOTICE__s_:DCC_Chat___s__n
push eax
call ebp
add esp, 0x10
push edi
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0058c390
add esp, 0xc
test bl, 2
je 0x434589
movzx edx, word [esi + 0x51c]
mov eax, dword [esp + 0x404]
push edx
push eax
lea ecx, [esi + 0x3f0]
push ecx
lea edx, [esp + 0x1c]
push 0x5e8314
push edx
call ebp
push edi
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0058c390
add esp, 0x20
jmp 0x4345e2
test bl, 4
je 0x434596
mov ecx, dword [esi + 0x52c]
jmp 0x4345a1
test bl, 8
je 0x43460e
mov ecx, dword [esi + 0x530]
movzx edx, word [esi + 0x51c]
push ecx
lea eax, [esi + 0x4b8]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea ecx, [esi + 0x3f0]
push ecx
lea edx, [esp + 0x20]
push 0x5e82ec
push edx
call ebp
push edi
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.0058c390
add esp, 0x24
mov ecx, dword [0x613698]
push ecx
push 0
push 0x517
mov dword [0x63f7ac], 0
call fcn.00421db0
mov edx, dword [esi]
add esp, 8
push eax
push edx
call fcn.00526870
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e8
ret
Function at 0x4353e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
push edi
mov edi, dword [esp + 0x3f8]
test edi, edi
je 0x43554f
cmp byte [edi], 0
je 0x43554f
mov esi, dword [esp + 0x3f4]
push esi
call fcn.00434440
add esp, 4
test eax, eax
je 0x435544
lea eax, [esp + 8]
push 0x3e7
push eax
call fcn.00423a00
lea edx, [esp + 0x10]
add esp, 8
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x435432
mov edx, dword [esi + 0x88c]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push 0
push eax
call fcn.0057b020
mov eax, dword [0x642ee0]
add esp, 0x14
test eax, eax
je 0x43548b
mov ecx, dword [esi]
push ecx
call fcn.005827d0
add esp, 4
test eax, eax
je 0x43548b
cmp dword [eax + 0x9f8], 0x80
jne 0x43548b
mov eax, dword [esi]
lea edx, [esp + 8]
push edx
push eax
call fcn.005468d0
add esp, 8
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435492
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x888]
cmp eax, 0xffffffff
mov dword [esi + 0x878], 0
mov dword [esi + 0x87c], 0
je 0x435544
push 0
push edi
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, edi
je 0x43554f
mov eax, dword [esi + 0x540]
test eax, eax
jne 0x435544
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
push 0
jne 0x435530
mov eax, dword [esi + 0x874]
lea edx, [esp + 0xc]
push edx
push eax
call fcn.004e2f90
add esp, 0xc
test eax, eax
je 0x43550a
mov dword [esi + 0x874], eax
mov ecx, dword [0x645324]
mov edx, dword [esi + 0x888]
push 0x23
push 0x801f
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
push 0x528
call fcn.00421db0
push eax
push esi
call fcn.00434890
add esp, 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3e8
ret
Function at 0x436490
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x3e8
push ebx
push esi
mov esi, dword [esp + 0x3f4]
xor ebx, ebx
cmp esi, ebx
je 0x43663e
cmp dword [esi + 0x520], 3
je 0x4364bf
cmp dword [esi + 0x534], 2
jne 0x43663e
mov eax, dword [esi + 0x888]
push 1
push 1
push eax
push 0x801f
mov dword [esi + 0x878], ebx
mov dword [esi + 0x87c], ebx
call fcn.0058d320
add esp, 0x10
test eax, eax
jne 0x43663e
push ebp
push edi
lea ecx, [ecx]
mov ecx, dword [esi + 0x880]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x880], ecx
jl 0x436529
mov ecx, dword [esi + 0x888]
push ebx
push 1
push ecx
push 0x801f
mov dword [esi + 0x880], ebx
call fcn.0058d320
add esp, 0x10
test eax, eax
jne 0x43663c
mov eax, dword [esi + 0x888]
push ebx
push 0x3e6
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x4365ff
cmp edi, ebx
jle 0x43662e
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x10], bl
jle 0x4365d5
mov edi, edi
mov al, byte [esp + ebp + 0x10]
cmp al, 9
je 0x4365af
cmp al, 0xd
je 0x4365af
cmp al, 0xa
jne 0x43657c
mov ecx, dword [esi + 0x3ec]
mov byte [ecx + esi + 4], bl
jmp 0x4365a0
mov edx, dword [esi + 0x3ec]
mov byte [edx + esi + 4], al
mov edx, dword [esi + 0x3ec]
inc edx
mov eax, edx
cmp eax, 0x3b5
mov dword [esi + 0x3ec], edx
jl 0x4365af
mov byte [eax + esi + 4], bl
push esi
mov dword [esi + 0x3ec], ebx
call fcn.00435f30
add esp, 4
mov eax, dword [0x611900]
cmp eax, ebx
je 0x4365d5
cmp esi, eax
je 0x4365c8
mov eax, dword [eax + 0x890]
cmp eax, ebx
jne 0x4365b8
jmp 0x4365d5
cmp dword [esi + 0x520], ebx
je 0x4365d5
inc ebp
cmp ebp, edi
jl 0x436560
mov eax, dword [0x611900]
cmp eax, ebx
je 0x43663c
mov edi, edi
cmp esi, eax
je 0x4364f0
mov eax, dword [eax + 0x890]
cmp eax, ebx
jne 0x4365e0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x43663c
push ebx
push 0x527
call fcn.00421db0
push eax
push esi
call fcn.00434890
add esp, 0x10
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
push 0x5e6c98
push esi
call fcn.00434890
add esp, 8
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
Function at 0x438640
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
mov dword [esi], 0
call edi
test ah, ah
jns 0x43865d
or dword [esi], 1
push 0x11
call edi
test ah, ah
jns 0x438668
or dword [esi], 2
push 0x10
call edi
test ah, ah
jns 0x438673
or dword [esi], 4
push 0x12
call edi
test ah, ah
jns 0x43867e
or dword [esi], 8
push 2
call edi
test ah, ah
jns 0x438689
or dword [esi], 0x10
push 4
call edi
test ah, ah
jns 0x438694
or dword [esi], 0x20
pop edi
pop esi
ret

Function at 0x4386a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
movzx ecx, ax
shr eax, 0x10
mov dword [0x609588], ecx
mov dword [0x60958c], eax
mov dword [esp + 4], 0x611f90
jmp fcn.00438640
Function at 0x43e1d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x613804]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x613804]
test eax, eax
je 0x43e1ee
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x613804], 0
ret

Function at 0x43f630
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x613804]
test eax, eax
je 0x43f63c
xor eax, eax
ret
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call edi
mov eax, dword [0x613804]
test eax, eax
je 0x43f65a
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [esp + 0xc]
push 0
push 0x43e200
push esi
mov dword [0x613804], 0
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [0x645320]
push 0xb4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp dword [esp + 0x10], 1
mov dword [0x613804], eax
jne 0x43f69d
push esi
push eax
call fcn.0043dfa0
jmp 0x43f6a5
push 4
push eax
call fcn.0042a7d0
mov ecx, dword [0x613804]
add esp, 8
push 8
push ecx
call edi
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov dword [0x613808], esi
mov eax, 1
pop esi
ret