joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531f50
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, ecx
movzx ecx, word [esi + 0x3618]
mov eax, ecx
and eax, 0x3ff
sub eax, 4
push edi
mov edi, 0x70b768
je 0x531fa6
sub eax, 0xd
je 0x531f93
dec eax
je 0x531f80
mov dword [esi + 0x3624], edi
jmp 0x531fec
mov byte [esi + 0x361e], 0
mov dword [esi + 0x3624], 0x70b77a
jmp 0x531fec
mov byte [esi + 0x361e], 1
mov dword [esi + 0x3624], 0x70b780
jmp 0x531fec
shr ecx, 0xa
dec ecx
mov byte [esi + 0x361e], 1
je 0x531fe2
dec ecx
je 0x531fbe
mov dword [esi + 0x3624], edi
jmp 0x531fec
mov ecx, esi
call fcn.00531b40
mov eax, dword [esi + 0x3628]
test eax, eax
sete al
mov byte [esi + 0x361e], al
mov dword [esi + 0x3624], 0x70b76e
jmp 0x531fec
mov dword [esi + 0x3624], 0x70b774
cmp dword [esi + 0x3624], edi
jne 0x532033
movzx edx, word [esi + 0x3618]
push 0xa
lea ecx, [esp + 0x18]
push ecx
push 3
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
movsx ax, byte [esp + 0x14]
mov ecx, dword [esi + 0x3624]
mov word [ecx], ax
movsx dx, byte [esp + 0x15]
push edx
call fcn.005d0433
mov ecx, dword [esi + 0x3624]
add esp, 4
mov word [ecx + 2], ax
mov edx, dword [esi + 0x3614]
push edx
call sub.IMM32.dll_ImmIsIME
test eax, eax
mov eax, dword [esi + 0x3610]
push eax
setne bl
call sub.IMM32.dll_ImmGetContext
mov edi, eax
test edi, edi
je 0x5320f8
xor ecx, ecx
mov cx, word [esi + 0x3618]
and ecx, 0x3ff
cmp ecx, 4
jne 0x5320aa
test bl, bl
je 0x5320aa
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push edi
call sub.IMM32.dll_ImmGetConversionStatus
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x3610]
and cl, 1
neg cl
push edi
push edx
sbb ecx, ecx
add ecx, 2
mov dword [esi + 0x3620], ecx
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop esi
pop ebx
add esp, 0x14
ret
cmp dword [0x708598], 0xb
jne 0x5320c7
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
sub eax, 0x4190419
neg eax
sbb eax, eax
inc eax
jmp 0x5320de
test bl, bl
je 0x5320dc
push edi
call sub.IMM32.dll_ImmGetOpenStatus
test eax, eax
je 0x5320dc
mov eax, 1
jmp 0x5320de
xor eax, eax
mov edx, dword [esi + 0x3610]
push edi
push edx
mov dword [esi + 0x3620], eax
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x3620], 0
cmp dword [0x708598], 0xb
jne 0x532123
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
sub eax, 0x4190419
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x3620], eax
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x5329e0
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x3614], eax
mov eax, dword [0x708598]
cmp eax, 8
jne 0x532a03
mov dword [esi + 0x3614], 0xe0080404
jmp 0x532a12
cmp eax, 0xc
jne 0x532a12
mov dword [esi + 0x3614], 0x41f041f
xor eax, eax
mov ax, word [esi + 0x3614]
mov word [esi + 0x3618], ax
push eax
call fcn.00532140
push eax
call fcn.00532220
add esp, 8
push 4
push 0
mov word [esi + 0x361a], ax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sub.IMM32.dll_ImmGetProperty
shr eax, 0x13
and al, 1
mov ecx, esi
mov byte [esi + 0x361c], al
call fcn.00531f50
mov ecx, esi
call fcn.00531b40
mov ecx, esi
call fcn.00531d40
mov dword [esi + 0xcc], 1
pop esi
ret 8

Function at 0x534d80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
push 0
mov edi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x534dfb
push ebx
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x534df3
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x534df3
cmp word [eax], 0
je 0x534dec
push esi
mov esi, eax
xor eax, eax
mov ax, word [esi]
mov ecx, edi
push eax
call fcn.005344c0
test al, al
jne 0x534deb
xor edx, edx
mov dx, word [esi]
mov ecx, edi
push edx
call fcn.00532630
test eax, eax
je 0x534de2
push edx
push 1
lea ecx, [edi + 0x84]
call fcn.00533e40
add esi, 2
cmp word [esi], 0
jne 0x534db2
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
pop edi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
ret

Function at 0x535200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b3460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov edx, 7
mov dword [eax + 0x80], edx
mov dword [eax + 0x7c], ecx
mov word [eax + 0x6c], cx
mov dword [eax + 0x9c], edx
mov dword [eax + 0x98], ecx
mov word [eax + 0x88], cx
mov dword [eax + 0xb8], 0xf
mov dword [eax + 0xb4], ecx
mov byte [eax + 0xa4], cl
mov dword [eax + 0x30f4], edx
mov dword [eax + 0x30f0], ecx
mov word [eax + 0x30e0], cx
mov dword [eax + 0x30fc], ecx
mov dword [eax + 0x3100], ecx
mov dword [eax + 0x3104], ecx
mov edx, 1
mov dword [eax + 0x3630], ecx
mov dword [eax + 0x3620], ecx
mov dword [eax + 0x28], ecx
mov byte [eax], cl
mov byte [eax + 0x30], cl
mov dword [eax + 0x34], ecx
mov dword [eax + 0x360c], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov byte [eax + 0xd0], cl
mov dword [eax + 0x3634], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 0x24], 0x14
mov dword [eax + 0x2c], edx
mov dword [eax + 4], 0x1f4
mov dword [eax + 0x3608], edx
mov dword [eax + 0xc4], 0xffffffff
mov dword [eax + 0xc8], 0xffffffff
mov dword [eax + 0xcc], edx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x537710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b3561
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0xc
mov dword [esp + 0x10], edi
lea esi, [edi + 0x14]
call fcn.005cc96d
mov dword [esi + 0x10], eax
xor ebx, ebx
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x10]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 4], esi
mov dword [esi + 8], esi
mov dword [esi + 0xc], esi
push 0xc
mov dword [esp + 0x20], ebx
lea esi, [edi + 0x30]
call fcn.005cc96d
mov dword [esi + 0x10], eax
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x14], ecx
add esp, 8
mov dword [esi + 0x18], ebx
mov dword [esi + 4], esi
mov dword [esi + 8], esi
mov dword [esi + 0xc], esi
lea ecx, [edi + 0x4c]
mov byte [esp + 0x18], 1
call fcn.00445710
lea ecx, [edi + 0x5c]
mov byte [esp + 0x18], 2
call fcn.00536220
mov ecx, dword [esp + 0x10]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 4], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5377c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b359c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esp + 0x14], 3
call fcn.005370e0
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 2
call fcn.005362c0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.004457b0
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.005af1a0
lea ecx, [edi + 0x10]
call fcn.004442c0
add esi, 0x14
mov ecx, esi
call fcn.005af1a0
lea ecx, [esi + 0x10]
call fcn.004442c0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5471c0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x547279
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x547279
push esi
lea eax, [esp + 0x10]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x18], eax
jbe 0x54726d
push eax
call fcn.005cc96d
mov esi, eax
add esp, 4
test esi, esi
jne 0x54720c
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x18]
push esi
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x547264
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push eax
push 0x6bb608
push esi
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x547264
mov eax, dword [esp + 0xc]
test eax, eax
je 0x547264
mov ecx, dword [eax + 8]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 0xc]
push esi
mov dword [ebx], edx
call fcn.005cc620
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
push esi
call fcn.005cc620
add esp, 4
pop esi
pop edi
mov eax, 0x80004005
pop ebx
add esp, 8
ret
pop edi
mov eax, 0x80070057
pop ebx
add esp, 8
ret
Function at 0x5525b0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x552761
cmp word [esi + 0x1c], 0
jne 0x55275d
mov eax, dword [0x7198d4]
test eax, eax
je 0x552614
mov eax, dword [esi + 0x10]
test eax, eax
mov word [esi + 0x1c], 1
je 0x5525f5
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x552590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
pop ecx
ret
movzx eax, byte [esi + 0xc]
cmp eax, 3
ja case.default.0x552621
jmp dword [eax*4 + 0x552768]
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x552656
test al, al
jne 0x552647
push str.humf_action.ALT
push str.data_Character_Human
jmp 0x55273c
push str.humm_action.ALT
push str.data_Character_Human
jmp 0x55273c
test al, al
jne 0x552669
push str.huwf_action.ALT
push str.data_Character_Human
jmp 0x55273c
push str.huwm_action.ALT
push str.data_Character_Human
jmp 0x55273c
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x5526a6
test al, al
jne 0x552697
push str.elmr_action.ALT
push str.data_Character_Elf
jmp 0x55273c
push str.elmm_action.ALT
push str.data_Character_Elf
jmp 0x55273c
test al, al
jne 0x5526b9
push str.elwr_action.ALT
push str.data_Character_Elf
jmp 0x55273c
push str.elwm_action.ALT
push str.data_Character_Elf
jmp 0x55273c
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x5526ed
test al, al
jne 0x5526e1
push str.demf_action.ALT
push str.data_Character_DeathEater
jmp 0x55273c
push str.demr_action.ALT
push str.data_Character_DeathEater
jmp 0x55273c
test al, al
jne 0x5526fd
push str.dewf_action.ALT
push str.data_Character_DeathEater
jmp 0x55273c
push str.dewr_action.ALT
push str.data_Character_DeathEater
jmp 0x55273c
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x552727
test al, al
jne 0x552720
push str.vimr_action.ALT
jmp 0x552737
push str.vimm_action.ALT
jmp 0x552737
test al, al
jne 0x552732
push str.viwr_action.ALT
jmp 0x552737
push 0x6bebd4
push str.data_Character_Vile
call fcn.00552120
xor edx, edx
mov dl, byte [esi + 0xe]
xor eax, eax
mov al, byte [esi + 0xd]
xor ecx, ecx
mov cl, byte [esi + 0xc]
push edx
push eax
push ecx
mov ecx, 0x220aad0
call fcn.00548c60
inc word [esi + 0x1c]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x555bc0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp word [esi + 0x5dc], 0
jne 0x555c9f
mov eax, dword [0x7198d4]
test eax, eax
je 0x555c98
mov eax, dword [esi + 0x104]
test eax, eax
mov word [esi + 0x5dc], 1
je 0x555c0a
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [esi + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x555c25
push eax
push str.data_Effect
lea ecx, [esi + 0x108]
call fcn.0055a180
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x555c40
push eax
push str.data_Effect
lea ecx, [esi + 0x234]
call fcn.0055a180
mov eax, dword [esi + 0xec]
test eax, eax
je 0x555c5b
push eax
push str.data_Effect
lea ecx, [esi + 0x360]
call fcn.0055a180
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x555c76
push eax
push str.data_Effect
lea ecx, [esi + 0x48c]
call fcn.0055a180
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x555ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x104], eax
mov eax, esi
pop esi
pop ecx
ret
mov ecx, esi
call fcn.005556f0
inc word [esi + 0x5dc]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x55cb10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x44]
push eax
lea ecx, [esi + 0x38]
push ecx
lea edx, [esi + 0x2c]
push edx
mov ecx, 0x2209408
call fcn.005426e0
mov ecx, dword [esi + 0xf0]
test ecx, ecx
je 0x55cbac
mov eax, dword [esi + 0xf4]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x55cbac
mov eax, dword [esi + 0x104]
cmp eax, 0xfa
jge 0x55cbbe
mov ecx, dword [esi + 0x1dac8]
imul eax, eax, 0x12c
mov edx, dword [esi + 0xf0]
mov ebx, dword [edx + ecx*4]
add eax, 0x220f708
mov edi, eax
mov eax, dword [edi + 0xc]
test eax, eax
lea ecx, [edx + ecx*4]
jne 0x55cb7e
mov ecx, edi
call fcn.00559890
test ebx, ebx
jl 0x55cb91
cmp ebx, dword [edi + 8]
jge 0x55cb91
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + ebx*4]
test ecx, ecx
jne 0x55cba5
mov eax, dword [0x2209400]
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x104]
jmp 0x55cbbe
call fcn.0053dc20
jmp 0x55cbbe
mov eax, dword [0x2209400]
mov edx, dword [eax]
push 0
push 0
push eax
call dword [edx + 0x104]
mov edx, dword [esi + 0xc8]
mov eax, dword [0x2209400]
mov ecx, dword [eax]
shl edx, 5
mov edx, dword [edx + 0x6ccc34]
push edx
push 0x13
push eax
call dword [ecx + 0xe4]
mov edx, dword [esi + 0xcc]
mov eax, dword [0x2209400]
mov ecx, dword [eax]
shl edx, 5
mov edx, dword [edx + 0x6ccc34]
push edx
push 0x14
push eax
call dword [ecx + 0xe4]
mov eax, dword [esi + 0x1dad0]
test eax, eax
je 0x55cc1c
mov eax, dword [esi + 0x17c]
test eax, eax
jne 0x55cc1c
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.0055b1f0
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.0055b650
Function at 0x58d3f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x224e340], eax
jne 0x58d40f
mov al, 1
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
push eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x18]
push ecx
mov word [esp + 0xa], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 4
lea edx, [esp + 4]
push edx
push 0xffffff7f
mov dword [esp + 0x14], eax
mov eax, dword [0x224e340]
push 0xffff
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [0x224e340]
push 0x10
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x58d479
mov al, 2
add esp, 0x14
ret
mov eax, dword [0x224a330]
mov ecx, dword [0x224e340]
push 0x21
push 0x2b10
push eax
push ecx
mov word [0x2246320], 0
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
setne al
dec al
and eax, 3
add esp, 0x14
ret

Function at 0x597e40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.005cd2a0
mov eax, dword [0x70c3c4]
test eax, eax
push ebx
push esi
push edi
je 0x597f55
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push esi
push edi
push str.SEND__
call fcn.00597d70
lea eax, [ebx + 4]
mov word [esp + 0x20], ax
mov dword [esp + 0x1c], eax
mov word [esp + 0x22], di
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 2]
push ecx
lea edx, [esp + 0x26]
push edx
call fcn.004010a0
mov ecx, dword [0x224e340]
add esp, 0x18
push 0
add ebx, 4
push ebx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x597f55
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x597ee1
cmp eax, 0x3e5
jne 0x597f55
movzx eax, word [esp + 0xc]
mov edx, dword [0x224e348]
mov ecx, eax
mov ebx, ecx
shr ecx, 2
lea edi, [edx + 0x2242320]
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
add edx, eax
and ecx, 3
cmp edx, 0x4000
rep movsb byte es:[edi], byte [esi]
mov dword [0x224e348], edx
jbe 0x597f3b
push 0
push str.Socket
push str.Send_Error___
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x224e348], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x224a330]
mov eax, dword [0x224e340]
push 0x23
push 0x2b10
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x597f60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.005cd2a0
mov eax, dword [0x70c3c4]
test eax, eax
push ebx
push esi
push edi
je 0x59806f
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [esi]
push ebx
push esi
push eax
push str.SEND__
call fcn.00597d70
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea eax, [ebx + 2]
mov word [esp + 0x20], ax
lea edi, [esp + 0x22]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], eax
mov ecx, edx
lea eax, [esp + 0x22]
and ecx, 3
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004010a0
mov edx, dword [0x224e340]
add esp, 0x18
push 0
add ebx, 2
push ebx
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x59806f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x597ffb
cmp eax, 0x3e5
jne 0x59806f
movzx eax, word [esp + 0xc]
mov edx, dword [0x224e348]
mov ecx, eax
mov ebx, ecx
shr ecx, 2
lea edi, [edx + 0x2242320]
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
add edx, eax
and ecx, 3
cmp edx, 0x4000
rep movsb byte es:[edi], byte [esi]
mov dword [0x224e348], edx
jbe 0x598055
push 0
push str.Socket
push str.Send_Error___
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x224e348], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x224a330]
mov ecx, dword [0x224e340]
push 0x23
push 0x2b10
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59fa90
Capabilities:
Initialize winsock library

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
sub esp, 0x190
push esi
push 0
push ecx
push 0
push eax
push 0
push 0
push 0
push 0
push 0xc0000000
push 0x6bb5d5
push str.BUTTON
push 0
mov dword [0x224a334], eax
mov dword [0x224a338], ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0x59f860
mov esi, eax
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [esp + 4]
push eax
push 0x202
mov dword [0x224a330], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor al, al
pop esi
add esp, 0x190
ret

Function at 0x59fcc0
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 0x808
push esi
mov esi, dword [esp + 0x814]
push 5
push esi
push str.data_
call fcn.005e0a1f
add esp, 0xc
test eax, eax
je 0x59fd00
push 5
push esi
push 0x6bc710
call fcn.005e0a1f
add esp, 0xc
test eax, eax
je 0x59fd00
xor al, al
pop esi
add esp, 0x808
ret
push edi
mov edi, dword [0x224e354]
test edi, edi
jne 0x59fd16
pop edi
xor al, al
pop esi
add esp, 0x808
ret
lea eax, [esi + 5]
lea edx, [esp + 0x10]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x59fd20
push ebx
xor ebx, ebx
xor ecx, ecx
mov esi, edi
xor eax, eax
mov dl, byte [esp + ebx + 0x14]
cmp dl, 0x2f
je 0x59fd49
cmp dl, 0x5c
je 0x59fd49
test dl, dl
je 0x59fd96
inc ebx
inc eax
jmp 0x59fd33
test eax, eax
lea edx, [esp + ecx + 0x14]
mov ecx, 0x1505
je 0x59fd71
mov edi, eax
movsx eax, byte [edx]
inc edx
cmp eax, 0x40
jle 0x59fd69
cmp eax, 0x5b
jge 0x59fd69
add eax, 0x20
imul ecx, ecx, 0x21
add ecx, eax
dec edi
jne 0x59fd58
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x2c]
call fcn.00564240
mov eax, dword [eax]
cmp eax, dword [esi + 0x30]
je 0x59fdf6
mov esi, dword [eax + 0x10]
inc ebx
mov ecx, ebx
jmp 0x59fd31
test eax, eax
je 0x59fdf6
push eax
lea edx, [esp + ecx + 0x18]
push edx
call fcn.0040d040
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x20]
call fcn.00564240
mov eax, dword [eax]
cmp eax, dword [esi + 0x24]
je 0x59fdf6
mov esi, dword [eax + 0x10]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x818]
push 0
push edx
mov edx, dword [ecx]
push eax
push edx
call fcn.005ce2a2
add esp, 0x10
pop ebx
pop edi
mov dword [0x224e350], esi
mov al, 1
pop esi
add esp, 0x808
ret
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x808
ret
Function at 0x5a26e0
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 0x808
push esi
mov esi, eax
push 5
push esi
push str.data_
call fcn.005e0a1f
add esp, 0xc
test eax, eax
je 0x5a271b
push 5
push esi
push 0x6bc710
call fcn.005e0a1f
add esp, 0xc
test eax, eax
je 0x5a271b
xor al, al
pop esi
add esp, 0x808
ret
push edi
mov edi, dword [0x224e364]
test edi, edi
jne 0x5a2731
pop edi
xor al, al
pop esi
add esp, 0x808
ret
lea eax, [esi + 5]
lea edx, [esp + 0x10]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5a2740
push ebx
xor ebx, ebx
xor ecx, ecx
mov esi, edi
xor eax, eax
mov dl, byte [esp + ebx + 0x14]
cmp dl, 0x2f
je 0x5a2769
cmp dl, 0x5c
je 0x5a2769
test dl, dl
je 0x5a27b6
inc ebx
inc eax
jmp 0x5a2753
test eax, eax
lea edx, [esp + ecx + 0x14]
mov ecx, 0x1505
je 0x5a2791
mov edi, eax
movsx eax, byte [edx]
inc edx
cmp eax, 0x40
jle 0x5a2789
cmp eax, 0x5b
jge 0x5a2789
add eax, 0x20
imul ecx, ecx, 0x21
add ecx, eax
dec edi
jne 0x5a2778
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x2c]
call fcn.00564240
mov eax, dword [eax]
cmp eax, dword [esi + 0x30]
je 0x5a2812
mov esi, dword [eax + 0x10]
inc ebx
mov ecx, ebx
jmp 0x5a2751
push eax
lea edx, [esp + ecx + 0x18]
push edx
call fcn.0040d040
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x20]
call fcn.00564240
mov eax, dword [eax]
cmp eax, dword [esi + 0x24]
je 0x5a2812
mov esi, dword [eax + 0x10]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x818]
push 0
push edx
mov edx, dword [ecx]
push eax
push edx
call fcn.005ce2a2
add esp, 0x10
pop ebx
pop edi
mov dword [0x224e368], esi
mov al, 1
pop esi
add esp, 0x808
ret
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x808
ret

Function at 0x5a4d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b4148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.004441b0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x38]
mov dword [esp + 0x10], eax
push edx
mov dword [esp + 0x1c], ecx
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x20], 0x43480000
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xbf800000
mov dword [esp + 0x30], 0
call fcn.005a4800
test al, al
pop esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
je 0x5a4dbd
call fcn.005bfb50
fld dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8
call fcn.005bfb50
fld dword [0x6bb5fc]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8