joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00542c90
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x4e6857
cmp dword [esi + 0x708], 1
jne 0x4e6857
push ebp
push 0x469c40
mov edx, 0x28a
mov ecx, edi
call fcn.004675d0
mov ebx, eax
cmp ebx, ebp
jle 0x4e6852
mov ecx, esi
call fcn.00542ed0
test eax, eax
je 0x4e6852
test bl, 0x40
je 0x4e66b6
mov dword [0x5ab734], ebp
mov dword [0x5ab738], ebp
mov dword [0x5ab73c], ebp
test bl, 0x20
je 0x4e66f6
push 0x5a98a0
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004b1bc0
mov eax, dword [0x5ab734]
mov dword [esi + 0x740], eax
mov ecx, dword [0x5ab738]
mov dword [esi + 0x728], ecx
mov edx, dword [0x5ab73c]
mov dword [esi + 0x774], edx
jmp 0x4e6828
test bl, 1
je 0x4e6703
mov dword [esi + 0x740], ebp
jmp 0x4e6730
test bl, 2
je 0x4e6714
mov dword [esi + 0x740], 1
jmp 0x4e6730
test bl, 4
je 0x4e6725
mov dword [esi + 0x740], 2
jmp 0x4e6730
mov eax, dword [0x5ab734]
mov dword [esi + 0x740], eax
test bl, bl
jns 0x4e6740
mov dword [esi + 0x774], 1
jmp 0x4e6746
mov dword [esi + 0x774], ebp
test bl, 0x10
je 0x4e6786
push 0x5a98a0
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004b1bc0
mov ecx, dword [esi + 0x740]
mov dword [0x5ab734], ecx
mov edx, dword [esi + 0x728]
mov dword [0x5ab738], edx
mov eax, dword [esi + 0x774]
mov dword [0x5ab73c], eax
jmp 0x4e6823
mov eax, dword [esi + 0x740]
cmp eax, ebp
jne 0x4e67ac
mov ecx, dword [0x5863a4]
mov dx, word [0x5863a8]
mov dword [0x5aa640], ecx
mov word [0x5aa644], dx
jmp 0x4e67d3
cmp eax, 1
jne 0x4e67c9
mov eax, dword [0x586320]
mov cl, byte [0x586324]
mov dword [0x5aa640], eax
mov byte [0x5aa644], cl
jmp 0x4e67d3
mov dword [0x5aa640], 0x66666f
mov eax, 0x5aa640
lea edx, [eax + 1]
jmp 0x4e67e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e67e0
mov ecx, dword [esi + 0x728]
sub eax, edx
mov edx, dword [esi + 0x774]
push edx
push ecx
lea edx, [eax + 0x5aa640]
push str.__d__d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x5a98a0
push 0x5aa640
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004b1bc0
call fcn.004b5990
mov esi, dword [0x5b430c]
cmp esi, ebp
je 0x4e6852
mov edi, 1
cmp dword [esi + 0x708], edi
jne 0x4e6848
xor edx, edx
mov ecx, esi
call fcn.004e6300
mov esi, dword [esi + 0xd9c]
cmp esi, ebp
jne 0x4e6837
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.0041d520

Function at 0x4e8730
Capabilities:
Capture screenshot
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.004e27f0
mov esi, eax
xor ecx, ecx
test esi, esi
jne 0x4e8748
pop edi
pop esi
jmp fcn.0041d520
call fcn.00531cf0
mov eax, dword [0x5b4328]
test eax, eax
jne 0x4e8773
push esi
push 0
push 0
mov edx, 7
mov ecx, 0x5890e0
call fcn.00548f10
test eax, eax
mov dword [0x5b4328], eax
je 0x4e878b
call fcn.004e7820
test edi, edi
je 0x4e878b
mov ecx, dword [0x5b4328]
pop edi
xor edx, edx
pop esi
jmp fcn.004973e0
pop edi
pop esi
ret
Function at 0x4e8790
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x3f4
push ebp
mov ebp, ecx
call fcn.004e2760
test eax, eax
je 0x4e88cc
push ebx
mov ecx, ebp
call fcn.004e6ab0
xor ebx, ebx
push ebx
lea eax, [esp + 0xc]
push 0x583f60
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x5a98a0
push 0x3e7
lea ecx, [esp + 0x1c]
push ecx
push 0x583b74
lea edx, [esp + 0x18]
mov ecx, 0x589c78
call fcn.004b1f10
mov al, byte [esp + 0x14]
test al, al
je 0x4e88ba
push esi
push edi
lea edx, [esp + 0x1c]
push str.WAVE2:
push edx
call fcn.00570b40
mov edi, eax
add esp, 8
test edi, edi
je 0x4e881b
mov byte [edi], 0
mov al, byte [edi + 6]
add edi, 6
test al, al
jne 0x4e881b
xor edi, edi
lea eax, [esp + 0x1c]
push str.WAVE:
push eax
call fcn.00570b40
mov esi, eax
add esp, 8
test esi, esi
je 0x4e8842
mov byte [esi], 0
mov al, byte [esi + 5]
add esi, 5
test al, al
jne 0x4e8842
xor esi, esi
lea ecx, [esp + 0x1c]
push str.NOTE:
push ecx
call fcn.00570b40
add esp, 8
test eax, eax
je 0x4e8867
mov byte [eax], 0
mov cl, byte [eax + 5]
add eax, 5
test cl, cl
jne 0x4e8867
xor eax, eax
push ebp
push edi
push esi
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.004e7c60
inc ebx
push ebx
lea edx, [esp + 0x14]
push 0x583f60
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x5a98a0
push 0x3e7
lea eax, [esp + 0x24]
push eax
push 0x583b74
lea edx, [esp + 0x20]
mov ecx, 0x589c78
call fcn.004b1f10
mov al, byte [esp + 0x1c]
test al, al
jne 0x4e87f4
pop edi
pop esi
mov ecx, dword [ebp + 0x215c]
call fcn.0051fea0
mov dword [ebp + 0x215c], eax
pop ebx
pop ebp
add esp, 0x3f4
ret
Function at 0x4f4020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push 0
push 0
push 0x18b
mov ebp, ecx
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4f404d
pop ebp
xor ecx, ecx
pop ebx
add esp, 4
jmp fcn.0041d520
dec ebx
mov dword [esp + 8], 0
js 0x4f416e
push esi
push edi
mov edi, edi
push 0x5a0bc8
push ebx
push 0x189
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, 0xffffffff
je 0x4f416c
mov eax, dword [0x5ae1c4]
xor edi, edi
test eax, eax
jne 0x4f40ec
mov esi, dword [0x59fa3c]
test esi, esi
je 0x4f416c
lea esp, [esp]
mov eax, dword [0x5ae1c4]
test eax, eax
je 0x4f40b2
cmp dword [esi + 0x138], 2
jne 0x4f40db
push 0x5c
push esi
call fcn.00570980
add esp, 8
test eax, eax
je 0x4f40db
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x4f40db
push 0x5a0bc8
push eax
call fcn.005809c6
add esp, 8
test eax, eax
je 0x4f410d
mov edi, esi
mov esi, dword [esi + 0x170]
test esi, esi
jne 0x4f40a0
jmp 0x4f416c
mov esi, dword [0x5aed58]
test esi, esi
je 0x4f416c
cmp dword [esi + 0x138], 2
je 0x4f4091
mov edi, esi
mov esi, dword [esi + 0x170]
test esi, esi
jne 0x4f40f6
jmp 0x4f416c
test edi, edi
je 0x4f4129
mov eax, dword [esi + 0x170]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x170], eax
mov dword [esi + 0x170], ecx
jmp 0x4f4161
mov eax, dword [0x5ae1c4]
test eax, eax
jne 0x4f4145
mov edx, dword [0x59fa3c]
mov eax, dword [edx + 0x170]
mov dword [0x59fa3c], eax
jmp 0x4f4157
mov ecx, dword [0x5aed58]
mov edx, dword [ecx + 0x170]
mov dword [0x5aed58], edx
mov eax, dword [esp + 0x10]
mov dword [esi + 0x170], eax
dec ebx
mov dword [esp + 0x10], esi
jns 0x4f4060
pop edi
pop esi
mov eax, dword [0x5ae1c4]
test eax, eax
jne 0x4f41ab
mov edx, dword [esp + 8]
test edx, edx
mov eax, edx
je 0x4f41d2
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x4f4195
mov eax, ecx
test eax, eax
jne 0x4f4181
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [0x59fa3c]
pop ebp
mov dword [eax + 0x170], ecx
mov dword [0x59fa3c], edx
pop ebx
pop ecx
ret
mov eax, dword [0x5aed58]
test eax, eax
je 0x4f41d2
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x4f41c8
mov eax, ecx
test eax, eax
jne 0x4f41b4
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 8]
mov dword [eax + 0x170], edx
pop ebp
pop ebx
pop ecx
ret
Function at 0x4fb3c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
push esi
mov esi, edx
mov dword [esp + 0x10], ecx
mov ecx, esi
mov dword [esp + 8], esi
call fcn.004e2760
test eax, eax
je 0x4fb538
push ebx
mov ebx, dword [0x5ae208]
push ebp
push edi
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x18], edi
je 0x4fb535
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
push edi
push 0x18b
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4fb413
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x4fb517
jmp 0x4fb425
mov esi, dword [esp + 0x14]
push 0
push edi
push 0x187
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
je 0x4fb502
test eax, eax
je 0x4fb502
push 0
push edi
push 0x199
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
je 0x4fb502
mov esi, dword [esi + 0x217c]
test esi, esi
je 0x4fb502
cmp esi, eax
je 0x4fb47a
mov esi, dword [esi + 0x264]
test esi, esi
jne 0x4fb467
jmp 0x4fb502
mov ecx, dword [esi + 0x1ec]
mov eax, dword [esp + 0x1c]
add eax, ecx
test eax, eax
mov dword [esi + 0x1ec], eax
jge 0x4fb49a
mov dword [esi + 0x1ec], 0
mov edx, dword [esi + 0x1ec]
mov eax, 0x2328
cmp edx, eax
jle 0x4fb4af
mov dword [esi + 0x1ec], eax
cmp ecx, dword [esi + 0x1ec]
je 0x4fb502
mov ecx, dword [esp + 0x14]
cmp esi, dword [ecx + 0x217c]
jne 0x4fb4fa
mov eax, dword [esi + 4]
test eax, eax
je 0x4fb4d8
mov edx, dword [0x5b4314]
push eax
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x1ec]
push 0x4f93a0
push eax
call fcn.0041eda0
mov ecx, dword [0x5b4314]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 4], eax
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x4fb421
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4fb525
pop edi
pop ebp
pop ebx
xor ecx, ecx
pop esi
add esp, 0x10
jmp fcn.0041d520
mov ecx, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
jmp fcn.004fa820
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x4fcf80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004e2760
test eax, eax
je 0x4fd16d
push ebx
mov ebx, dword [0x5ae208]
push ebp
xor ebp, ebp
cmp ebx, ebp
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], 0xffffffff
je 0x4fd16a
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebp
push ebp
push 0x18b
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x4fcfdb
mov dword [esp + 0x14], ebp
mov eax, ebp
test eax, eax
jle 0x4fd050
nop
push 0
push ebp
push 0x187
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
je 0x4fd03d
test eax, eax
je 0x4fd03d
cmp dword [esp + 0x18], 0xffffffff
jne 0x4fd001
mov dword [esp + 0x18], ebp
push 0
push ebp
push 0x199
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
je 0x4fd03d
mov ecx, dword [esi + 0x217c]
mov esi, ecx
test esi, esi
mov dword [esp + 0x1c], 0
je 0x4fd039
cmp esi, eax
je 0x4fd05e
mov dword [esp + 0x1c], esi
mov esi, dword [esi + 0x264]
test esi, esi
jne 0x4fd027
mov esi, dword [esp + 0x10]
inc ebp
cmp ebp, dword [esp + 0x14]
jl 0x4fcfe0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4fd0fc
pop edi
pop ebp
pop ebx
xor ecx, ecx
pop esi
add esp, 0x18
jmp fcn.0041d520
test esi, esi
je 0x4fd039
cmp esi, ecx
jne 0x4fd06e
mov dword [esp + 0x24], 1
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4fd084
lea eax, [esi + 0x74]
push eax
call fcn.005725fc
add esp, 4
mov eax, dword [esi + 0x1f8]
test eax, eax
lea ecx, [esi + 0x1f8]
je 0x4fd099
call fcn.004c8280
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4fd0b5
mov ecx, dword [esi + 0x264]
push esi
mov dword [eax + 0x264], ecx
call fcn.005700aa
jmp 0x4fd0d5
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x217c]
mov esi, dword [eax + 0x264]
push eax
call fcn.005700aa
mov eax, dword [esp + 0x14]
mov dword [eax + 0x217c], esi
mov ecx, dword [0x5ae208]
add esp, 4
push 0
push ebp
push 0x182
push 0x65
push ecx
mov dword [esp + 0x34], 1
call edi
mov esi, dword [esp + 0x10]
jmp 0x4fd03e
push 0xffffffffffffffff
push 0
push 0x185
push 0x65
push ebx
call edi
mov ebp, dword [esp + 0x18]
test ebp, ebp
jl 0x4fd136
push 0
push ebp
push 0x19e
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
jne 0x4fd129
dec ebp
jns 0x4fd112
jmp 0x4fd136
push ebp
push 1
push 0x185
push 0x65
push ebx
call edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4fd155
mov ecx, esi
call fcn.004f9ab0
test eax, eax
jle 0x4fd155
mov edx, esi
mov ecx, 2
call fcn.004f9c60
mov ecx, esi
call fcn.004fa820
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x18
jmp fcn.004fb2c0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x18
ret
Function at 0x504920
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5ae598]
sub esp, 0x10
test eax, eax
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_htons]
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_bind]
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x5049a7
mov al, byte [0x5ae5a0]
test al, al
je 0x5049a7
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0x5ae5a0
mov dword [esp + 0x20], eax
mov word [esp + 0x14], 2
call dword [sym.imp.WSOCK32.dll_inet_addr]
push esi
mov dword [esp + 0x18], eax
call ebx
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
mov word [esp + 0x1e], ax
call ebp
test eax, eax
jne 0x504994
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
cmp dword [0x5ae598], 2
jne 0x5049a7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
push esi
mov dword [esp + 0x20], edx
mov word [esp + 0x14], 2
mov dword [esp + 0x18], edx
call ebx
mov word [esp + 0x12], ax
push 0x10
lea eax, [esp + 0x14]
push eax
push edi
call ebp
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x10
ret
Function at 0x508980
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
lea eax, [esp + 0x10]
push eax
push str..html
push bind
mov byte [0x5ae628], 0
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x104
jne 0x508a5f
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0x584d78
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x508a58
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x12c]
push str._s_shellopen
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x12c]
push edx
push bind
call esi
test eax, eax
jne 0x508a58
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push str.command
push edx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x508a51
mov edx, 0x5ae628
lea ecx, [esp + 0x24]
call fcn.00508910
mov eax, dword [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov al, byte [0x5ae628]
test al, al
jne 0x508b05
lea edx, [esp + 0x10]
push edx
push str.htmlfile_shellopen
push bind
call esi
test eax, eax
jne 0x508ab4
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push str.command
push edx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x508aad
mov edx, 0x5ae628
lea ecx, [esp + 0x24]
call fcn.00508910
mov eax, dword [esp + 0x10]
push eax
call ebp
mov al, byte [0x5ae628]
test al, al
jne 0x508b05
lea ecx, [esp + 0x10]
push ecx
push str.http_shellopen
push bind
call esi
test eax, eax
jne 0x508b05
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push str.command
push ecx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x508afe
mov edx, 0x5ae628
lea ecx, [esp + 0x24]
call fcn.00508910
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x508b10
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x5ae730]
sub esp, 0x10c
test al, al
je 0x508b3b
mov edx, 1
mov ecx, 0x5ae730
call fcn.0041fd10
test eax, eax
jne 0x508bc7
mov byte [0x5ae730], al
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
xor edi, edi
lea esp, [esp]
test edi, edi
jne 0x508b60
lea eax, [esp + 0xc]
push eax
push str.mailto_shellopen
jmp 0x508b6a
lea ecx, [esp + 0xc]
push ecx
push str..sta_shellopen
push bind
call esi
test eax, eax
jne 0x508bb0
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push str.command
push ecx
mov dword [esp + 0x20], 0x104
call ebx
test eax, eax
jne 0x508ba5
mov edx, 0x5ae730
lea ecx, [esp + 0x14]
call fcn.00508910
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x5ae730]
test al, al
jne 0x508bc4
test edi, edi
jne 0x508bc4
mov edi, 1
jmp 0x508b50
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x5147e0
Capabilities:
Extract resource via kernel32 functions
Hide graphical window

Disassembly:
mov eax, dword [0x5afbd0]
push esi
push edi
push 1
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x5afbd0]
push 3
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x5afbd0]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5afbd0]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [0x5afbd0]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x65
push ecx
call edi
mov edx, esi
mov ecx, eax
call fcn.0052c810
mov edx, dword [0x5afbd0]
push 0x12c
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
ret
push esi
mov esi, ecx
mov ecx, dword [0x5afbd0]
test ecx, ecx
je 0x514819
mov eax, dword [0x5afbd4]
test eax, eax
jne 0x5147fd
call fcn.0040c710
jmp 0x514813
cmp eax, 1
jne 0x514809
call fcn.004f76f0
jmp 0x514813
cmp eax, 2
jl 0x514819
call fcn.00504f50
mov ecx, dword [0x5afbd0]
mov eax, esi
sub eax, 0
pop esi
je 0x514876
dec eax
je 0x514857
test ecx, ecx
je 0x514842
call fcn.00504d80
mov ecx, dword [0x5afbd4]
cmp ecx, 2
jge 0x51483d
mov ecx, 2
jmp 0x512fc0
cmp dword [0x5afbd4], 2
jge 0x514890
mov dword [0x5afbd4], 2
jmp 0x514890
test ecx, ecx
je 0x51486a
call fcn.004f7570
mov ecx, 1
jmp 0x512fc0
mov dword [0x5afbd4], 1
jmp 0x514890
test ecx, ecx
je 0x514886
call fcn.0040c610
xor ecx, ecx
jmp 0x512fc0
mov dword [0x5afbd4], 0
mov eax, dword [0x59bd14]
test eax, eax
je 0x5148a0
mov eax, dword [0x5b4314]
jmp 0x5148a6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
push 0x5137a0
push eax
mov eax, dword [0x5b4310]
push 0x2e4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
jne 0x5148ca
xor ecx, ecx
jmp fcn.0041d520
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x514eb0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5afc18]
sub esp, 0x3e8
test eax, eax
push ebp
push esi
mov ebp, edx
mov esi, ecx
je 0x514fd4
lea esp, [esp]
cmp eax, esi
je 0x514ee9
mov eax, dword [eax + 0x3cc]
test eax, eax
jne 0x514ed0
pop esi
pop ebp
add esp, 0x3e8
ret 8
mov ecx, dword [esi]
push edi
call fcn.004e2870
mov edi, eax
test edi, edi
je 0x514fd3
push ebx
mov bl, byte [esp + 0x400]
test bl, 1
je 0x514f52
xor edx, edx
mov ecx, 0x1391
call fcn.0041d620
push eax
push 1
push 0
push 1
mov edx, 1
mov ecx, esi
call fcn.00536580
push ebp
lea eax, [esi + 0x234]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x1c]
push str.NOTICE__s_:DCC_Send__s___s__n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.0054b400
test bl, 2
je 0x514f75
mov eax, dword [esi + 0x364]
mov edx, dword [esp + 0x3fc]
xor ecx, ecx
mov cx, word [esi + 0x354]
push edi
push 0
push eax
push ecx
push edx
jmp 0x514fa8
test bl, 4
je 0x514fb6
mov eax, dword [esi + 0x340]
mov ecx, dword [esi + 0x364]
xor edx, edx
mov dx, word [esi + 0x354]
push edi
push eax
push ecx
lea eax, [esi + 0xcc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea ecx, [esi + 4]
lea edx, [esi + 0x234]
call fcn.00514d30
xor edx, edx
mov ecx, 0x1392
call fcn.0041d620
push eax
push 0
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.00536580
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x3e8
ret 8
Function at 0x516360
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
mov ecx, dword [esi + 0x3c8]
call fcn.004e2760
test eax, eax
jne 0x51638a
push 0x583b74
xor edx, edx
mov ecx, esi
call fcn.00515c80
xor eax, eax
pop esi
add esp, 0x1c
ret
push edi
lea edi, [esi + 0xcc]
push edi
mov dword [esi + 0x33c], 1
mov dword [esi + 0x39c], 0
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov ecx, dword [0x5a8b60]
mov dword [esp + 8], eax
jne 0x5163f7
test ecx, ecx
je 0x5163c9
mov edx, dword [0x5a8b5c]
test edx, edx
jne 0x5163f7
mov eax, dword [esi + 0x378]
test eax, eax
je 0x5163ed
mov ecx, dword [esi]
push 8
push 0
push edi
lea edx, [esi + 4]
call fcn.00470c10
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
mov ecx, 0x138d
jmp 0x51651d
test ecx, ecx
je 0x516458
xor edx, edx
mov ecx, 0x138e
call fcn.0041d620
push eax
push 1
push 0
push 1
mov edx, 1
mov ecx, esi
call fcn.00536580
mov eax, dword [esi + 0x340]
test eax, eax
jne 0x51642f
call fcn.0041ec80
mov dword [esi + 0x340], eax
mov eax, dword [esi + 0x3c8]
mov ecx, dword [esi + 0x340]
mov dx, word [esi + 0x354]
push eax
push ecx
push 0
mov ecx, edi
call fcn.0048a3e0
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
lea edx, [esp + 8]
mov dword [esp + 0xc], edx
xor edx, edx
mov dx, word [esi + 0x354]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], ecx
push edx
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.WSOCK32.dll_htons]
mov dx, word [0x59bcfc]
push 1
mov word [esp + 0x1a], ax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 0
push 2
mov dword [esp + 0x24], ecx
mov cx, word [0x59bcf8]
push 0
call fcn.005049f0
cmp eax, 0xffffffff
mov dword [esi + 0x3c4], eax
jne 0x5164d1
mov ecx, 0x138f
jmp 0x51651d
mov ecx, eax
call fcn.0054af90
mov edx, dword [0x5b4314]
mov eax, dword [esi + 0x3c4]
push 0x10
push 0x8014
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edx, dword [esi + 0x3c4]
push 0x10
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x51652e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x51652e
mov ecx, 0x1390
xor edx, edx
call fcn.0041d620
mov ecx, esi
xor edx, edx
push eax
call fcn.00515c80
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret