joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5212c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 0x3614]
sub esp, 0x114
cmp eax, 0xe00e0804
je 0x5213f1
cmp eax, 0xe0090404
je 0x5213f1
mov eax, dword [ecx + 0x3628]
test eax, eax
je 0x5213f1
mov ecx, eax
push ebx
and ecx, 0xffff
xor bl, bl
cmp ecx, 0x404
jne 0x5213fa
push ebp
push esi
push edi
mov ecx, 0xa
mov esi, str.softwaremicrosoftwindowscurrentversion_
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
and eax, 0xffff0000
movsw word es:[edi], word [esi]
mov ebp, eax
cmp ebp, 0x5010000
movsb byte es:[edi], byte [esi]
mov eax, str.MSTCIPH
jae 0x521336
mov eax, str.TINTLGNT
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x521338
lea edi, [esp + 0x20]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x521346
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
push 0x20019
mov ecx, eax
push 0
lea eax, [esp + 0x2c]
push eax
and ecx, 3
push 0x80000001
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5213e4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.Keyboard_Mapping
push ecx
mov dword [esp + 0x30], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x5213d9
cmp ebp, 0x5000000
mov al, byte [esp + 0x14]
ja 0x5213bf
cmp al, 0x22
je 0x5213d7
cmp al, 0x23
je 0x5213d7
cmp ebp, 0x5010000
je 0x5213cf
cmp ebp, 0x5020000
jne 0x5213d9
cmp al, 0x22
jb 0x5213d9
cmp al, 0x24
ja 0x5213d9
mov bl, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x114
ret
mov al, 1
add esp, 0x114
ret
mov al, bl
pop ebx
add esp, 0x114
ret
Function at 0x521410
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, ecx
movzx ecx, word [esi + 0x3618]
mov eax, ecx
and eax, 0x3ff
sub eax, 4
push edi
mov edi, 0x6f5a88
je 0x521466
sub eax, 0xd
je 0x521453
dec eax
je 0x521440
mov dword [esi + 0x3624], edi
jmp 0x5214ac
mov byte [esi + 0x361e], 0
mov dword [esi + 0x3624], 0x6f5a9a
jmp 0x5214ac
mov byte [esi + 0x361e], 1
mov dword [esi + 0x3624], 0x6f5aa0
jmp 0x5214ac
shr ecx, 0xa
dec ecx
mov byte [esi + 0x361e], 1
je 0x5214a2
dec ecx
je 0x52147e
mov dword [esi + 0x3624], edi
jmp 0x5214ac
mov ecx, esi
call fcn.00521000
mov eax, dword [esi + 0x3628]
test eax, eax
sete al
mov byte [esi + 0x361e], al
mov dword [esi + 0x3624], 0x6f5a8e
jmp 0x5214ac
mov dword [esi + 0x3624], 0x6f5a94
cmp dword [esi + 0x3624], edi
jne 0x5214f3
movzx edx, word [esi + 0x3618]
push 0xa
lea ecx, [esp + 0x18]
push ecx
push 3
push edx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
movsx ax, byte [esp + 0x14]
mov ecx, dword [esi + 0x3624]
mov word [ecx], ax
movsx dx, byte [esp + 0x15]
push edx
call fcn.005bb19b
mov ecx, dword [esi + 0x3624]
add esp, 4
mov word [ecx + 2], ax
mov edx, dword [esi + 0x3614]
push edx
call sub.imm32.dll_ImmIsIME
test eax, eax
mov eax, dword [esi + 0x3610]
push eax
setne bl
call sub.imm32.dll_ImmGetContext
mov edi, eax
test edi, edi
je 0x52159b
xor ecx, ecx
mov cx, word [esi + 0x3618]
and ecx, 0x3ff
cmp ecx, 4
jne 0x52156a
test bl, bl
je 0x52157f
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push edi
call sub.imm32.dll_ImmGetConversionStatus
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x3610]
and cl, 1
neg cl
push edi
push edx
sbb ecx, ecx
add ecx, 2
mov dword [esi + 0x3620], ecx
call sub.imm32.dll_ImmReleaseContext
pop edi
pop esi
pop ebx
add esp, 0x14
ret
test bl, bl
je 0x52157f
push edi
call sub.imm32.dll_ImmGetOpenStatus
test eax, eax
je 0x52157f
mov eax, 1
jmp 0x521581
xor eax, eax
mov edx, dword [esi + 0x3610]
push edi
push edx
mov dword [esi + 0x3620], eax
call sub.imm32.dll_ImmReleaseContext
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x3620], 0
cmp dword [0x6f3558], 0xa
jne 0x5215c6
push 0
call dword [sym.imp.user32.dll_GetKeyboardLayout]
sub eax, 0x4190419
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x3620], eax
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x521e40
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x3614], eax
mov eax, dword [0x6f3558]
cmp eax, 7
jne 0x521e63
mov dword [esi + 0x3614], 0xe0080404
jmp 0x521e72
cmp eax, 0xb
jne 0x521e72
mov dword [esi + 0x3614], 0x41f041f
xor eax, eax
mov ax, word [esi + 0x3614]
mov word [esi + 0x3618], ax
push eax
call fcn.005215e0
push eax
call fcn.005216c0
add esp, 8
push 4
push 0
mov word [esi + 0x361a], ax
call dword [sym.imp.user32.dll_GetKeyboardLayout]
push eax
call sub.imm32.dll_ImmGetProperty
shr eax, 0x13
and al, 1
mov ecx, esi
mov byte [esi + 0x361c], al
call fcn.00521410
mov ecx, esi
call fcn.00521000
mov ecx, esi
call fcn.00521200
mov dword [esi + 0xcc], 1
pop esi
ret 8
Function at 0x5241f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
push 0
mov edi, ecx
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x52426b
push ebx
push 0xd
call dword [sym.imp.user32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x524263
push ebx
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x524263
cmp word [eax], 0
je 0x52425c
push esi
mov esi, eax
xor eax, eax
mov ax, word [esi]
mov ecx, edi
push eax
call fcn.00523930
test al, al
jne 0x52425b
xor edx, edx
mov dx, word [esi]
mov ecx, edi
push edx
call fcn.00521ad0
test eax, eax
je 0x524252
push edx
push 1
lea ecx, [edi + 0x84]
call fcn.005232b0
add esi, 2
cmp word [esi], 0
jne 0x524222
pop esi
push ebx
call dword [sym.imp.kernel32.dll_GlobalUnlock]
pop ebx
pop edi
jmp dword [sym.imp.user32.dll_CloseClipboard]
pop edi
ret

Function at 0x524670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69e950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov edx, 7
mov dword [eax + 0x80], edx
mov dword [eax + 0x7c], ecx
mov word [eax + 0x6c], cx
mov dword [eax + 0x9c], edx
mov dword [eax + 0x98], ecx
mov word [eax + 0x88], cx
mov dword [eax + 0xb8], 0xf
mov dword [eax + 0xb4], ecx
mov byte [eax + 0xa4], cl
mov dword [eax + 0x30f4], edx
mov dword [eax + 0x30f0], ecx
mov word [eax + 0x30e0], cx
mov dword [eax + 0x30fc], ecx
mov dword [eax + 0x3100], ecx
mov dword [eax + 0x3104], ecx
mov edx, 1
mov dword [eax + 0x3630], ecx
mov dword [eax + 0x3620], ecx
mov dword [eax + 0x28], ecx
mov byte [eax], cl
mov byte [eax + 0x30], cl
mov dword [eax + 0x34], ecx
mov dword [eax + 0x360c], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov byte [eax + 0xd0], cl
mov dword [eax + 0x3634], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 0x24], 0x14
mov dword [eax + 0x2c], edx
mov dword [eax + 4], 0x1f4
mov dword [eax + 0x3608], edx
mov dword [eax + 0xc4], 0xffffffff
mov dword [eax + 0xc8], 0xffffffff
mov dword [eax + 0xcc], edx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x526b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69ea51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0xc
mov dword [esp + 0x10], edi
lea esi, [edi + 0x14]
call fcn.005b8072
mov dword [esi + 0x10], eax
xor ebx, ebx
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x10]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 4], esi
mov dword [esi + 8], esi
mov dword [esi + 0xc], esi
push 0xc
mov dword [esp + 0x20], ebx
lea esi, [edi + 0x30]
call fcn.005b8072
mov dword [esi + 0x10], eax
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x14], ecx
add esp, 8
mov dword [esi + 0x18], ebx
mov dword [esi + 4], esi
mov dword [esi + 8], esi
mov dword [esi + 0xc], esi
lea ecx, [edi + 0x4c]
mov byte [esp + 0x18], 1
call fcn.00444180
lea ecx, [edi + 0x5c]
mov byte [esp + 0x18], 2
call fcn.00525a70
mov ecx, dword [esp + 0x10]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 4], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x526c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x69ea8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esp + 0x14], 3
call fcn.00526540
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 2
call fcn.00525b10
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.00444220
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.004449f0
lea ecx, [edi + 0x10]
call fcn.00442ec0
add esi, 0x14
mov ecx, esi
call fcn.004449f0
lea ecx, [esi + 0x10]
call fcn.00442ec0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x536360
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x536419
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x536419
push esi
lea eax, [esp + 0x10]
push eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x18], eax
jbe 0x53640d
push eax
call fcn.005b8072
mov esi, eax
add esp, 4
test esi, esi
jne 0x5363ac
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x18]
push esi
push ecx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x536404
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push eax
push 0x6a7608
push esi
mov dword [esp + 0x1c], 0
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x536404
mov eax, dword [esp + 0xc]
test eax, eax
je 0x536404
mov ecx, dword [eax + 8]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 0xc]
push esi
mov dword [ebx], edx
call fcn.005b806d
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
push esi
call fcn.005b806d
add esp, 4
pop esi
pop edi
mov eax, 0x80004005
pop ebx
add esp, 8
ret
pop edi
mov eax, 0x80070057
pop ebx
add esp, 8
ret
Function at 0x541550
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x541701
cmp word [esi + 0x1c], 0
jne 0x5416fd
mov eax, dword [0x703a94]
test eax, eax
je 0x5415b4
mov eax, dword [esi + 0x10]
test eax, eax
mov word [esi + 0x1c], 1
je 0x541595
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObjectEx]
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x541530
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
pop ecx
ret
movzx eax, byte [esi + 0xc]
cmp eax, 3
ja case.default.0x5415c1
jmp dword [eax*4 + 0x541708]
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x5415f6
test al, al
jne 0x5415e7
push str.humf_action.ALT
push str.data_Character_Human
jmp 0x5416dc
push str.humm_action.ALT
push str.data_Character_Human
jmp 0x5416dc
test al, al
jne 0x541609
push str.huwf_action.ALT
push str.data_Character_Human
jmp 0x5416dc
push str.huwm_action.ALT
push str.data_Character_Human
jmp 0x5416dc
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x541646
test al, al
jne 0x541637
push str.elmr_action.ALT
push str.data_Character_Elf
jmp 0x5416dc
push str.elmm_action.ALT
push str.data_Character_Elf
jmp 0x5416dc
test al, al
jne 0x541659
push str.elwr_action.ALT
push str.data_Character_Elf
jmp 0x5416dc
push str.elwm_action.ALT
push str.data_Character_Elf
jmp 0x5416dc
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x54168d
test al, al
jne 0x541681
push str.demf_action.ALT
push str.data_Character_DeathEater
jmp 0x5416dc
push str.demr_action.ALT
push str.data_Character_DeathEater
jmp 0x5416dc
test al, al
jne 0x54169d
push str.dewf_action.ALT
push str.data_Character_DeathEater
jmp 0x5416dc
push str.dewr_action.ALT
push str.data_Character_DeathEater
jmp 0x5416dc
mov al, byte [esi + 0xd]
test al, al
mov al, byte [esi + 0xe]
mov ecx, esi
jne 0x5416c7
test al, al
jne 0x5416c0
push str.vimr_action.ALT
jmp 0x5416d7
push str.vimm_action.ALT
jmp 0x5416d7
test al, al
jne 0x5416d2
push str.viwr_action.ALT
jmp 0x5416d7
push str.viwm_action.ALT
push str.data_Character_Vile
call fcn.005410c0
xor edx, edx
mov dl, byte [esi + 0xe]
xor eax, eax
mov al, byte [esi + 0xd]
xor ecx, ecx
mov cl, byte [esi + 0xc]
push edx
push eax
push ecx
mov ecx, 0x21f3340
call fcn.005383a0
inc word [esi + 0x1c]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x544b60
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp word [esi + 0x5dc], 0
jne 0x544c3f
mov eax, dword [0x703a94]
test eax, eax
je 0x544c38
mov eax, dword [esi + 0x104]
test eax, eax
mov word [esi + 0x5dc], 1
je 0x544baa
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObjectEx]
mov eax, dword [esi + 0x104]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x544bc5
push eax
push str.data_Effect
lea ecx, [esi + 0x108]
call fcn.00549130
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x544be0
push eax
push str.data_Effect
lea ecx, [esi + 0x234]
call fcn.00549130
mov eax, dword [esi + 0xec]
test eax, eax
je 0x544bfb
push eax
push str.data_Effect
lea ecx, [esi + 0x360]
call fcn.00549130
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x544c16
push eax
push str.data_Effect
lea ecx, [esi + 0x48c]
call fcn.00549130
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x544b40
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x104], eax
mov eax, esi
pop esi
pop ecx
ret
mov ecx, esi
call fcn.00544690
inc word [esi + 0x5dc]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x54bac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x44]
push eax
lea ecx, [esi + 0x38]
push ecx
lea edx, [esi + 0x2c]
push edx
mov ecx, 0x21f1c78
call fcn.00530ec0
mov ecx, dword [esi + 0xf0]
test ecx, ecx
je 0x54bb5c
mov eax, dword [esi + 0xf4]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x54bb5c
mov eax, dword [esi + 0x104]
cmp eax, 0xdc
jge 0x54bb6e
mov ecx, dword [esi + 0x1dac8]
imul eax, eax, 0x12c
mov edx, dword [esi + 0xf0]
mov ebx, dword [edx + ecx*4]
add eax, 0x21f7f78
mov edi, eax
mov eax, dword [edi + 0xc]
test eax, eax
lea ecx, [edx + ecx*4]
jne 0x54bb2e
mov ecx, edi
call fcn.00548840
test ebx, ebx
jl 0x54bb41
cmp ebx, dword [edi + 8]
jge 0x54bb41
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + ebx*4]
test ecx, ecx
jne 0x54bb55
mov eax, dword [0x21f1c70]
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x104]
jmp 0x54bb6e
call fcn.0052d0f0
jmp 0x54bb6e
mov eax, dword [0x21f1c70]
mov edx, dword [eax]
push 0
push 0
push eax
call dword [edx + 0x104]
mov edx, dword [esi + 0xc8]
mov eax, dword [0x21f1c70]
mov ecx, dword [eax]
shl edx, 5
mov edx, dword [edx + 0x6b7d44]
push edx
push 0x13
push eax
call dword [ecx + 0xe4]
mov edx, dword [esi + 0xcc]
mov eax, dword [0x21f1c70]
mov ecx, dword [eax]
shl edx, 5
mov edx, dword [edx + 0x6b7d44]
push edx
push 0x14
push eax
call dword [ecx + 0xe4]
mov eax, dword [esi + 0x1dad0]
test eax, eax
je 0x54bbcc
mov eax, dword [esi + 0x17c]
test eax, eax
jne 0x54bbcc
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.0054a1a0
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.0054a600
Function at 0x57a840
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push 0
push 1
push 2
call dword [sym.imp.ws2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x2234888], eax
jne 0x57a85f
mov al, 1
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
push eax
mov word [esp + 8], 2
call dword [sym.imp.ws2_32.dll_htons]
mov ecx, dword [esp + 0x18]
push ecx
mov word [esp + 0xa], ax
call dword [sym.imp.ws2_32.dll_inet_addr]
push 4
lea edx, [esp + 4]
push edx
push 0xffffff7f
mov dword [esp + 0x14], eax
mov eax, dword [0x2234888]
push 0xffff
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.ws2_32.dll_setsockopt]
mov edx, dword [0x2234888]
push 0x10
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x57a8c9
mov al, 2
add esp, 0x14
ret
mov eax, dword [0x2230878]
mov ecx, dword [0x2234888]
push 0x21
push 0x2b10
push eax
push ecx
mov word [0x222c868], 0
call dword [sym.imp.ws2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
setne al
dec al
and eax, 3
add esp, 0x14
ret

Function at 0x5871e0
Capabilities:
Initialize winsock library

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
sub esp, 0x190
push esi
push 0
push ecx
push 0
push eax
push 0
push 0
push 0
push 0
push 0xc0000000
push 0x6a75d5
push str.BUTTON
push 0
mov dword [0x223087c], eax
mov dword [0x2230880], ecx
call dword [sym.imp.user32.dll_CreateWindowExA]
push 0x586fb0
mov esi, eax
push 0xfffffffffffffffc
push esi
call dword [sym.imp.user32.dll_SetWindowLongA]
lea eax, [esp + 4]
push eax
push 0x202
mov dword [0x2230878], esi
call dword [sym.imp.ws2_32.dll_WSAStartup]
xor al, al
pop esi
add esp, 0x190
ret
Function at 0x587250
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.005b89a0
mov eax, dword [0x6f66dc]
test eax, eax
push ebx
push esi
push edi
je 0x587365
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push esi
push edi
push str.SEND__
call fcn.00586ee0
lea eax, [ebx + 4]
mov word [esp + 0x20], ax
mov dword [esp + 0x1c], eax
mov word [esp + 0x22], di
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 2]
push ecx
lea edx, [esp + 0x26]
push edx
call fcn.004010a0
mov ecx, dword [0x2234888]
add esp, 0x18
push 0
add ebx, 4
push ebx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x587365
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x5872f1
cmp eax, 0x3e5
jne 0x587365
movzx eax, word [esp + 0xc]
mov edx, dword [0x2234890]
mov ecx, eax
mov ebx, ecx
shr ecx, 2
lea edi, [edx + 0x2228868]
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
add edx, eax
and ecx, 3
cmp edx, 0x4000
rep movsb byte es:[edi], byte [esi]
mov dword [0x2234890], edx
jbe 0x58734b
push 0
push str.Socket
push str.Send_Error___
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov dword [0x2234890], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x2230878]
mov eax, dword [0x2234888]
push 0x23
push 0x2b10
push edx
push eax
call dword [sym.imp.ws2_32.dll_WSAAsyncSelect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x587370
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.005b89a0
mov eax, dword [0x6f66dc]
test eax, eax
push ebx
push esi
push edi
je 0x58747f
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [esi]
push ebx
push esi
push eax
push str.SEND__
call fcn.00586ee0
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea eax, [ebx + 2]
mov word [esp + 0x20], ax
lea edi, [esp + 0x22]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], eax
mov ecx, edx
lea eax, [esp + 0x22]
and ecx, 3
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004010a0
mov edx, dword [0x2234888]
add esp, 0x18
push 0
add ebx, 2
push ebx
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x58747f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x58740b
cmp eax, 0x3e5
jne 0x58747f
movzx eax, word [esp + 0xc]
mov edx, dword [0x2234890]
mov ecx, eax
mov ebx, ecx
shr ecx, 2
lea edi, [edx + 0x2228868]
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
add edx, eax
and ecx, 3
cmp edx, 0x4000
rep movsb byte es:[edi], byte [esi]
mov dword [0x2234890], edx
jbe 0x587465
push 0
push str.Socket
push str.Send_Error___
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov dword [0x2234890], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x2230878]
mov ecx, dword [0x2234888]
push 0x23
push 0x2b10
push eax
push ecx
call dword [sym.imp.ws2_32.dll_WSAAsyncSelect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58bd50
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 0x808
push esi
mov esi, dword [esp + 0x814]
push 5
push esi
push str.data_
call fcn.005cc11f
add esp, 0xc
test eax, eax
je 0x58bd90
push 5
push esi
push 0x6a842c
call fcn.005cc11f
add esp, 0xc
test eax, eax
je 0x58bd90
xor al, al
pop esi
add esp, 0x808
ret
push edi
mov edi, dword [0x2234898]
test edi, edi
jne 0x58bda6
pop edi
xor al, al
pop esi
add esp, 0x808
ret
lea eax, [esi + 5]
lea edx, [esp + 0x10]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x58bdb0
push ebx
xor ebx, ebx
xor ecx, ecx
mov esi, edi
xor eax, eax
mov dl, byte [esp + ebx + 0x14]
cmp dl, 0x2f
je 0x58bdd9
cmp dl, 0x5c
je 0x58bdd9
test dl, dl
je 0x58be26
inc ebx
inc eax
jmp 0x58bdc3
test eax, eax
lea edx, [esp + ecx + 0x14]
mov ecx, 0x1505
je 0x58be01
mov edi, eax
movsx eax, byte [edx]
inc edx
cmp eax, 0x40
jle 0x58bdf9
cmp eax, 0x5b
jge 0x58bdf9
add eax, 0x20
imul ecx, ecx, 0x21
add ecx, eax
dec edi
jne 0x58bde8
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x2c]
call fcn.00529da0
mov eax, dword [eax]
cmp eax, dword [esi + 0x30]
je 0x58be86
mov esi, dword [eax + 0x10]
inc ebx
mov ecx, ebx
jmp 0x58bdc1
test eax, eax
je 0x58be86
push eax
lea edx, [esp + ecx + 0x18]
push edx
call fcn.0040b5a0
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x20]
call fcn.00529da0
mov eax, dword [eax]
cmp eax, dword [esi + 0x24]
je 0x58be86
mov esi, dword [eax + 0x10]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x818]
push 0
push edx
mov edx, dword [ecx]
push eax
push edx
call fcn.005b99a2
add esp, 0x10
pop ebx
pop edi
mov dword [0x2234894], esi
mov al, 1
pop esi
add esp, 0x808
ret
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x808
ret