joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f760
Capabilities:
Clear file content

Disassembly:
sub esp, 0x40c
push esi
mov esi, ecx
mov eax, dword [esi + 0x468]
push edi
xor edi, edi
cmp eax, edi
je 0x48f82d
mov ecx, dword [esi + 0x474]
cmp ecx, 1
jne 0x48f7ff
lea eax, [esi + 0x234]
push eax
lea ecx, [esi + 0x130]
push ecx
lea edx, [esp + 0x34]
push 0x583954
push edx
mov dword [esi + 0x474], 2
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.005815d4
add esp, 0x18
test eax, eax
jne 0x48f7de
mov edx, dword [esi + 0x464]
cmp edx, dword [esp + 0x1c]
jae 0x48f7de
mov dword [esi + 0x468], edi
pop edi
pop esi
add esp, 0x40c
ret
mov eax, dword [esi + 0x468]
cmp eax, 0x2000
jb 0x48f7cf
add eax, 0xffffe000
pop edi
mov dword [esi + 0x468], eax
pop esi
add esp, 0x40c
ret
cmp ecx, 2
mov dword [esi + 0x474], edi
jne 0x48f82d
mov ecx, dword [esi + 0x43c]
push edi
push eax
xor edx, edx
call fcn.0048df30
and eax, edx
cmp eax, 0xffffffff
je 0x48f82d
mov eax, dword [esi + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
add esp, 0x40c
ret
Function at 0x48faf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x5a8ba4]
sub esp, 0x7d0
test eax, eax
push esi
mov esi, ecx
je 0x48fb10
cmp eax, esi
je 0x48fb1a
mov eax, dword [eax + 0x4bc]
test eax, eax
jne 0x48fb02
xor eax, eax
pop esi
add esp, 0x7d0
ret
mov ecx, dword [esi + 0x4b8]
call fcn.004e2760
test eax, eax
je 0x48fb10
mov ecx, dword [0x5b4314]
push edi
push 0
push 0x468620
mov edx, 0xfa
mov dword [0x5a5bec], esi
call fcn.004675d0
mov ecx, esi
mov edi, eax
mov dword [0x5a5bec], 0
call fcn.0048f680
test eax, eax
je 0x48fbbc
mov ecx, dword [esi + 0x4b8]
call fcn.004e2760
test eax, eax
je 0x48fbb3
test edi, edi
jg 0x48fbc7
mov eax, dword [esi + 0x47c]
test eax, eax
je 0x48fbb3
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48fb95
push 0
sub eax, edx
mov edx, dword [esi + 0x4b0]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
xor edx, edx
mov ecx, esi
call fcn.0048fa10
pop edi
xor eax, eax
pop esi
add esp, 0x7d0
ret
cmp edi, 2
jne 0x48fd36
mov eax, dword [esi + 0x47c]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x48fc55
lea eax, [esp + 8]
push str.151_rejected_n
push eax
call edi
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48fbf6
push 0
sub eax, edx
mov edx, dword [esi + 0x4b0]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
lea eax, [esi + 0x68]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x3f8]
push str._s_id__s
push edx
call edi
mov eax, dword [esi + 0x4b8]
add esp, 0x10
push eax
mov edx, 2
lea ecx, [esp + 0x3f4]
call fcn.004ce1b0
lea ecx, [esp + 0x3f0]
push ecx
push str.__ignore__wdu__s
jmp 0x48fc94
lea eax, [esi + 0x68]
push eax
lea ecx, [esi + 4]
push ecx
lea edx, [esp + 0x3f8]
push 0x584c54
push edx
call edi
mov eax, dword [esi + 0x4b8]
add esp, 0x10
push eax
mov edx, 2
lea ecx, [esp + 0x3f4]
call fcn.004ce1b0
lea ecx, [esp + 0x3f0]
push ecx
push str.__ignore__du__s
lea edx, [esp + 0x10]
push edx
call edi
mov eax, dword [esi + 0x4b8]
mov ecx, dword [eax]
add esp, 0xc
push eax
push 0
push 0
push 0
lea edx, [esp + 0x18]
push 0
call fcn.0043e080
xor edx, edx
mov ecx, esi
call fcn.0048fa10
mov esi, dword [0x5a8ba4]
test esi, esi
je 0x48fd2b
jmp 0x48fcd0
mov eax, dword [esi + 0x47c]
test eax, eax
lea eax, [esi + 0x68]
lea ecx, [esi + 4]
push eax
lea edx, [esp + 0xc]
push ecx
je 0x48fced
push str._s_id__s
jmp 0x48fcf2
push 0x584c54
push edx
call edi
add esp, 0x10
push 1
push 0
lea edx, [esp + 0x10]
lea ecx, [esp + 0x3f8]
call fcn.00542310
test eax, eax
je 0x48fd21
xor edx, edx
mov ecx, esi
call fcn.0048fa10
mov esi, dword [0x5a8ba4]
jmp 0x48fd27
mov esi, dword [esi + 0x4bc]
test esi, esi
jne 0x48fcd0
pop edi
xor eax, eax
pop esi
add esp, 0x7d0
ret
mov eax, edi
pop edi
pop esi
add esp, 0x7d0
ret
Function at 0x4916c0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.00571390
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x4918b5
cmp dword [esi + 0x474], ebx
je 0x4916e5
call fcn.0048f760
mov edx, dword [esi + 0x4b0]
push 1
push 1
mov ecx, 0x8012
mov dword [esi + 0x4ac], ebx
call fcn.0054c250
test eax, eax
jne 0x4918b5
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push edi
nop
mov ecx, dword [esi + 0x4b4]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x4b4], ecx
jl 0x491745
mov edx, dword [esi + 0x4b0]
push ebx
push 1
mov ecx, 0x8012
mov dword [esi + 0x4b4], ebx
call fcn.0054c250
test eax, eax
jne 0x4918b3
mov ecx, dword [esi + 0x4b0]
push ebx
push 0x2000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov edi, eax
cmp dword [esi + 0x440], 4
jne 0x4918b3
cmp edi, 0xffffffff
je 0x491876
cmp edi, ebx
jle 0x491896
mov edx, dword [esi + 0x458]
mov ecx, dword [esi + 0x470]
mov eax, dword [esi + 0x468]
add edx, edi
add ecx, edi
cmp eax, ebx
mov dword [esi + 0x458], edx
mov dword [esi + 0x470], ecx
jbe 0x4917b0
mov edx, dword [esi + 0x43c]
push 2
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x43c]
push ebx
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49189d
cmp edi, dword [esp + 0x10]
jne 0x49189d
mov eax, dword [esi + 0x458]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, esi
mov dword [esi + 0x45c], eax
call fcn.0048f8c0
mov ecx, esi
call fcn.00491120
test eax, eax
je 0x4918b3
mov eax, dword [0x5a8ba4]
cmp eax, ebx
je 0x4918b3
cmp eax, esi
je 0x491830
mov eax, dword [eax + 0x4bc]
cmp eax, ebx
jne 0x491815
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2004
ret
mov eax, dword [esi + 0x464]
cmp eax, ebx
jbe 0x491842
cmp dword [esi + 0x458], eax
jae 0x49188a
cmp dword [0x5a8ba8], ebx
je 0x491710
cmp dword [esi + 0x470], 0x7d000
jl 0x491710
mov ecx, dword [esi + 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esi + 0x470], ebx
jmp 0x491710
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4918b3
mov ecx, 0xb67
jmp 0x4918a2
mov edx, dword [esi + 0x464]
mov dword [esi + 0x458], edx
push 0x583b74
jmp 0x4918aa
mov ecx, 0xb65
xor edx, edx
call fcn.0041d620
push eax
mov ecx, esi
xor edx, edx
call fcn.00490190
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2004
ret
Function at 0x491d90
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
sub esp, 0x3e8
push esi
xor esi, esi
test al, al
push edi
lea edx, [esp + 8]
je 0x491daf
inc ecx
mov byte [edx], al
mov al, byte [ecx]
inc edx
inc esi
test al, al
jne 0x491da4
test esi, esi
mov byte [edx], 0
lea edi, [esp + 8]
ja 0x491dc5
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
mov cl, byte [esp + 8]
xor eax, eax
test cl, cl
je 0x491df0
jmp 0x491de0
movzx ecx, cl
xor ecx, eax
shl ecx, 1
inc edi
mov eax, ecx
mov cl, byte [edi]
test cl, cl
jne 0x491de0
pop edi
pop esi
add esp, 0x3e8
ret

Function at 0x496a30
Capabilities:
Capture screenshot

Disassembly:
push esi
call fcn.00542c90
mov esi, eax
test esi, esi
je 0x496a83
mov eax, dword [esi + 0x710]
test eax, eax
jg 0x496a83
mov eax, dword [esi]
cmp eax, dword [0x5b4320]
je 0x496a83
push eax
mov dword [esi + 0x710], 1
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x496a7b
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x496a7b
xor edx, edx
mov ecx, esi
call fcn.00496980
mov ecx, esi
pop esi
jmp fcn.00527d80
pop esi
ret

Function at 0x496a90
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x59bd48]
test eax, eax
je 0x496afd
push esi
mov esi, dword [0x5b430c]
test esi, esi
je 0x496afc
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsIconic]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
lea esp, [esp]
mov ecx, dword [esi]
call fcn.00543010
test eax, eax
je 0x496aef
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x496aef
mov ecx, esi
call fcn.005273b0
test eax, eax
je 0x496aef
mov ecx, dword [esi]
push ecx
call ebp
test eax, eax
je 0x496aef
mov edx, dword [esi]
push 0
push edx
call edi
mov esi, dword [esi + 0xd9c]
test esi, esi
jne 0x496ac0
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x497650
Capabilities:
Capture screenshot
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push edi
mov ebx, edx
mov edi, ecx
call fcn.00542c90
mov ebp, eax
test ebp, ebp
je 0x4976b8
push esi
push edi
call dword [sym.imp.USER32.dll_IsZoomed]
neg eax
sbb eax, eax
neg eax
mov ecx, edi
mov dword [ebp + 0x770], eax
call fcn.00543010
test eax, eax
je 0x4977cb
mov eax, dword [0x59bd48]
test eax, eax
je 0x4977cb
mov ecx, ebp
call fcn.005273b0
test eax, eax
jne 0x4976bc
cmp dword [ebp + 0x708], 3
je 0x4977cb
push 0
push 0
push 0x10
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop edi
pop ebp
pop ebx
ret
test bl, 1
mov ebx, dword [sym.imp.USER32.dll_UpdateWindow]
je 0x497737
call fcn.00513040
test eax, eax
jne 0x497737
call fcn.00496a90
mov eax, dword [0x5b4318]
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call ebp
cmp eax, edi
jne 0x497737
push 2
push eax
call ebp
mov esi, eax
test esi, esi
je 0x49770e
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4977a3
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x4976f4
mov ecx, edi
call fcn.004e28f0
mov esi, eax
mov ecx, esi
call fcn.00543010
test eax, eax
je 0x497737
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.00542c90
mov ecx, eax
call fcn.00527d80
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call ebp
mov ecx, dword [0x5b4318]
push ecx
call ebx
push edi
call ebx
mov edx, dword [0x5b4318]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb
push edx
call esi
push 7
push edi
call ebp
push 0
push edi
call ebp
mov eax, dword [0x5b4318]
push 0
push 1
push 0xb
push eax
call esi
mov ecx, dword [0x5b4318]
push ecx
call ebx
push edi
call ebx
mov ecx, edi
call fcn.00544c90
call fcn.00496a90
call fcn.00544d70
pop esi
pop edi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.00527d80
test esi, esi
je 0x49770e
cmp esi, edi
je 0x49770e
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x497729
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 7
push edi
call ebx
mov ecx, edi
call fcn.00543010
test eax, eax
jne 0x49780e
mov eax, dword [0x5b4330]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x497801
push 0x10
call esi
test ah, ah
jns 0x497809
mov eax, dword [0x5b4330]
test eax, eax
jne 0x49780e
push 0x10
call esi
test ah, ah
jns 0x49780e
push 0
push edi
call ebx
cmp edi, dword [0x5b4320]
jne 0x497820
mov dword [0x5b4320], 0
mov ecx, dword [ebp]
call fcn.00544c90
call fcn.00544d70
mov ecx, edi
call fcn.00542c90
pop esi
pop edi
pop ebp
mov ecx, eax
pop ebx
jmp fcn.00527d80
Function at 0x497930
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ecx
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
cmp edi, dword [0x5a8ce0]
je 0x49799b
push ebx
xor eax, eax
mov bl, 0x20
push esi
mov esi, dword [sym.imp.USER32.dll_VkKeyScanA]
mov dword [0x5a8cdc], eax
mov byte [esp + 0xc], bl
lea esp, [esp]
test bl, bl
je 0x497990
test eax, eax
jne 0x497990
mov eax, dword [esp + 0xc]
push eax
call esi
cmp ah, 6
jne 0x497980
mov eax, 1
mov dword [0x5a8cdc], eax
jmp 0x497985
mov eax, dword [0x5a8cdc]
inc bl
cmp bl, 0xff
mov byte [esp + 0xc], bl
jbe 0x497960
pop esi
pop ebx
mov dword [0x5a8ce0], edi
pop edi
pop ecx
ret
mov eax, dword [0x5a8cdc]
pop edi
pop ecx
ret
Function at 0x49ba40
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword [0x5a9278]
test eax, eax
push esi
mov esi, ecx
je 0x49ba77
mov eax, dword [0x59bb58]
test eax, eax
je 0x49ba60
xor ecx, ecx
call fcn.004e4c50
test eax, eax
je 0x49ba77
push 0
mov edx, esi
mov ecx, 0x5a9280
call fcn.004ef870
test eax, eax
jne 0x49ba7f
mov dword [0x5a9278], eax
xor ecx, ecx
pop esi
jmp fcn.0049b9b0
mov eax, dword [0x59bb60]
or esi, 0xffffffff
cmp eax, esi
jne 0x49bae4
push 0
push 1
push 2
mov dword [0x59bb64], esi
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, esi
mov dword [0x59bb60], eax
je 0x49ba77
mov edx, dword [0x59bb5c]
mov ecx, eax
call fcn.00504920
test eax, eax
je 0x49ba77
mov eax, dword [0x59bb60]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
jne 0x49ba77
mov ecx, dword [0x5b4314]
mov edx, dword [0x59bb60]
push 8
push 0x802a
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
ret
Function at 0x49baf0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x59bb64]
sub esp, 0x17c
cmp eax, 0xffffffff
push ebp
push esi
jne 0x49bbdd
mov eax, dword [0x5b4314]
mov ecx, dword [0x59bb60]
push 0
push 0
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov ecx, dword [0x59bb60]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
cmp eax, 0xffffffff
mov dword [0x59bb64], eax
je 0x49bbdd
mov edx, 0x64
lea ecx, [esp + 0x1c]
call fcn.0041ef30
mov eax, dword [esp + 8]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [0x59bb68], 0xffffffff
je 0x49bbac
cmp eax, 6
jl 0x49bbac
movzx edx, byte [esp + 0x13]
movzx eax, byte [esp + 0x12]
movzx ecx, byte [esp + 0x11]
push edx
movzx edx, byte [esp + 0x14]
push eax
push ecx
push edx
lea eax, [esp + 0x2c]
push 0x58467c
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [0x59bb68], eax
mov ecx, 1
call fcn.004e4c50
mov esi, eax
test esi, esi
jne 0x49bc6c
mov eax, dword [0x59bb58]
test eax, eax
jne 0x49bbe7
call fcn.004e27f0
mov esi, eax
test esi, esi
jne 0x49bc76
mov eax, dword [0x59bb64]
mov ecx, dword [0x59bb58]
test ecx, ecx
je 0x49bc07
xor ecx, ecx
call fcn.004e4c50
test eax, eax
jne 0x49bc02
xor ecx, ecx
call fcn.0049b9b0
pop esi
pop ebp
add esp, 0x17c
ret
mov eax, dword [0x59bb64]
cmp eax, 0xffffffff
je 0x49bc2c
push 1
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov edx, dword [0x59bb64]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [0x59bb64], 0xffffffff
mov eax, dword [0x59bb60]
cmp eax, 0xffffffff
mov dword [0x5a9318], 0
mov dword [0x59bb68], 0xffffffff
je 0x49bd0d
mov ecx, dword [0x5b4314]
push 8
push 0x802a
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
pop ebp
add esp, 0x17c
ret
mov dword [esi + 0x838], 2
mov eax, dword [0x59bb54]
test eax, eax
je 0x49bcdf
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
mov al, byte [esp + 0x1c]
test al, al
je 0x49bcc3
lea edx, [esp + 0x1c]
push edx
xor edx, edx
mov ecx, 0xc1d
call fcn.0041d620
push eax
lea eax, [esp + 0x88]
push eax
call ebp
mov ecx, dword [0x5a5514]
add esp, 0xc
push ecx
lea edx, [esp + 0x84]
jmp 0x49bcd8
mov edx, dword [0x5a5514]
push edx
xor edx, edx
mov ecx, 0xc1e
call fcn.0041d620
mov edx, eax
mov ecx, dword [esi]
call fcn.00502c40
mov eax, dword [0x5b4314]
mov ecx, dword [0x59bb64]
push 0x21
push 0x802b
push eax
push ecx
mov dword [0x5a9318], 0x1e
mov dword [0x5a931c], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
pop ebp
add esp, 0x17c
ret
Function at 0x49bd20
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x550
push ebx
mov eax, ecx
shr eax, 0x10
test eax, eax
push ebp
push esi
jne 0x49bd6a
cmp ecx, 0x20
je 0x49bd6a
mov eax, dword [0x59bb64]
cmp eax, 0xffffffff
je 0x49bd6a
push 0
push 0x103
lea ecx, [esp + 0x78]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x49bd97
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x49bf92
mov eax, dword [0x59bb58]
test eax, eax
je 0x49bf3c
xor ecx, ecx
call fcn.004e4c50
test eax, eax
jne 0x49bf3c
xor ecx, ecx
call fcn.0049b9b0
pop esi
pop ebp
pop ebx
add esp, 0x550
ret
cmp eax, 1
jle 0x49bd6a
cmp eax, 0x19
jg 0x49bd6a
lea edx, [esp + 0x70]
push 0x2c
push edx
mov byte [esp + eax + 0x78], 0
call fcn.00570260
mov esi, eax
add esp, 8
test esi, esi
je 0x49bd6a
mov byte [esi], 0
mov al, byte [esi + 1]
inc esi
test al, al
je 0x49bd6a
lea eax, [esp + 0x70]
push eax
call fcn.005705cb
push esi
mov ebp, eax
call fcn.005705cb
add esp, 8
mov ecx, 2
mov ebx, eax
call fcn.004e4c50
mov esi, eax
test esi, esi
jne 0x49be07
mov eax, dword [0x59bb58]
test eax, eax
jne 0x49bd77
call fcn.004e27f0
mov esi, eax
test esi, esi
je 0x49bd6a
jmp 0x49be11
mov dword [esi + 0x838], 0
push 0x5a9280
mov edx, 0x64
lea ecx, [esp + 0x10]
call fcn.0041ee40
mov eax, dword [0x5a927c]
test eax, eax
je 0x49be5f
mov edx, 0x64
lea ecx, [esp + 0xc]
call fcn.0041ef30
push 0
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.004ef870
test eax, eax
jne 0x49be5f
push 0x5a9280
mov edx, 0x64
lea ecx, [esp + 0x10]
call fcn.0041ee40
mov eax, dword [0x59bb54]
test eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x49beb6
lea ecx, [esp + 0x10]
push ecx
push 0x5a92e4
push ebx
push ebp
xor edx, edx
mov ecx, 0xc1f
call fcn.0041d620
push eax
lea edx, [esp + 0x18c]
push edx
call edi
mov eax, dword [0x5a5514]
mov ecx, dword [esi]
add esp, 0x18
push eax
lea edx, [esp + 0x17c]
call fcn.00502c40
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
mov ecx, dword [0x5b4314]
mov edx, dword [0x59bb64]
push 0x22
push 0x802c
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp + 0x10]
push eax
push 0x5a92e4
push ebx
push ebp
lea ecx, [esp + 0x84]
push str._d___d_:_USERID_:__s_:__s_r_n
push ecx
call edi
add esp, 0x18
lea eax, [esp + 0x74]
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49bef7
sub eax, edx
push 0
mov esi, eax
mov eax, dword [0x59bb64]
push esi
lea edx, [esp + 0x78]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
jne 0x49bd6a
pop esi
pop ebp
mov dword [0x5a9318], 3
mov dword [0x5a931c], 1
pop ebx
add esp, 0x550
ret
mov eax, dword [0x59bb64]
or esi, 0xffffffff
cmp eax, esi
je 0x49bf64
push 1
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov ecx, dword [0x59bb64]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [0x59bb64], esi
mov eax, dword [0x59bb60]
cmp eax, esi
mov dword [0x5a9318], 0
mov dword [0x59bb68], esi
je 0x49bf92
mov edx, dword [0x5b4314]
push 8
push 0x802a
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop esi
pop ebp
pop ebx
add esp, 0x550
ret
Function at 0x4a0350
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, edx
mov edx, dword [edi + 8]
test edx, edx
mov dword [esp + 0xc], ebx
jne 0x4a03a8
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edx, dword [ebx]
push 0x63
push esi
push eax
push edi
call fcn.004f48e0
cmp eax, 1
jne 0x4a04f8
mov ecx, dword [edi + 8]
cmp ecx, eax
je 0x4a04f8
cmp ecx, 2
je 0x4a04f8
push 6
mov edx, esi
mov ecx, edi
call fcn.00479d70
pop edi
pop esi
pop ebx
pop ecx
ret 0x18
mov eax, dword [edi + 0x40]
test eax, eax
je 0x4a03bb
cmp edx, 2
jne 0x4a03c7
mov ecx, dword [eax + 0x40]
test ecx, ecx
jne 0x4a03c7
pop edi
pop esi
mov eax, 2
pop ebx
pop ecx
ret 0x18
mov ecx, dword [eax + 0x1c]
mov esi, 1
cmp ecx, esi
je 0x4a03dc
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 0x18
cmp edx, 2
push ebp
jne 0x4a03f4
mov ecx, dword [eax + 0x40]
cmp dword [ecx + 0x1c], esi
je 0x4a03f4
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 0x18
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4a04cb
cmp edx, 2
jne 0x4a0412
mov ecx, dword [eax + 0x40]
mov ebp, dword [ecx + 0xc]
test ebp, ebp
jne 0x4a04cb
xor ebp, ebp
cmp edx, 2
jne 0x4a0437
mov edx, dword [eax + 0x40]
mov eax, dword [edx]
push eax
call fcn.005705cb
mov ebp, eax
add esp, 4
test ebp, ebp
jge 0x4a0431
xor ebp, ebp
jmp 0x4a0437
cmp ebp, esi
jle 0x4a0437
mov ebp, esi
mov ecx, dword [edi + 0x40]
mov ecx, dword [ecx]
cmp byte [ecx], 0x3d
jne 0x4a050c
mov al, byte [ecx + 1]
test al, al
lea ebx, [ecx + 1]
je 0x4a04c7
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4a0493
mov ecx, dword [esi + 0xc88]
call fcn.0042c530
test eax, eax
je 0x4a0493
mov eax, dword [esi + 0xc88]
mov ecx, dword [eax + 0x520]
test ecx, ecx
je 0x4a0493
add eax, 0x3f0
push ebx
push eax
call fcn.005809c6
add esp, 8
test eax, eax
jne 0x4a0493
mov esi, dword [esi + 0xc88]
test esi, esi
jne 0x4a04ff
mov esi, dword [0x5a3a48]
test esi, esi
je 0x4a04c7
lea ecx, [ecx]
cmp dword [esi + 0x520], 3
jne 0x4a04bd
lea edx, [esi + 0x3f0]
push ebx
push edx
call fcn.005809c6
add esp, 8
test eax, eax
je 0x4a04ff
mov esi, dword [esi + 0x88c]
test esi, esi
jne 0x4a04a0
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 8]
test eax, eax
jle 0x4a04eb
mov edx, dword [edi + 0x40]
mov ecx, dword [ebx]
call fcn.004c7fe0
mov dword [ebx], eax
mov ecx, dword [edi + 8]
dec ecx
mov eax, ecx
test eax, eax
mov dword [edi + 8], ecx
jg 0x4a04d2
mov dword [edi + 8], 0
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 0x18
mov ecx, dword [esi]
call fcn.00542c90
mov ebx, dword [esp + 0x10]
jmp 0x4a0515
mov edx, dword [esp + 0x2c]
call fcn.004e2e60
test eax, eax
je 0x4a04cb
test ebp, ebp
jne 0x4a053c
mov eax, dword [eax + 0x86c]
test eax, eax
je 0x4a04cb
mov ecx, dword [esp + 0x1c]
push ecx
push 0x1f4
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4a04cb
mov eax, dword [eax + 0x870]
test eax, eax
je 0x4a04cb
mov edx, dword [esp + 0x1c]
push edx
push 0x1f4
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4a04cb
Function at 0x4a5be0
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 8]
test eax, eax
push edi
mov edi, edx
jne 0x4a5c08
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 1
push eax
push edx
mov edx, dword [edi]
push esi
call fcn.004f48e0
pop edi
pop esi
ret 0x10
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4a5cc0
cmp dword [eax + 0x1c], 1
je 0x4a5c23
pop edi
mov eax, 1
pop esi
ret 0x10
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4a5c92
mov eax, dword [eax]
movzx ecx, byte [eax]
push ecx
call fcn.00570e57
add esp, 4
test eax, eax
je 0x4a5c92
mov edx, dword [esi + 0x40]
mov eax, dword [edx]
push 0x2e
push eax
call fcn.00570260
mov ecx, dword [esi + 0x40]
mov edx, dword [ecx]
add esp, 8
test eax, eax
push edx
je 0x4a5c7e
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4a5c92
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
mov eax, dword [esp + 0x14]
push 0x583930
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4a5c92
call fcn.0057031e
push ecx
mov ecx, dword [esp + 0x18]
fstp qword [esp]
xor edx, edx
call fcn.0041f180
mov eax, dword [esi + 8]
test eax, eax
jle 0x4a5cb9
lea esp, [esp]
mov edx, dword [esi + 0x40]
mov ecx, dword [edi]
call fcn.004c7fe0
mov dword [edi], eax
mov ecx, dword [esi + 8]
dec ecx
mov eax, ecx
test eax, eax
mov dword [esi + 8], ecx
jg 0x4a5ca0
mov dword [esi + 8], 0
pop edi
mov eax, 2
pop esi
ret 0x10