joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466f84
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, 0x50e5ac
mov esi, 0x4f646c
mov edi, 0x4f6470
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x466fbf
cmp eax, 0x20
je 0x466fbf
cmp dword [0x4f6460], 0xffffffff
je 0x466fbf
cmp dword [0x4f645c], 0xffffffff
jne 0x466fcb
push 2
call fcn.004669ac
jmp 0x467100
cmp byte [ebx], 0
jne 0x4670a8
mov eax, dword [esi]
push eax
push 0x3e7
push ebx
call fcn.00404834
add esp, 0xc
test eax, eax
je 0x4670f9
push ebx
call fcn.004833f0
test eax, eax
jne 0x4670f9
call fcn.00466b8c
test eax, eax
je 0x466fcb
push 0xa
push ebx
call fcn.00401278
add esp, 8
test eax, eax
jne 0x467020
lea ecx, [edi + 0x41]
push ecx
push ebx
call fcn.0040123c
add esp, 8
lea eax, [edi + 0x44]
push eax
push ebx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4670a8
mov edx, dword [esi]
push edx
call fcn.00405194
pop ecx
mov dword [0x50e4a4], eax
mov dword [0x50e4a8], 1
jmp 0x46706f
push ebx
call fcn.004833f0
test eax, eax
jne 0x467084
lea ecx, [edi + 0x47]
push ecx
push ebx
call fcn.004014a8
add esp, 8
test eax, eax
je 0x46706f
xor eax, eax
mov dword [0x50e4a8], eax
jmp 0x467084
mov edx, dword [esi]
push edx
push 0x3e7
push ebx
call fcn.00404834
add esp, 0xc
test eax, eax
jne 0x46704b
push 0
mov ecx, dword [0x50e4a4]
push ecx
mov eax, dword [esi]
push eax
call fcn.00405130
add esp, 0xc
cmp dword [0x50e4a8], 0
jne 0x4670f9
mov byte [ebx], 0xa
mov byte [ebx + 1], 0
push 0
push ebx
call fcn.00401318
pop ecx
push eax
push ebx
mov edx, dword [0x4f6460]
push edx
call sub.WSOCK32.dll_send
test eax, eax
jge 0x4670f1
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4670d6
cmp eax, 0x2734
jne 0x4670f9
push 0x22
push 0x430
mov ecx, dword [0x4fd9ec]
push ecx
mov eax, dword [0x4f6460]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x467100
mov byte [ebx], 0
jmp 0x466fcb
push 2
call fcn.004669ac
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x467108
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x4f64d0
mov esi, 0x4f7dec
mov edi, 0x50464c
push esi
push 0x3e7
push edi
lea eax, [ebx + 0x10]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0x79
jne 0x467140
mov dword [0x4f64cc], 1
jmp 0x467148
xor ecx, ecx
mov dword [0x4f64cc], ecx
push esi
push 0x64
push 0x50ead0
lea eax, [ebx + 0x25]
push eax
lea edx, [ebx + 0x1b]
push edx
lea ecx, [ebx + 0x14]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x50ead0
call fcn.004d7f14
push esi
push 0x3e7
push edi
lea eax, [ebx + 0x36]
push eax
lea edx, [ebx + 0x30]
push edx
lea ecx, [ebx + 0x29]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x467197
push edi
call fcn.00409a14
pop ecx
mov word [0x4f64c0], ax
jmp 0x4671a0
mov word [0x4f64c0], 0x438
cmp word [0x4f64c0], 0
ja 0x4671b3
mov word [0x4f64c0], 0x438
push esi
push 0x64
push 0x50eb34
lea eax, [ebx + 0x49]
push eax
lea edx, [ebx + 0x41]
push edx
lea ecx, [ebx + 0x3a]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x50eb34
call fcn.004d7f14
push esi
push 0x64
push 0x50eb98
lea eax, [ebx + 0x5e]
push eax
lea edx, [ebx + 0x54]
push edx
lea ecx, [ebx + 0x4d]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x50eb98], 0
je 0x467239
push esi
push 0
lea eax, [ebx + 0x69]
push eax
lea edx, [ebx + 0x62]
push edx
call fcn.0048326c
push 0x50eb98
push 0x5120fc
call sub.USER32.dll_wsprintfA
add esp, 8
push 0x5120fc
call fcn.0045bb34
push esi
push 0x5120fc
lea ecx, [ebx + 0x7a]
push ecx
lea eax, [ebx + 0x73]
push eax
call fcn.0048326c
jmp 0x467265
push esi
push 0x64
push 0x50eb98
lea edx, [ebx + 0x8d]
push edx
lea ecx, [ebx + 0x87]
push ecx
lea eax, [ebx + 0x80]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x50eb98
call fcn.0045bb5c
push esi
push 0x3e7
push edi
lea edx, [ebx + 0xa0]
push edx
lea ecx, [ebx + 0x98]
push ecx
lea eax, [ebx + 0x91]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0x35
jne 0x467297
mov dword [0x4f64c4], 1
jmp 0x46729f
xor edx, edx
mov dword [0x4f64c4], edx
push esi
push 0x3e7
push edi
lea ecx, [ebx + 0xb1]
push ecx
lea eax, [ebx + 0xab]
push eax
lea edx, [ebx + 0xa4]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0x79
jne 0x4672d1
mov dword [0x4f64c8], 1
jmp 0x4672d9
xor ecx, ecx
mov dword [0x4f64c8], ecx
pop edi
pop esi
pop ebx
ret
Function at 0x467ac0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x467af5
mov ebx, dword [0x4f64bc]
jmp 0x467ae0
mov ebx, dword [ebx + 0x80]
test ebx, ebx
je 0x467aea
cmp dword [ebx + 0x6c], 0
jne 0x467ada
test ebx, ebx
jne 0x467af5
xor eax, eax
jmp 0x467bcf
cmp byte [esi], 0
je 0x467b05
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x467b18
push 1
mov edx, dword [ebx + 0x70]
push edx
push ebx
call fcn.00467618
xor eax, eax
jmp 0x467bcf
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x74], 0xb4
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00401198
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [0x4f64c0]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov dword [ebx + 0x7c], esi
cmp esi, 0xffffffff
jne 0x467b7b
push 2
mov eax, dword [ebx + 0x70]
push eax
push ebx
call fcn.00467618
xor eax, eax
jmp 0x467bcf
mov edx, dword [ebx + 0x7c]
push edx
call fcn.004ef808
push 0x10
push 0x431
mov ecx, dword [0x4fd9ec]
push ecx
mov eax, dword [ebx + 0x7c]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebx + 0x7c]
push ecx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x467bca
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x467bca
push 3
mov eax, dword [ebx + 0x70]
push eax
push ebx
call fcn.00467618
xor eax, eax
jmp 0x467bcf
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x468aa4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4f669c], 1
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004686a8
push 0x4faef4
push 0x4f66f7
push 0x50ecfc
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x50ecfc
call fcn.00401318
pop ecx
push eax
push 0x50ecfc
mov ecx, dword [0x4fe2b0]
push ecx
call sub.WSOCK32.dll_send
pop ebp
ret 8
Function at 0x4693e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub eax, 6
je 0x4694a2
sub eax, 0x12
je 0x46940c
sub eax, 0xf9
je 0x4694b4
jmp 0x4694d9
cmp dword [0x4f6704], 1
jne 0x469428
push 0x4f691a
push 0
push 0xc
push 0x65
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x469464
cmp dword [0x4f6704], 2
jne 0x469444
push 0x4f6928
push 0
push 0xc
push 0x65
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x469464
push 0
push 0x66
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x65
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
cmp dword [0x4f6704], 0
jl 0x469475
xor edx, edx
mov dword [0x4f6704], edx
cmp dword [0x4f6704], 0
jge 0x469488
push 0x1e
push ebx
call fcn.0042238c
jmp 0x469490
push 7
push ebx
call fcn.0042238c
test ebx, ebx
jne 0x4694d9
cmp dword [ebp + 0x10], 0
jne 0x4694d9
cmp dword [ebp + 0x14], 0
jne 0x4694d9
jmp 0x4694d9
cmp dword [ebp + 0x10], 0
je 0x4694d9
mov dword [0x4f9c60], 0x3d4
jmp 0x4694d9
mov cx, word [ebp + 0x10]
dec cx
jne 0x4694d5
push 0x66
push ebx
call sub.USER32.dll_IsDlgButtonChecked
test eax, eax
je 0x4694d9
mov dword [0x4f6704], 1
jmp 0x4694d9
xor eax, eax
jmp 0x4694db
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x469f8c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x50f43a
mov edi, 0x4f6964
mov dword [0x4f4f40], ebx
push 0x452820
push 0x49
mov eax, dword [0x4fd9ec]
push eax
call fcn.00451600
xor edx, edx
mov dword [0x4f4f40], edx
test eax, eax
jg 0x46a012
cmp dword [ebx + 0x420], 0
je 0x46a003
mov ecx, dword [0x4fac34]
shl ecx, 2
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
add ecx, 0x4fab6c
push ecx
push edi
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.00401318
pop ecx
push eax
push esi
mov eax, dword [ebx + 0x438]
push eax
call sub.WSOCK32.dll_send
push 0
push ebx
call fcn.00469ccc
xor eax, eax
jmp 0x46a131
cmp eax, 2
jne 0x46a131
cmp dword [ebx + 0x420], 0
je 0x46a079
mov edx, dword [0x4fac34]
shl edx, 2
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
add edx, 0x4fab6c
push edx
lea ecx, [edi + 9]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.00401318
pop ecx
push eax
push esi
mov eax, dword [ebx + 0x438]
push eax
call sub.WSOCK32.dll_send
lea edx, [ebx + 0x68]
push edx
lea ecx, [ebx + 4]
push ecx
lea eax, [edi + 0x12]
push eax
push 0x50b8e0
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x46a092
lea edx, [ebx + 0x68]
push edx
lea ecx, [ebx + 4]
push ecx
lea eax, [edi + 0x1e]
push eax
push 0x50b8e0
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 2
push 0x50b8e0
call fcn.0049bedc
push esi
push edi
lea eax, [edi + 0x25]
mov edi, esi
mov esi, eax
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
push 1
push 0x1e
push esi
push 0x50b8e0
push 1
call fcn.00482f00
push 0
push ebx
call fcn.00469ccc
mov ebx, dword [0x4f6954]
test ebx, ebx
je 0x46a12f
cmp dword [ebx + 0x420], 0
je 0x46a0f1
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x2c]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x46a106
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x38]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
push esi
push 0x50b8e0
call fcn.004e842c
test eax, eax
je 0x46a125
push 0
push ebx
call fcn.00469ccc
mov ebx, dword [0x4f6954]
jmp 0x46a0cd
mov ebx, dword [ebx + 0x43c]
test ebx, ebx
jne 0x46a0d1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x46aadc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x3fc], 2
push 0
call fcn.0040ef0c
pop ecx
mov dword [ebx + 0x434], eax
cmp dword [ebx + 0x400], 0
je 0x46abfe
cmp word [ebx + 0x404], 0
jne 0x46abfe
cmp dword [0x4f64cc], 0
je 0x46ab68
cmp dword [0x4f64c8], 0
je 0x46ab68
push 0
push 0xb5c
call fcn.0041f178
push eax
push 1
push 1
push 1
push 1
push ebx
call fcn.004e2c0c
mov eax, dword [ebx + 0x400]
push eax
push 1
push 0
add ebx, 0xcc
push ebx
call fcn.00467944
mov eax, 1
jmp 0x46ad29
push 0
lea edx, [ebx + 0x404]
push edx
mov cx, word [0x4f474a]
push ecx
mov ax, word [0x4f4748]
push eax
call fcn.004bf8c8
mov esi, eax
mov dword [ebx + 0x438], esi
cmp esi, 0xffffffff
jne 0x46abae
push 1
push ebx
push 0
push 0xb5d
call fcn.0041f178
push eax
call fcn.0046a8f0
xor eax, eax
jmp 0x46ad29
push 8
push 0x410
mov edx, dword [0x4fd9ec]
push edx
mov ecx, dword [ebx + 0x438]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
mov eax, dword [ebx + 0x400]
push eax
mov edx, dword [ebx + 0x414]
push edx
mov cx, word [ebx + 0x404]
push ecx
mov eax, dword [0x4fb024]
push eax
lea edx, [ebx + 0x230]
push edx
add ebx, 4
push ebx
call fcn.004cff90
mov eax, 1
jmp 0x46ad29
lea edx, [ebx + 0xcc]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x46ac2e
push 1
push ebx
push 0
push 0xb5e
call fcn.0041f178
push eax
call fcn.0046a8f0
xor eax, eax
jmp 0x46ad29
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00401198
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.00401128
add esp, 0xc
mov cx, word [ebx + 0x404]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0x28], ecx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov dword [ebx + 0x438], esi
cmp esi, 0xffffffff
jne 0x46acc6
push 1
push ebx
push 0
push 0xb5d
call fcn.0041f178
push eax
call fcn.0046a8f0
xor eax, eax
jmp 0x46ad29
mov edx, dword [ebx + 0x438]
push edx
call fcn.004ef808
push 0x10
push 0x40f
mov ecx, dword [0x4fd9ec]
push ecx
mov eax, dword [ebx + 0x438]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebx + 0x438]
push ecx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x46ad27
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x46ad27
push 1
push ebx
push 0
push 0xb5f
call fcn.0041f178
push eax
call fcn.0046a8f0
xor eax, eax
jmp 0x46ad29
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46b2ac
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x46b2c0
xor eax, eax
jmp 0x46b43f
push 0
call fcn.0040ef0c
pop ecx
mov dword [ebx + 0x434], eax
push 0
push 0
mov edx, dword [0x4fd9ec]
push edx
mov ecx, dword [ebx + 0x438]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0
push 0x1000
push 0x50f43a
mov eax, dword [ebx + 0x438]
push eax
call sub.WSOCK32.dll_recv
mov esi, eax
cmp dword [ebx + 0x3fc], 4
je 0x46b328
push 0x21
push 0x411
mov eax, dword [0x4fd9ec]
push eax
mov edx, dword [ebx + 0x438]
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x46b43f
cmp esi, 0xffffffff
jne 0x46b37d
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x46b340
cmp eax, 0x2734
jne 0x46b361
push 0x21
push 0x411
mov edx, dword [0x4fd9ec]
push edx
mov ecx, dword [ebx + 0x438]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x46b43f
push 1
push ebx
push 0
push 0xb67
call fcn.0041f178
push eax
call fcn.0046a8f0
xor eax, eax
jmp 0x46b43f
test esi, esi
jg 0x46b38e
push ebx
call fcn.0046b6b8
xor eax, eax
jmp 0x46b43f
mov byte [esi + 0x50f43a], 0
mov edi, esi
add dword [ebx + 0x408], edi
cmp dword [ebx + 0x418], 0
jbe 0x46b3b9
push 2
push 0
mov eax, dword [ebx + 0x3f8]
push eax
call fcn.00405518
add esp, 0xc
push edi
push 0x50f43a
mov edx, dword [ebx + 0x3f8]
push edx
call fcn.004066d0
add esp, 0xc
cmp esi, eax
je 0x46b3eb
push 1
push ebx
push 0
push 0xb65
call fcn.0041f178
push eax
call fcn.0046a8f0
xor eax, eax
jmp 0x46b43f
mov edx, dword [ebx + 0x408]
push edx
call sub.WSOCK32.dll_htonl
mov dword [ebx + 0x40c], eax
push ebx
call fcn.0046b530
push ebx
call fcn.0046b448
push ebx
call fcn.00469dc8
test eax, eax
jne 0x46b417
xor eax, eax
jmp 0x46b43f
mov eax, dword [ebx + 0x414]
test eax, eax
jbe 0x46b2e5
cmp eax, dword [ebx + 0x408]
jae 0x46b2e5
mov dword [ebx + 0x408], eax
push ebx
call fcn.0046b6b8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x46c290
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4f6ae0
mov esi, 0x5128ca
mov edi, 0x50464c
mov ebp, 0x5104a0
push 0x4f7dec
push 0x3e7
push esi
lea eax, [ebx + 0x1b]
push eax
lea edx, [ebx + 0x10]
push edx
lea ecx, [ebx + 0xa]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x46c367
mov eax, dword [0x4f6ad0]
push eax
mov edx, dword [0x4f6ad8]
push edx
mov ecx, dword [0x4f29d0]
inc ecx
push ecx
lea eax, [ebx + 0x1f]
push eax
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
cmp dword [0x4f6ad4], 1
jne 0x46c307
lea edx, [ebx + 0x2d]
push edx
push edi
call fcn.0040123c
add esp, 8
jmp 0x46c329
cmp dword [0x4f6ad4], 2
jne 0x46c329
push 0
push 5
call fcn.0045a910
push eax
call fcn.0041fb90
push eax
push edi
call fcn.0040123c
add esp, 8
lea ecx, [ebx + 0x33]
push ecx
push edi
call fcn.0040123c
add esp, 8
push esi
push edi
call fcn.0040123c
add esp, 8
push 0x4f7dec
push edi
lea eax, [ebx + 0x42]
push eax
lea edx, [ebx + 0x37]
push edx
call fcn.0048326c
push 0x4f7dec
push 0
lea ecx, [ebx + 0x4c]
push ecx
lea eax, [ebx + 0x46]
push eax
call fcn.0048326c
xor edx, edx
mov dword [ebp], edx
mov ecx, dword [ebp]
push ecx
lea eax, [ebx + 0x57]
push eax
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
inc dword [ebp]
push 0x4f7dec
push 0x3e7
push esi
lea edx, [ebx + 0x67]
push edx
push edi
lea ecx, [ebx + 0x5c]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x46c3a6
push esi
call fcn.0046bea4
jmp 0x46c36c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46f3c8
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, 0x4f6d10
push 0x4f7dec
push 0x3e7
push 0x5128ca
lea eax, [ebx + 0xf]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea ecx, [ebx + 0x13]
push ecx
push 0x5128ca
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x46f40c
mov dword [0x4f6c5c], 1
jmp 0x46f413
xor eax, eax
mov dword [0x4f6c5c], eax
push 0x4f7dec
push 0x64
push 0x4f6c6a
lea edx, [ebx + 0x27]
push edx
lea ecx, [ebx + 0x1f]
push ecx
lea eax, [ebx + 0x18]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4f6c6a], 0
je 0x46f44f
push 0x20
push 0x4f6c6a
call fcn.00401278
add esp, 8
test eax, eax
je 0x46f44f
mov byte [eax], 0
cmp byte [0x4f6c6a], 0
jne 0x46f460
xor edx, edx
mov dword [0x4f6c5c], edx
push 0x4f7dec
push 0x32
push 0x4f6cce
lea ecx, [ebx + 0x3a]
push ecx
lea eax, [ebx + 0x32]
push eax
lea edx, [ebx + 0x2b]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4f7dec
push 0x3e7
push 0x5128ca
lea ecx, [ebx + 0x4d]
push ecx
lea eax, [ebx + 0x47]
push eax
lea edx, [ebx + 0x40]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x5128ca], 0
je 0x46f4b9
push 0x5128ca
call fcn.00409a14
pop ecx
mov word [0x4f6c68], ax
jmp 0x46f4c2
mov word [0x4f6c68], 0x71
cmp word [0x4f6c68], 0
ja 0x46f4d5
mov word [0x4f6c68], 0x71
pop ebx
ret

Function at 0x46f60c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov esi, 0x4f6d08
cmp dword [esi], 0xffffffff
jne 0x46f6ad
mov dword [0x4f6d0c], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [esi], ebx
cmp ebx, 0xffffffff
jne 0x46f646
push 0
call fcn.0046f588
jmp 0x46f6ad
mov word [esp], 2
xor eax, eax
mov dword [esp + 4], eax
mov dx, word [0x4f6c68]
push edx
call sub.WSOCK32.dll_htons
mov word [esp + 2], ax
push 0x10
lea ecx, [esp + 4]
push ecx
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_bind
test eax, eax
je 0x46f680
push 0
call fcn.0046f588
jmp 0x46f6ad
push 5
mov edx, dword [esi]
push edx
call sub.WSOCK32.dll_listen
test eax, eax
je 0x46f697
push 0
call fcn.0046f588
jmp 0x46f6ad
push 8
push 0x42a
mov ecx, dword [0x4fd9ec]
push ecx
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x46f804
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x46f930
cmp eax, 0x20
je 0x46f930
mov eax, dword [0x4f6d0c]
cmp eax, 0xffffffff
je 0x46f930
push 0
push 0x32
push 0x5117dc
push eax
call sub.WSOCK32.dll_recv
cmp eax, 1
jle 0x46f930
cmp eax, 0x19
jg 0x46f930
mov byte [eax + 0x5117dc], 0
push 0x2c
push 0x5117dc
call fcn.00401278
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x46f930
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x46f930
push 0x5117dc
call fcn.00409a14
pop ecx
mov esi, eax
push ebx
call fcn.00409a14
pop ecx
mov ebx, eax
cmp dword [0x4f6c60], 0
je 0x46f8ef
push 0x4f6c6a
push 0x4f6cce
push ebx
push esi
push 0
push 0xc1f
call fcn.0041f178
push eax
push 0x513c45
call sub.USER32.dll_wsprintfA
add esp, 0x18
mov eax, dword [0x4f29e4]
push eax
push 0x513c45
mov edx, dword [0x4fd9fc]
push edx
call fcn.004bc548
mov ecx, dword [0x4f29d4]
push ecx
mov eax, dword [0x4fd9fc]
push eax
call fcn.004bc3ec
push 0x4f6c6a
push 0x4f6cce
push ebx
push esi
push 0x4f6dc7
push 0x5117dc
call sub.USER32.dll_wsprintfA
add esp, 0x18
push 0x22
push 0x42c
mov edx, dword [0x4fd9ec]
push edx
mov ecx, dword [0x4f6d0c]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0
call fcn.0046f958
jmp 0x46f952
cmp dword [0x4f39b0], 0
je 0x46f94b
cmp dword [0x4f6c64], 0
je 0x46f94b
push 0
call fcn.0046f588
jmp 0x46f952
push 1
call fcn.0046f588
pop esi
pop ebx
pop ebp
ret 4
Function at 0x471138
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, 0x5119a8
cmp dword [ebp + 0x20], 0
jne 0x47115b
mov dword [0x51199c], 1
jmp 0x4711ce
cmp dword [esi + 4], 0
jne 0x471180
push 1
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004b6d0c
jmp 0x471358
cmp dword [esi + 0x30], 0
jne 0x471190
mov eax, 2
jmp 0x471358
mov edx, dword [esi + 0x30]
cmp dword [edx + 0x18], 1
je 0x4711a3
mov eax, 1
jmp 0x471358
mov edx, dword [esi + 0x30]
cmp dword [edx + 8], 0
jne 0x471334
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
push eax
call fcn.00409a14
pop ecx
mov dword [0x51199c], eax
cmp dword [0x51199c], 0
jl 0x471334
mov edx, dword [0x4fd9ec]
push edx
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x471334
push 1
call sub.USER32.dll_GetClipboardData
mov dword [0x511998], eax
cmp dword [0x511998], 0
je 0x47132f
mov ecx, dword [0x511998]
push ecx
call sub.KERNEL32.dll_GlobalLock
mov dword [0x5119ac], eax
cmp dword [0x5119ac], 0
je 0x47132f
mov byte [edi], 0
mov eax, dword [0x5119ac]
push eax
call fcn.00401318
pop ecx
mov dword [0x5119a4], eax
xor edx, edx
mov dword [0x5119a0], edx
push 0xa
mov ecx, dword [0x5119ac]
push ecx
call fcn.00401278
add esp, 8
mov dword [ebx], eax
inc dword [0x5119a0]
mov eax, dword [0x5119a0]
cmp eax, dword [0x51199c]
jne 0x47128c
cmp dword [ebx], 0
je 0x471265
mov edx, dword [ebx]
mov byte [edx], 0
push 0x3b5
mov ecx, dword [0x5119ac]
push ecx
push edi
call fcn.004014f0
add esp, 0xc
mov byte [edi + 0x3b5], 0
mov eax, dword [ebx]
test eax, eax
je 0x4712aa
mov byte [eax], 0xa
jmp 0x4712aa
cmp dword [ebx], 0
je 0x4712aa
inc dword [ebx]
mov edx, dword [ebx]
cmp byte [edx], 0xd
jne 0x47129c
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0
je 0x4712aa
mov dword [0x5119ac], eax
jmp 0x471235
cmp dword [0x51199c], 0
jne 0x4712c8
mov edx, dword [0x5119a0]
push edx
push 0x4f6ecc
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [esi + 0xc], 0
je 0x471324
push 0x2e
mov ecx, dword [esi]
push ecx
call fcn.004015cc
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x471324
push 0x4f6ed0
mov edx, dword [ebx]
push edx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x471321
cmp dword [0x51199c], 0
je 0x47130a
push edi
call fcn.00401318
pop ecx
mov dword [0x5119a4], eax
mov ecx, dword [0x5119a4]
push ecx
push 0x4f6ed6
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x471324
mov byte [edi], 0
mov eax, dword [0x511998]
push eax
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [ebp + 0x20], 1
jne 0x471353
mov edx, dword [esi + 0x30]
push edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push eax
call fcn.00498fb0
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
xor ecx, ecx
mov dword [esi + 4], ecx
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c