joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b158
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
call fcn.0042abc8
push 0x4f7dec
push 0x3e7
push 0x50464c
push 0x4f2c65
push 0x4f2c61
push 0x4f2c58
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x50464c], 0
je 0x42b21b
xor ebp, ebp
mov esi, 0x50464c
mov ebx, 0x509578
jmp 0x42b1d7
push 0x2c
push esi
call fcn.00401278
add esp, 8
mov edi, eax
test edi, edi
je 0x42b1b4
mov byte [edi], 0
inc edi
push esi
call fcn.00409a14
pop ecx
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jl 0x42b1c8
cmp eax, 0x10
jle 0x42b1cc
xor edx, edx
mov dword [ebx], edx
inc ebp
add ebx, 0x1c
cmp ebp, 0x1e
jge 0x42b1e0
mov esi, edi
test esi, esi
je 0x42b1e0
cmp byte [esi], 0
jne 0x42b19f
cmp ebp, 0x18
jne 0x42b21b
mov eax, dword [0x5097fc]
mov dword [0x509818], eax
mov edx, dword [0x5097e0]
mov dword [0x5097fc], edx
mov ecx, dword [0x5097c4]
mov dword [0x5097e0], ecx
mov eax, dword [0x5097a8]
mov dword [0x5097c4], eax
mov dword [0x5097a8], 1
call fcn.0042b070
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42ca78
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x4f2a5c]
push eax
call sub.USER32.dll_ShowWindow
mov eax, dword [0x4f2a5c]
test eax, eax
je 0x42ca94
push eax
call sub.USER32.dll_DestroyWindow
xor edx, edx
mov dword [0x4f2a5c], edx
ret
Function at 0x43b0ac
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x43b1a0
push 0x68
push eax
call fcn.00401278
add esp, 8
test eax, eax
je 0x43b13d
push 0x5a
push esi
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x43b1a0
xor edx, edx
mov dword [0x4fb024], edx
mov byte [0x4fafc0], 0
push esi
mov edi, esi
mov esi, 0x4faf5c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x4faf5c
call fcn.004d7f14
call fcn.004ef378
push 0x33
push 0
push 0x4faf5c
push 0x4f3273
push 0
call fcn.00455180
jmp 0x43b1a0
push 0x75
mov eax, dword [ebx + 4]
push eax
call fcn.00401278
add esp, 8
test eax, eax
je 0x43b1a0
push 2
call fcn.00444c50
test eax, eax
jne 0x43b16a
push 0xc
push 0
mov edx, dword [ebx]
push edx
push 0
call fcn.0045bf34
jmp 0x43b1a5
mov dword [0x4f9194], 1
mov ecx, dword [0x4fac34]
shl ecx, 2
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
add ecx, 0x4fab6c
push ecx
push 0x4f3277
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.004efb4c
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x43e80c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x43e827
cmp dword [ebx + 8], 0
jne 0x43e83a
push 0
push 0
mov eax, dword [ebx]
push eax
push 0
call fcn.0045bf34
jmp 0x43e9e1
mov edx, dword [ebx + 4]
push edx
call fcn.004eae20
mov dword [0x50a59c], eax
cmp dword [0x50a59c], 0
je 0x43e865
mov ecx, dword [0x50a59c]
mov al, byte [ecx + 0x4cc]
cmp al, 9
je 0x43e878
cmp al, 0xa
je 0x43e878
push 7
push 0
mov edx, dword [ebx]
push edx
push 0
call fcn.0045bf34
jmp 0x43e9e1
mov eax, dword [ebx + 8]
cmp byte [eax], 0x40
jne 0x43e88c
push eax
call fcn.00401318
pop ecx
cmp eax, 1
ja 0x43e89f
push 3
push 0
mov edx, dword [ebx]
push edx
push 0
call fcn.0045bf34
jmp 0x43e9e1
mov ecx, dword [ebx + 8]
push ecx
call fcn.004eae20
test eax, eax
je 0x43e8c9
push 6
push 0
push 0
push 0x397
call fcn.0041f178
push eax
push 0
call fcn.0045bf34
jmp 0x43e9e1
mov eax, dword [0x50a59c]
add eax, 4
mov edx, dword [ebx + 8]
push esi
push edi
mov esi, eax
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [ebx + 8]
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx + 0xc], 0
je 0x43e95a
mov byte [esi], 0
push ebx
push esi
push 3
call fcn.004b6b5c
cmp byte [esi], 0
je 0x43e993
push 0x4f365c
push edi
call fcn.0040123c
add esp, 8
push esi
push edi
call fcn.0040123c
add esp, 8
push 0xf
push edi
call fcn.004d7fb8
jmp 0x43e993
push pe_nt_image_headers32
push esi
mov eax, dword [0x50a59c]
mov edx, dword [eax]
push edx
call sub.USER32.dll_GetWindowTextA
cmp byte [esi], 0
je 0x43e993
push 0x20
push esi
call fcn.00401278
add esp, 8
mov ebx, eax
mov dword [0x50a5a0], ebx
test ebx, ebx
je 0x43e993
push ebx
push edi
call fcn.0040123c
add esp, 8
mov dword [0x50a5a0], edi
mov eax, dword [0x50a59c]
cmp byte [eax + 0x4eb], 0
je 0x43e9b8
mov edx, dword [0x50a5a0]
cmp byte [edx], 0x40
jne 0x43e9b8
inc dword [0x50a5a0]
mov ecx, dword [0x50a5a0]
push ecx
mov eax, dword [eax]
push eax
call sub.USER32.dll_SetWindowTextA
cmp dword [0x4fccb4], 0
je 0x43e9dc
mov edx, dword [0x50a59c]
push edx
call fcn.004d9d04
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4410c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, 0x4fd9ec
mov eax, dword [ebx + 4]
test eax, eax
je 0x441297
cmp byte [eax], 0x2d
jne 0x441297
push 0x6e
push eax
call fcn.00401278
add esp, 8
test eax, eax
je 0x441157
mov edx, dword [0x4fd518]
mov dword [0x50a67c], edx
xor ecx, ecx
mov dword [0x4fd518], ecx
mov eax, dword [0x4fd510]
mov dword [0x50a680], eax
xor edx, edx
mov dword [0x4fd510], edx
push 7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_ShowWindow
cmp dword [0x4fd514], 0
je 0x44113a
push 2
call fcn.004e4198
push 8
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
mov edx, dword [0x50a67c]
mov dword [0x4fd518], edx
mov ecx, dword [0x50a680]
mov dword [0x4fd510], ecx
jmp 0x441297
push 0x78
mov eax, dword [ebx + 4]
push eax
call fcn.00401278
add esp, 8
test eax, eax
je 0x4411a0
cmp dword [0x4fd514], 0
je 0x441179
push 2
call fcn.004e4198
push 3
mov edx, dword [esi]
push edx
call sub.USER32.dll_ShowWindow
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SetForegroundWindow
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetActiveWindow
mov edx, dword [esi]
push edx
call sub.USER32.dll_SetFocus
jmp 0x441297
push 0x73
mov ecx, dword [ebx + 4]
push ecx
call fcn.00401278
add esp, 8
test eax, eax
je 0x4411e9
cmp dword [0x4fd514], 0
je 0x4411c2
push 2
call fcn.004e4198
push 8
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
mov edx, dword [esi]
push edx
call sub.USER32.dll_SetForegroundWindow
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SetActiveWindow
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetFocus
jmp 0x441297
push 0x72
mov edx, dword [ebx + 4]
push edx
call fcn.00401278
add esp, 8
test eax, eax
je 0x441239
cmp dword [0x4fd514], 0
je 0x441215
push 2
call fcn.004e4198
push 8
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_ShowWindow
push 9
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
mov edx, dword [esi]
push edx
call sub.USER32.dll_SetForegroundWindow
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SetActiveWindow
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetFocus
jmp 0x441297
push 0x74
mov edx, dword [ebx + 4]
push edx
call fcn.00401278
add esp, 8
test eax, eax
je 0x441297
mov ecx, dword [0x4fd518]
mov dword [0x50a67c], ecx
mov dword [0x4fd518], 1
cmp dword [0x4fd510], 0
je 0x441281
push 1
call fcn.004e4198
test eax, eax
je 0x441281
push 0
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x44128b
push 7
mov edx, dword [esi]
push edx
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x50a67c]
mov dword [0x4fd518], ecx
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4426b8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
jne 0x4426ee
mov byte [0x518038], 0
cmp dword [0x4f2d68], 0
jne 0x4426e4
push edi
push esi
call fcn.0041f8c4
mov eax, 1
jmp 0x44286e
mov edx, dword [ebx + 4]
cmp byte [edx], 0x40
jne 0x4427da
mov ecx, dword [ebx + 4]
push ecx
call fcn.004eae20
mov dword [0x50a6c4], eax
cmp dword [0x50a6c4], 0
jne 0x442724
push 7
push 0
mov eax, dword [ebx]
push eax
push 0
call fcn.0045bf34
jmp 0x44286e
mov edx, dword [ebx + 4]
mov dword [0x50a6c8], edx
mov ecx, dword [0x50a6c4]
cmp byte [ecx + 0x4eb], 0
je 0x442742
inc dword [0x50a6c8]
mov eax, dword [0x50a6c8]
push eax
push 0x4f3956
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
push esi
push 2
call fcn.004b6b5c
push 0xf
push esi
call fcn.004d7fb8
mov edx, dword [0x50a6c4]
mov ecx, dword [edx]
push ecx
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
push esi
call fcn.00401318
pop ecx
cmp ebx, eax
jne 0x4427c1
push 0x3b5
push edi
mov eax, dword [0x50a6c4]
mov edx, dword [eax]
push edx
call sub.USER32.dll_GetWindowTextA
mov eax, esi
mov edx, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4427c1
test cl, cl
je 0x4427b5
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4427c1
add eax, 2
add edx, 2
test cl, cl
jne 0x442799
jne 0x4427c1
mov eax, 1
jmp 0x44286e
push esi
mov edx, dword [0x50a6c4]
mov ecx, dword [edx]
push ecx
call sub.USER32.dll_SetWindowTextA
mov eax, 1
jmp 0x44286e
push 0x4f395b
mov edx, dword [ebx + 4]
push edx
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4427fb
mov dword [0x50a6cc], 2
jmp 0x442805
mov dword [0x50a6cc], 1
mov ecx, dword [0x50a6cc]
cmp dword [ebx + ecx*4], 0
je 0x442852
mov byte [esi], 0
push ebx
push esi
mov eax, dword [0x50a6cc]
push eax
call fcn.004b6b5c
mov byte [esi + 0xfa], 0
push esi
push edi
mov edi, esi
mov esi, 0x518038
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x442859
mov byte [0x518038], 0
cmp dword [0x4f2d68], 0
jne 0x442869
push edi
push esi
call fcn.0041f8c4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x445304
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
or ebx, 0xffffffff
push 0x4f3dd0
mov eax, dword [ebp + 8]
push eax
call fcn.00404e28
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44532b
xor eax, eax
jmp 0x4453a5
mov edx, dword [ebp - 4]
push edx
push 0x200
push 1
push 0x50a8a0
call fcn.004050a0
add esp, 0x10
mov esi, eax
test esi, esi
jbe 0x445380
xor edx, edx
mov eax, 0x50a8a0
cmp esi, edx
jbe 0x445378
mov ecx, ebx
xor cl, byte [eax]
and ecx, 0xff
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f39d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
inc eax
cmp esi, edx
ja 0x445354
cmp esi, 0x200
jae 0x44532b
mov eax, dword [ebp - 4]
test byte [eax + 0x12], 0x10
je 0x445397
mov edx, dword [ebp - 4]
push edx
call fcn.00404724
pop ecx
xor eax, eax
jmp 0x4453a5
mov edx, dword [ebp - 4]
push edx
call fcn.00404724
pop ecx
not ebx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x447824
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00447d6c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4479f1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28d8], 0
je 0x4479f1
push edi
call sub.USER32.dll_GetDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4479f1
mov edx, dword [ebp - 0xc]
push edx
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x447887
mov ecx, dword [ebp - 0xc]
push ecx
push edi
call sub.USER32.dll_ReleaseDC
jmp 0x4479f1
mov eax, dword [0x4f29f8]
push eax
call sub.GDI32.dll_CreateSolidBrush
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4478b3
mov edx, dword [ebp - 0x10]
push edx
call sub.GDI32.dll_DeleteDC
mov ecx, dword [ebp - 0xc]
push ecx
push edi
call sub.USER32.dll_ReleaseDC
jmp 0x4479f1
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28d8]
test ebx, ebx
je 0x4479d5
mov eax, dword [ebx + 0xc]
push eax
push edi
call sub.USER32.dll_GetDlgItem
mov esi, eax
test esi, esi
je 0x4479c7
push esi
call sub.USER32.dll_IsWindowEnabled
test eax, eax
je 0x4479c7
mov eax, dword [ebx + 4]
test eax, eax
je 0x44790c
push 0
mov edx, dword [ebx + 8]
push edx
push eax
mov ecx, dword [ebx + 0xc]
push ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc8]
push edx
call fcn.004206f8
jmp 0x4479c7
cmp dword [ebx], 0
je 0x4479c7
lea ecx, [ebp - 0x2c]
push ecx
push esi
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x28]
sub dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x1c]
push edx
push edi
call sub.USER32.dll_ScreenToClient
mov ecx, dword [ebp - 0x20]
push ecx
mov eax, dword [ebp - 0x24]
push eax
mov edx, dword [ebp - 0xc]
push edx
call sub.GDI32.dll_CreateCompatibleBitmap
mov esi, eax
test esi, esi
je 0x4479c7
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov eax, dword [ebp - 0x10]
push eax
call sub.USER32.dll_FillRect
mov edx, dword [ebx]
push edx
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call sub.USER32.dll_DrawIcon
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x24]
push ecx
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
call sub.GDI32.dll_BitBlt
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 0x10]
push edx
call sub.GDI32.dll_SelectObject
push esi
call sub.GDI32.dll_DeleteObject
mov ebx, dword [ebx + 0x114]
test ebx, ebx
jne 0x4478c4
mov ecx, dword [ebp - 0x14]
push ecx
call sub.GDI32.dll_DeleteObject
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.dll_DeleteDC
mov edx, dword [ebp - 0xc]
push edx
push edi
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x450074
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, 0x4f4d08
mov esi, 0x50464c
push 0x4f7dec
push 0x3e7
push esi
lea eax, [ebx + 0x13]
push eax
lea edx, [ebx + 5]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x4500bb
lea ecx, [ebx + 0x17]
push ecx
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x4500bb
mov dword [0x4f4c1c], 1
jmp 0x4500c2
xor eax, eax
mov dword [0x4f4c1c], eax
push 0x4f7dec
push 0x3c
push 0x4f4bcc
lea edx, [ebx + 0x2d]
push edx
lea ecx, [ebx + 0x20]
push ecx
lea eax, [ebx + 0x1b]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4f7dec
push 0x3e7
push esi
lea edx, [ebx + 0x43]
push edx
lea ecx, [ebx + 0x38]
push ecx
lea eax, [ebx + 0x33]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45011d
lea edx, [ebx + 0x48]
push edx
push esi
call fcn.004014a8
add esp, 8
test eax, eax
jne 0x45011d
mov dword [0x4f4c20], 1
jmp 0x450125
xor ecx, ecx
mov dword [0x4f4c20], ecx
mov eax, sym.mirc32.exe_DDECallback
mov dword [0x4f4bc8], eax
push 0
push 0x1c4020
push eax
push 0x4f4bc4
call sub.USER32.dll_DdeInitializeA
test eax, eax
jne 0x45015b
cmp dword [0x4f4c1c], 0
je 0x450153
call fcn.00450170
mov eax, 1
pop esi
pop ebx
ret
xor edx, edx
mov dword [0x4f4bc4], edx
xor ecx, ecx
mov dword [0x4f4bc8], ecx
xor eax, eax
pop esi
pop ebx
ret
Function at 0x45a9b8
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x4f5258
mov esi, 0x504a33
mov edi, 0x4f7dec
push edi
push 0x3e7
push esi
lea eax, [ebx + 0xe]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45aa04
push 0
push 0
push esi
call fcn.0041fbd4
push eax
mov ecx, dword [0x4f5254]
push ecx
call fcn.00498c08
test eax, eax
je 0x45aa04
mov dword [0x4f5254], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x21]
push eax
lea edx, [ebx + 0x19]
push edx
lea ecx, [ebx + 0x12]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45aa40
push 1
push 0
push esi
call fcn.0041fbd4
push eax
mov eax, dword [0x4f5254]
push eax
call fcn.00498c08
test eax, eax
je 0x45aa40
mov dword [0x4f5254], eax
push edi
push 0x3e7
push esi
lea edx, [ebx + 0x34]
push edx
lea ecx, [ebx + 0x2c]
push ecx
lea eax, [ebx + 0x25]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45aa7d
push 2
push 0
push esi
call fcn.0041fbd4
push eax
mov edx, dword [0x4f5254]
push edx
call fcn.00498c08
test eax, eax
je 0x45aa7d
mov dword [0x4f5254], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x4b]
push ecx
lea eax, [ebx + 0x3f]
push eax
lea edx, [ebx + 0x38]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45aaba
push 3
push 0
push esi
call fcn.0041fbd4
push eax
mov ecx, dword [0x4f5254]
push ecx
call fcn.00498c08
test eax, eax
je 0x45aaba
mov dword [0x4f5254], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x5c]
push eax
lea edx, [ebx + 0x56]
push edx
lea ecx, [ebx + 0x4f]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45aaf6
push 4
push 0
push esi
call fcn.0041fbd4
push eax
mov eax, dword [0x4f5254]
push eax
call fcn.00498c08
test eax, eax
je 0x45aaf6
mov dword [0x4f5254], eax
push edi
push 0x3e7
push esi
lea edx, [ebx + 0x72]
push edx
lea ecx, [ebx + 0x67]
push ecx
lea eax, [ebx + 0x60]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45ab33
push 5
push 0
push esi
call fcn.0041fbd4
push eax
mov edx, dword [0x4f5254]
push edx
call fcn.00498c08
test eax, eax
je 0x45ab33
mov dword [0x4f5254], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x84]
push ecx
lea eax, [ebx + 0x7d]
push eax
lea edx, [ebx + 0x76]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x45ab73
push 6
push 0
push esi
call fcn.0041fbd4
push eax
mov ecx, dword [0x4f5254]
push ecx
call fcn.00498c08
test eax, eax
je 0x45ab73
mov dword [0x4f5254], eax
pop edi
pop esi
pop ebx
ret
Function at 0x46656c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov eax, dword [ebp + 8]
cmp eax, dword [0x4f6414]
je 0x466585
xor eax, eax
jmp 0x466673
mov edx, dword [ebp + 0xc]
shr edx, 0x10
test dx, 0xffff
je 0x4665ab
push 0
push 0x9c7
call fcn.0041f178
push eax
call fcn.00466104
xor eax, eax
jmp 0x466673
xor edx, edx
mov dword [0x4f6414], edx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [0x4f6410], ebx
cmp ebx, 0xffffffff
jne 0x4665e4
push 0
push 0x9c8
call fcn.0041f178
push eax
call fcn.00466104
xor eax, eax
jmp 0x466673
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00401198
add esp, 0xc
mov word [ebp - 0x10], 2
push 0x4f
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x50e39c]
cmp eax, 0xffffffff
je 0x466614
mov dword [ebp - 0xc], eax
jmp 0x466623
mov eax, 0x50de9c
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
push 0x10
push 0x423
mov edx, dword [0x4fd9ec]
push edx
mov ecx, dword [0x4f6410]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x10]
push eax
mov edx, dword [0x4f6410]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x466671
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x466671
push 0
push 0x9c9
call fcn.0041f178
push eax
call fcn.00466104
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46667c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x50e29c
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x4666ab
push 0
push 0x9c9
call fcn.0041f178
push eax
call fcn.00466104
xor eax, eax
jmp 0x4667af
cmp byte [0x4f6344], 0
je 0x466704
push 0x4f63a8
push 0x4f6344
push 0
push 0x9ca
call fcn.0041f178
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov edx, dword [0x4f29d8]
push edx
push esi
mov ecx, dword [0x4fda10]
push ecx
call fcn.004bc548
push 0x4f6344
push 0x4f6446
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov byte [0x4f6344], 0
jmp 0x466745
push 0x4f63a8
push 0
push 0x9cb
call fcn.0041f178
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4f29d8]
push eax
push esi
mov edx, dword [0x4fda10]
push edx
call fcn.004bc548
push 0x4f63a8
push 0x4f644b
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov ecx, dword [0x4f29d4]
push ecx
mov eax, dword [0x4fda10]
push eax
call fcn.004bc3ec
mov byte [0x50e3a0], 0
xor edx, edx
mov dword [0x4f641c], edx
push 0x21
push 0x424
mov ecx, dword [0x4fd9ec]
push ecx
mov eax, dword [0x4f6410]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
push esi
call fcn.00401318
pop ecx
mov ebx, eax
push 0
push ebx
push esi
mov eax, dword [0x4f6410]
push eax
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x4667ad
push 0
push 0x9cc
call fcn.0041f178
push eax
call fcn.00466104
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x466a48
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
add esp, 0xfffffff0
or eax, 0xffffffff
mov dword [0x4f6460], eax
mov dword [0x4f645c], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x4f645c], eax
cmp eax, 0xffffffff
jne 0x466a76
push 0
call fcn.004669ac
jmp 0x466ae1
mov word [esp], 2
xor edx, edx
mov dword [esp + 4], edx
push 0x4f
call sub.WSOCK32.dll_htons
mov word [esp + 2], ax
push 0x10
lea ecx, [esp + 4]
push ecx
mov eax, dword [0x4f645c]
push eax
call sub.WSOCK32.dll_bind
test eax, eax
je 0x466aad
push 0
call fcn.004669ac
jmp 0x466ae1
push 5
mov edx, dword [0x4f645c]
push edx
call sub.WSOCK32.dll_listen
test eax, eax
je 0x466ac8
push 0
call fcn.004669ac
jmp 0x466ae1
push 8
push 0x42e
mov ecx, dword [0x4fd9ec]
push ecx
mov eax, dword [0x4f645c]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
add esp, 0x10
ret