joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d5a0
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
test edi, edi
je 0x40d672
cmp byte [edi], 0
je 0x40d672
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x40d674
push 0x4c71c0
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x40d616
lea ecx, [ecx]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2afa
jne 0x40d616
mov eax, ebx
inc ebx
cmp eax, 0xa
jae 0x40d616
push edi
push ebx
push str.Timeout__u_while_trying_to_resolve__s._Trying_again.
push 0x2000
call fcn.004090c0
add esp, 0x10
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x40d5e0
push 0x4c71c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x40d64e
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x40d64e
cmp word [esi + 8], 2
je 0x40d647
call fcn.00460a98
push edi
mov dword [eax], 0x2739
push str.hostname__s_resolves_to_unknown_address_type.
jmp 0x40d65f
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
pop ebx
ret
call fcn.00460a98
push edi
mov dword [eax], 0x16
push str.could_not_resolve_hostname__s
push 0x2000
call fcn.004090c0
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
ret
xor eax, eax
pop esi
pop ebx
ret

Function at 0x40d680
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4b9430]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x120]
push eax
push 0
push 0
lea ecx, [ebp - 0x118]
push ecx
lea edx, [esi + 1]
push edx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x40d6f1
push esi
push str.select___on_socket__d_failed:__E
push 2
call fcn.004090c0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x40d717
push 2
push 1
lea ecx, [ebp - 0x10]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
jne 0x40d6e1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
Function at 0x40d730
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], 0xa
mov edi, str.GET_ftp:__
mov esi, ebx
test ebx, ebx
jne 0x40d753
mov esi, 0x4ab595
jmp 0x40d791
cmp byte [ebx], 0
je 0x40d791
mov al, byte [edi]
test al, al
je 0x40d791
mov cl, byte [esi]
cmp cl, al
je 0x40d785
movzx eax, cl
push eax
call fcn.0046178b
movzx ecx, byte [edi]
add esp, 4
push ecx
mov ebx, eax
call fcn.0046178b
add esp, 4
cmp ebx, eax
mov ebx, dword [ebp + 0xc]
jne 0x40d791
dec dword [ebp - 4]
je 0x40d791
inc esi
inc edi
cmp byte [esi], 0
jne 0x40d758
movzx edx, byte [esi]
push edx
call fcn.0046178b
mov esi, eax
movzx eax, byte [edi]
add esp, 4
push eax
call fcn.0046178b
add esp, 4
sub esi, eax
je 0x40d831
mov dword [ebp - 4], 0xd
mov edi, str.GET_gopher:__
mov esi, ebx
test ebx, ebx
jne 0x40d7cc
mov esi, 0x4ab595
jmp 0x40d80a
cmp byte [ebx], 0
je 0x40d80a
mov al, byte [edi]
test al, al
je 0x40d80a
mov cl, byte [esi]
cmp cl, al
je 0x40d7fe
movzx ecx, cl
push ecx
call fcn.0046178b
movzx edx, byte [edi]
add esp, 4
push edx
mov ebx, eax
call fcn.0046178b
add esp, 4
cmp ebx, eax
mov ebx, dword [ebp + 0xc]
jne 0x40d80a
dec dword [ebp - 4]
je 0x40d80a
inc esi
inc edi
cmp byte [esi], 0
jne 0x40d7d1
movzx eax, byte [esi]
push eax
call fcn.0046178b
movzx ecx, byte [edi]
add esp, 4
push ecx
mov esi, eax
call fcn.0046178b
add esp, 4
sub esi, eax
je 0x40d831
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xa
mov edi, str.GET_ftp:__
mov esi, ebx
test ebx, ebx
jne 0x40d84a
mov esi, 0x4ab595
jmp 0x40d889
cmp byte [ebx], 0
je 0x40d889
nop
mov al, byte [edi]
test al, al
je 0x40d889
mov cl, byte [esi]
cmp cl, al
je 0x40d87d
movzx edx, cl
push edx
call fcn.0046178b
mov ebx, eax
movzx eax, byte [edi]
add esp, 4
push eax
call fcn.0046178b
add esp, 4
cmp ebx, eax
mov ebx, dword [ebp + 0xc]
jne 0x40d889
dec dword [ebp - 4]
je 0x40d889
inc esi
inc edi
cmp byte [esi], 0
jne 0x40d850
movzx ecx, byte [esi]
push ecx
call fcn.0046178b
movzx edx, byte [edi]
add esp, 4
push edx
mov esi, eax
call fcn.0046178b
add esp, 4
sub esi, eax
jne 0x40d8b5
mov dword [ebp + 0xc], 0x4a964c
mov eax, 0x4adb9c
jmp 0x40d8c1
mov dword [ebp + 0xc], str.HTTP_1.1_400_Invalid_request_received_from_client_r_n
mov eax, str.GOPHER
mov edi, dword [ebp + 8]
push ebx
push eax
mov eax, dword [edi + 0xdc]
push eax
push str._s_tried_to_use_Privoxy_as__s_proxy:__s
push 0x2000
call fcn.004090c0
mov ecx, dword [edi + 0xdc]
add esp, 0x14
push ebx
push ecx
push str._s_______T____s__400_0
push 0x200
call fcn.004090c0
add esp, 0x10
test ebx, ebx
je 0x40d906
push ebx
call fcn.0045d483
add esp, 4
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d910
mov ebx, dword [edi + 0x84]
sub eax, edx
mov esi, eax
je 0x40d943
mov edi, dword [ebp + 0xc]
push edi
push esi
push ebx
push str.to_socket__d:__N
push 0x10
call fcn.004090c0
add esp, 0x14
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d950
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, eax
lea esi, [edi + 0xe8]
mov eax, ebx
call fcn.00418ba0
test eax, eax
jne 0x40d971
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, ebx
call fcn.004125f0
mov ebx, eax
call fcn.00413cd0
mov eax, dword [esi]
mov ecx, dword [edi + 0xdc]
push eax
push ecx
push str._s_______T____s__400_0
push 0x200
call fcn.004090c0
mov edx, dword [esi]
mov eax, dword [edi + 0xdc]
push ebx
push edx
push eax
push str.Privoxy_was_unable_to_get_the_destination_for__ss_request:_n_s_n_s
push 0x2000
call fcn.004090c0
add esp, 0x24
test ebx, ebx
je 0x40d9c2
push ebx
call fcn.0045d483
add esp, 4
mov edi, dword [edi + 0x84]
push str.HTTP_1.1_400_Bad_request_received_from_client_r_n
push 0x2f
push edi
push str.to_socket__d:__N
push 0x10
call fcn.004090c0
add esp, 0x14
push 0
push 0x2f
push str.HTTP_1.1_400_Bad_request_received_from_client_r_n
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412360
add esp, 4
pop edi
pop esi
mov eax, 4
pop ebx
pop ebp
ret
Function at 0x40dca0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, eax
push edi
test esi, esi
jne 0x40dcc0
push str.NULL_response_in_send_crunch_response.
push 0x4000
call fcn.004090c0
add esp, 8
cmp dword [0x4c5ca0], 0
mov eax, dword [esi + 0x10]
mov cl, byte [eax + 9]
mov byte [ebp - 4], cl
mov dl, byte [eax + 0xa]
mov byte [ebp - 3], dl
mov al, byte [eax + 0xb]
mov byte [ebp - 2], al
mov byte [ebp - 1], 0
je 0x40ddcb
test byte [0x4c1ff2], 1
je 0x40dd19
lea edi, [ebx + 4]
call fcn.00402650
mov edi, eax
push edi
push 0x4abfc8
push 0x10000
call fcn.004090c0
add esp, 0xc
test edi, edi
je 0x40dd19
push edi
call fcn.0045d483
add esp, 4
cmp dword [ebx + 0x118], 0
je 0x40dd82
mov ecx, dword [ebx + 0xe4]
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
call fcn.00403790
mov edi, eax
add esp, 4
test edi, edi
je 0x40dd79
mov edx, dword [ebx + 0x118]
mov eax, dword [ebx + 0xf4]
mov ecx, dword [ebp - 8]
push edx
push eax
push ecx
push edi
mov eax, esi
call fcn.0040dbd0
push eax
push str._s__s:_d_:__s_Rule__s
push 0x400
call fcn.004090c0
add esp, 0x1c
push edi
call fcn.0045d483
add esp, 4
jmp 0x40dda3
mov edx, dword [ebx + 0xf4]
push edx
jmp 0x40dd89
mov eax, dword [ebx + 0xf4]
push eax
mov eax, esi
call fcn.0040dbd0
push eax
push str._s:__s
push 0x400
call fcn.004090c0
add esp, 0x10
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebx + 0xec]
push ecx
mov ecx, dword [ebx + 0xdc]
lea edx, [ebp - 4]
push edx
push eax
push ecx
push str._s_______T____s___s__u
push 0x200
call fcn.004090c0
add esp, 0x18
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov ecx, dword [ebx + 0x84]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x40de11
push eax
push edi
push ecx
push str.to_socket__d:__N
push 0x10
call fcn.004090c0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add esp, 0x14
push 0
push edi
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, edi
setne cl
mov eax, ecx
test eax, eax
jne 0x40de57
mov edi, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov ecx, dword [ebx + 0x84]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
test edi, edi
je 0x40de70
push eax
push edi
push ecx
push str.to_socket__d:__N
push 0x10
call fcn.004090c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add esp, 0x14
push 0
push edi
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, edi
setne cl
mov eax, ecx
test eax, eax
je 0x40de70
mov edx, dword [ebx + 0x84]
push edx
push str.Couldnt_deliver_the_error_message_through_client_socket__d:__E
push 0x2000
call fcn.004090c0
add esp, 0xc
cmp esi, 0x4c3a44
je 0x40de7d
call fcn.004072c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e850
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14b0
call fcn.00463a90
mov eax, dword [0x4b9430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x14a4]
lea edi, [esi + 0x154]
push eax
call fcn.0040e7d0
add esp, 4
test eax, eax
jne 0x40e981
jmp 0x40e890
mov ecx, dword [esi]
mov edx, dword [ecx + 0x74]
mov edi, dword [esi + 0x84]
xor eax, eax
mov dword [ebp - 0x14ac], eax
mov dword [ebp - 0x14a8], eax
lea eax, [ebp - 0x14ac]
push eax
push 0
push 0
lea ecx, [ebp - 0x14a0]
mov dword [ebp - 0x14ac], edx
push ecx
lea edx, [edi + 1]
push edx
mov dword [ebp - 0x149c], edi
mov dword [ebp - 0x14a0], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jne 0x40e9e5
push 2
push eax
lea eax, [ebp - 0x10]
push eax
push edi
mov edi, dword [sym.imp.WS2_32.dll_recv]
call edi
cmp eax, 1
jne 0x40e9e5
mov ebx, dword [esi + 0x84]
push 0
push 0x1387
lea ecx, [ebp - 0x1398]
push ecx
push ebx
call edi
mov edi, eax
test edi, edi
jle 0x40e9f9
lea edx, [ebp - 0x1398]
push edx
push edi
push ebx
push str.from_socket__d:__N
push 0x8000
call fcn.004090c0
mov ecx, dword [esi]
mov edx, dword [ecx + 0x64]
add esp, 0x14
push edi
lea eax, [ebp - 0x1398]
push eax
lea edi, [esi + 0x154]
mov eax, edi
call fcn.004152f0
add esp, 8
test eax, eax
jne 0x40e98a
mov edx, dword [esi + 0x15c]
sub edx, dword [edi]
cmp edx, 0x32000
jg 0x40e9d0
lea eax, [ebp - 0x14a4]
push eax
call fcn.0040e7d0
add esp, 4
test eax, eax
je 0x40e890
cmp eax, 1
je 0x40ea10
mov edi, dword [esi + 0x84]
push str.HTTP_1.1_400_Failed_reading_client_body_r_n
push 0x29
push edi
push str.to_socket__d:__N
push 0x10
call fcn.004090c0
add esp, 0x14
push 0
push 0x29
push str.HTTP_1.1_400_Failed_reading_client_body_r_n
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esi + 0xdc]
push ecx
push str._s_______T___Failed_reading_chunked_client_body__400_0
push 0x200
call fcn.004090c0
add esp, 0xc
mov eax, 4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
push str.Timeout_while_waiting_for_the_client_body.
push 0x2000
call fcn.004090c0
add esp, 8
jmp 0x40e98a
push str.Read_the_client_body_failed:__E
push 0x2000
call fcn.004090c0
add esp, 8
jmp 0x40e98a
mov edi, dword [ebp - 0x14a4]
push edi
push str.Chunked_client_body_completely_read._Length:__d
push 2
call fcn.004090c0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x1a0], edi
pop edi
xor ecx, ebp
mov dword [esi + 0x1a4], 0
xor eax, eax
pop ebx
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
Function at 0x40ee50
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
test byte [eax + 8], 0x80
push edi
je 0x40ee83
mov ecx, dword [esi + 0xf8]
mov eax, str.HTTP_1.1
call fcn.00413be0
test eax, eax
jne 0x40ee83
cmp dword [esi + 0x110], eax
jne 0x40eec6
or dword [esi + 0xd8], 0x8000
cmp dword [esi + 0x110], 0
jne 0x40eec6
test dword [esi + 0xd8], 0x1000000
je 0x40eeaa
call fcn.0040e850
test eax, eax
je 0x40eec1
mov eax, 4
pop edi
pop esi
pop ebx
ret
lea eax, [esi + 0x164]
call fcn.00418f90
mov dword [esi + 0x1a0], eax
mov dword [esi + 0x1a4], edx
call fcn.0040e210
push 0
push esi
call fcn.004162c0
add esp, 8
test eax, eax
je 0x40eee7
push str.Failed_to_parse_client_headers.
push 0x4000
call fcn.004090c0
add esp, 8
mov eax, dword [esi + 0x164]
or dword [esi + 0xd8], 0x100
cmp dword [eax], 0
je 0x40ef3e
mov ecx, dword [eax]
mov eax, dword [esi + 0xe8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ef24
test dl, dl
je 0x40ef20
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ef24
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ef04
xor eax, eax
jmp 0x40ef29
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40ef38
mov eax, esi
call fcn.0040e000
test eax, eax
jne 0x40ef3e
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov edi, dword [esi + 0x84]
push str.HTTP_1.1_400_Malformed_request_after_rewriting_r_n
push 0x30
push edi
push str.to_socket__d:__N
push 0x10
call fcn.004090c0
add esp, 0x14
push 0
push 0x30
push str.HTTP_1.1_400_Malformed_request_after_rewriting_r_n
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esi + 0xdc]
push ecx
push str._s_______T___Invalid_request_generated__500_0
push 0x200
call fcn.004090c0
add esp, 0xc
push str.Invalid_request_line_after_applying_header_filters.
push 0x2000
call fcn.004090c0
add esp, 8
lea esi, [esi + 0xe8]
call fcn.004202b0
pop edi
pop esi
mov eax, 4
pop ebx
ret
Function at 0x4117d0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x220
mov eax, dword [0x4b9430]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [0x4c5c74], eax
mov dword [0x4c5c78], edi
mov dword [0x4c5c70], 0x4af0c8
call fcn.004232e0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4c7140
call esi
push 0x4c73e0
call esi
push 0x4c7160
call esi
push 0x4c71c0
call esi
push 0x4c71e0
call esi
push 0x4c71a0
call esi
push 0x4c7180
call esi
push 0x4c7140
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0045ff63
add eax, 0x40
push 0x4c7140
mov dword [0x4c5b2c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [0x4c1ff0], 0x4000
mov esi, 1
xor ebx, ebx
cmp dword [ebp + 8], esi
jle 0x41195c
lea ecx, [ecx]
mov ecx, dword [edi + esi*4]
push 9
push str.__install
push ecx
call fcn.0045d3c3
add esp, 0xc
test eax, eax
je 0x4119d4
mov edx, dword [edi + esi*4]
push 0xb
push str.__uninstall
push edx
call fcn.0045d3c3
add esp, 0xc
test eax, eax
je 0x4119f0
mov eax, dword [edi + esi*4]
mov ecx, str.__service
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4118e0
cmp dl, bl
je 0x4118dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4118e0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x4118c0
xor eax, eax
jmp 0x4118e5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x411952
push 0x104
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [0x4c5cbc], 1
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x411945
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x11c]
push edx
push 0x104
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x411945
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x411945
lea ecx, [esp + 0x118]
push ecx
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x423370
call fcn.0045e392
add esp, 4
inc esi
cmp esi, dword [ebp + 8]
jl 0x411880
mov edx, dword [0x4c5c78]
mov esi, dword [edx]
push str.Privoxy_version_2.1
push 0x1000
call fcn.004090c0
add esp, 8
cmp esi, ebx
je 0x41198d
push esi
push str.Program_name:__s
push 0x1000
call fcn.004090c0
add esp, 0xc
push ebx
mov dword [0x4c721c], ebx
mov dword [0x4c7220], ebx
call fcn.0045ec8e
push eax
call fcn.00460836
add esp, 8
call fcn.00406b80
cmp dword [0x4c5cbc], ebx
je 0x411a0c
call fcn.00422df0
test eax, eax
je 0x411a0c
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + esi*4]
add ecx, 9
cmp byte [ecx], 0x3a
jne 0x4119e0
inc ecx
call fcn.00422f70
neg eax
sbb eax, eax
inc eax
push eax
call fcn.0046039b
mov ecx, dword [edi + esi*4]
add ecx, 0xb
cmp byte [ecx], 0x3a
jne 0x4119fc
inc ecx
call fcn.004230d0
neg eax
sbb eax, eax
inc eax
push eax
call fcn.0046039b
call fcn.00411b80
call fcn.00412310
mov ecx, dword [esp + 0x224]
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
Function at 0x412130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4b9430]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.00463ac0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x10c]
push 0x5c
push edx
call fcn.0045e830
mov byte [eax], 0
lea eax, [ebp - 0x10c]
add esp, 8
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x412190
mov ecx, dword [str._adhook.ini]
mov edx, dword [0x4ab8f8]
mov dword [eax], ecx
mov ecx, dword [0x4ab8fc]
mov dword [eax + 4], edx
lea edx, [ebp - 0x10c]
push edx
push 0x104
push esi
push str.adhook.dll
push str.dllname
push 0x4ab9f4
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
Function at 0x415290
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebx + 8]
push edi
mov edi, dword [ebx + 4]
sub esi, edi
test esi, esi
jg 0x4152a9
xor eax, eax
pop edi
pop esi
pop ecx
pop ebp
ret
mov eax, dword [ebp + 8]
push edi
push esi
push eax
push str.to_socket__d:__N
push 0x10
call fcn.004090c0
mov ecx, dword [ebp + 8]
add esp, 0x14
push 0
push esi
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
xor edx, edx
cmp eax, esi
setne dl
mov eax, edx
test eax, eax
je 0x4152e1
or eax, 0xffffffff
pop edi
pop esi
pop ecx
pop ebp
ret
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
pop edi
mov eax, esi
pop esi
pop ecx
pop ebp
ret
Function at 0x41abc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
push esi
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4aba9c
push eax
call fcn.0045e59d
mov esi, eax
add esp, 8
test esi, esi
jne 0x41abeb
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 2
push 0
push esi
call fcn.0045eae0
push esi
call fcn.0045e9f1
push 0
push 0
push esi
mov ebx, eax
call fcn.0045eae0
lea ecx, [ebx + 1]
push ecx
call fcn.0045db21
push esi
push 1
push ebx
push eax
mov dword [ebp - 4], eax
call fcn.0045e809
add esp, 0x30
push esi
cmp eax, 1
je 0x41ac37
call fcn.0045ec1a
add esp, 4
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0045ec1a
mov edx, dword [ebp - 4]
add esp, 4
mov dword [edi + 4], ebx
pop ebx
mov dword [edi], edx
mov dword [edi + 8], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ace0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4b9430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x104
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.00463ac0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x110]
push 0x5c
push edx
call fcn.0045e830
mov byte [eax], 0
lea eax, [ebp - 0x110]
add esp, 8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41ad48
mov ecx, dword [str.datauser.txt]
mov edx, dword [0x4b1aa4]
push esi
push 0x80
mov dword [eax], ecx
mov ecx, dword [0x4b1aa8]
push 3
mov dword [eax + 4], edx
mov dx, word [0x4b1aac]
push esi
mov dword [eax + 8], ecx
mov cl, byte [0x4b1aae]
push 7
mov word [eax + 0xc], dx
push accept
lea edx, [ebp - 0x110]
push edx
mov byte [eax + 0xe], cl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41adfa
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x41ade0
cmp edi, 0xa00000
ja 0x41ade0
lea eax, [edi + 1]
push eax
call fcn.0045db21
mov esi, eax
add esp, 4
test esi, esi
je 0x41ade0
push 0
lea ecx, [ebp - 0x114]
push ecx
push edi
push esi
push ebx
mov byte [esi + edi], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41adfa
push esi
call fcn.0041b790
push esi
call fcn.0045d483
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
Function at 0x41ae10
Capabilities:
Create thread
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4b9430]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c5a70]
push esi
push edi
xor esi, esi
push esi
push esi
push 0xe
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x104
lea ecx, [ebp - 0x10b]
push esi
push ecx
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x10c], 0
call fcn.00463ac0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x10c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.0045e830
mov byte [eax], 0
lea eax, [ebp - 0x10c]
add esp, 8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41ae87
mov ecx, dword [str.datauser.txt]
mov edx, dword [0x4b1aa4]
inc dword [ebp - 0x110]
push 0
push 0x80
mov dword [eax], ecx
mov ecx, dword [0x4b1aa8]
push 2
mov dword [eax + 4], edx
mov dx, word [0x4b1aac]
push 0
mov dword [eax + 8], ecx
mov cl, byte [0x4b1aae]
push 7
mov word [eax + 0xc], dx
push 0x40000000
lea edx, [ebp - 0x10c]
push edx
mov byte [eax + 0xe], cl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41af3e
push ebx
mov ebx, dword [ebp - 0x110]
lea eax, [ebx + 1]
push eax
call fcn.0045db21
mov esi, eax
add esp, 4
test esi, esi
je 0x41af36
mov ecx, dword [0x4c5a70]
push esi
push ebx
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x110]
push 0
mov byte [edx + esi], 0
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0x110]
push eax
dec ecx
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
push esi
call fcn.0045d483
push 0
push 0
push 0x403780
call fcn.0045dd34
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
xor ecx, ebp
pop esi
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret