joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ab91c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5ab92e
add esp, 0xfffffff0
call fcn.00407b88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c2d34
mov eax, dword [0x5c9c28]
mov dword [eax + 4], ebx
mov dword [eax], 0x5abdd8
mov eax, dword [0x5c9c38]
mov dword [eax + 4], ebx
mov dword [eax], 0x5abde4
mov eax, ebx
call fcn.005abdf0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x48], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x60]
push eax
mov eax, 0x5a66a8
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4f7044]
call fcn.004fd194
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4f7044]
call fcn.004fd194
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4f7044]
call fcn.004fd194
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4f7044]
call fcn.004fd194
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4f7044]
call fcn.004fd194
mov dword [ebx + 0x90], eax
mov eax, ebx
call fcn.005ac3e0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ac1fc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ac1fc
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ac1fc
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ac1fc
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ac1fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5abaab
call fcn.00407be0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5abf9c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ac147
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x5ac128
mov dl, 1
mov eax, dword [0x48de20]
call fcn.004b1100
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.004091c4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5ac117
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00529c30
test al, al
je 0x5ac10a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5ac158
lea eax, [ebp - 0x394]
call fcn.00422610
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5ac10a
xor eax, eax
push ebp
push 0x5ac103
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5ac1c8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5ac0ec
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409dac
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x5ac0ec
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac10a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5ac00d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004b103c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac14e
lea eax, [ebp - 0x3a0]
call fcn.004091c4
ret

Function at 0x5acd08
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5d033c]
cmp byte [eax + 0xb9], 0
jne 0x5acd7a
cmp dword [0x5d035c], 0
jne 0x5acd3a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5c9a80]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5d035c], eax
cmp dword [0x5d0358], 0
jne 0x5acd55
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5d0358], eax
cmp dword [0x5d0360], 0
jne 0x5acd7a
push esp
push 0
push 0
mov eax, dword [0x5c9a7c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5d0360], eax
pop edx
ret
Function at 0x5ad368
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5ad37f
add esp, 0xfffffff0
call fcn.00407b88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c2d34
mov eax, dword [0x5c9af0]
cmp byte [eax], 0
jne 0x5ad3ac
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x18c], al
mov eax, dword [0x5c9e0c]
cmp word [eax + 2], 0
jne 0x5ad3c6
mov eax, dword [0x5c9e0c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005af678
mov eax, dword [0x5c9f34]
cmp word [eax + 2], 0
jne 0x5ad3e0
mov eax, dword [0x5c9f34]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005af87c
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x4f7044]
call fcn.004fd194
mov esi, eax
mov dword [ebx + 0x4c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5afdf4
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0x9c], eax
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0xbc], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
xor eax, eax
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x68], 0xff000018
mov dword [ebx + 0x84], 0x1f4
mov byte [ebx + 0x88], 1
xor eax, eax
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x80], 0x9c4
mov byte [ebx + 0x94], 0
mov byte [ebx + 0xb1], 1
mov byte [ebx + 0xc8], 1
mov dl, 1
mov eax, dword [0x4fba6c]
call fcn.00506904
mov esi, eax
mov dword [ebx + 0xac], esi
push 0x5ad5c8
mov eax, dword [0x5c9ccc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00506d94
mov eax, dword [ebx + 0xac]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5b00dc
mov dl, 1
mov eax, dword [0x48a664]
call fcn.00407554
mov dword [ebx + 0xa4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5c9ccc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00422410
test eax, eax
je 0x5ad4fa
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042224c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004223f4
test eax, eax
je 0x5ad512
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x98]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00409dac
push ebx
push 0x5af054
call fcn.005a2b4c
mov dword [ebx + 0x188], eax
mov byte [ebx + 0xdc], 0
mov eax, dword [0x5c9af0]
cmp byte [eax], 0
jne 0x5ad563
mov eax, ebx
call fcn.005ad790
mov byte [ebx + 0x65], 1
mov byte [ebx + 0x66], 1
mov byte [ebx + 0x67], 1
mov byte [ebx + 0xb2], 1
mov byte [ebx + 0xdd], 0
mov byte [ebx + 0xe8], 0
xor eax, eax
mov dword [ebx + 0xe0], eax
mov byte [ebx + 0xdf], 0
xor eax, eax
mov dword [ebx + 0xb4], eax
mov eax, ebx
call fcn.005b0324
mov eax, ebx
call fcn.005b0f74
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5ad5c0
call fcn.00407be0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5adac8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x180]
test eax, eax
je 0x5adb74
cmp dword [ebx + 0xa0], 0
jne 0x5adb6e
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5ada00
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x9c]
cmp dword [eax + 8], 0
je 0x5adb6e
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5adb34
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x9c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5adb6e
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x9c]
call fcn.004aca20
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5adb43
inc dword [ebx + 0xa0]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5add94
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5d033c]
cmp dword [eax + 0x180], 0
je 0x5adef9
test bl, bl
jne 0x5ade47
cmp dword [esi + 0xa8], 0
jne 0x5ade3c
mov eax, esi
call fcn.005b0dc4
push eax
push 0x5adca0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x50], 0
je 0x5ade0d
mov eax, dword [0x5d033c]
cmp byte [eax + 0xdf], 0
je 0x5ade0d
mov eax, dword [esi + 0xe4]
call fcn.0040af70
mov edi, eax
cmp edi, 0
jl 0x5ade0d
push 0
mov eax, dword [esi + 0xe4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5addf6
mov eax, dword [esi + 0xa4]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ade3c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xa4]
call fcn.004aca20
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ade1c
inc dword [esi + 0xa8]
jmp 0x5adef9
cmp dword [esi + 0xa8], 0
jle 0x5adef9
dec dword [esi + 0xa8]
cmp dword [esi + 0xa8], 0
jne 0x5adef9
cmp dword [esi + 0x50], 0
je 0x5adea4
mov eax, dword [0x5d033c]
cmp byte [eax + 0xdf], 0
je 0x5adea4
mov eax, dword [esi + 0xe4]
call fcn.0040af70
mov edi, eax
cmp edi, 0
jl 0x5adea4
push 5
mov eax, dword [esi + 0xe4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ade8d
mov eax, dword [esi + 0xa4]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5aded3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xa4]
call fcn.004aca20
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5adeb3
mov eax, dword [esi + 0xa4]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xe4]
mov ecx, 1
mov edx, dword [0x59f3f0]
call fcn.0040b184
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5aeb54
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb8], 0
je 0x5aebb1
cmp byte [ebx + 0xdf], 0
jne 0x5aebb1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040934c
mov eax, dword [esi]
test eax, eax
je 0x5aeb9e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5aebbe
mov eax, esi
mov edx, dword [ebx + 0x98]
call fcn.004095a4
jmp 0x5aebbe
mov eax, esi
mov edx, dword [ebx + 0x98]
call fcn.004095a4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5b0510
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x90]
test esi, esi
je 0x5b0581
mov eax, esi
call fcn.00523a68
test al, al
je 0x5b0581
mov eax, dword [ebx + 0x90]
call fcn.005236b4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5b0581
mov eax, dword [ebx + 0x90]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5b0572
push 0
mov eax, dword [ebx + 0x90]
call fcn.005236b4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x90]
call fcn.0051a3f8
jmp 0x5b0581
mov cl, 1
mov edx, dword [ebx + 0x80]
mov eax, ebx
call fcn.005b0344
pop esi
pop ebx
ret
Function at 0x5b7084
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5b70fe
mov eax, dword [ebx + 8]
call fcn.005236b4
mov ecx, eax
mov dl, 1
mov eax, dword [0x5307d0]
call fcn.0051da38
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00535c40
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b0], 0x5b697c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005236b4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005236b4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5b7174
mov eax, dword [ebx + 8]
call fcn.005236b4
mov ecx, eax
mov dl, 1
mov eax, dword [0x5307d0]
call fcn.0051da38
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00535c40
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b0], 0x5b69c8
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005236b4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005236b4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5b71e0
mov eax, dword [ebx + 8]
call fcn.005236b4
mov ecx, eax
mov dl, 1
mov eax, dword [0x531240]
call fcn.0051da38
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x288], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.005236b4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.005236b4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5bae78
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5bafc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004091c4
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.00409d08
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x5bafb3
mov eax, dword [ebp - 8]
call fcn.004066e0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5bafac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
cmp dword [ebp - 0x10], 0
jne 0x5baefc
call fcn.004089c0
jmp 0x5bafb3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5bafdc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
cmp dword [ebp - 0x14], 0
jne 0x5baf22
call fcn.004089c0
jmp 0x5bafb3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x5bb020
call fcn.004226e0
mov eax, dword [ebp - 0x1c]
call fcn.00409d08
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
cmp dword [ebp - 0x18], 0
jne 0x5baf88
call fcn.004089c0
jmp 0x5bafb3
mov ecx, dword [ebp - 8]
dec ecx
mov eax, esi
mov edx, dword [ebp - 0x18]
call fcn.0040934c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bafb3
mov eax, dword [ebp - 0x10]
call fcn.004066fc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bafd0
lea eax, [ebp - 0x1c]
call fcn.004091c4
ret
Function at 0x40e0a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47dc68]
jne 0x40e0aa
repz ret
jmp fcn.00412cef

Function at 0x41f473
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041324f
and dword [ebp - 4], 0
cmp dword [0x481b40], 0
mov ebx, eax
jne 0x41f524
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f5d5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46afa4
push edi
call esi
test eax, eax
je 0x41f5d5
push eax
call fcn.004131dd
mov dword [esp], 0x46af94
push edi
mov dword [0x481b40], eax
call esi
push eax
call fcn.004131dd
mov dword [esp], 0x46af80
push edi
mov dword [0x481b44], eax
call esi
push eax
call fcn.004131dd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x481b48], eax
call esi
push eax
call fcn.004131dd
pop ecx
mov dword [0x481b50], eax
test eax, eax
je 0x41f524
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004131dd
pop ecx
mov dword [0x481b4c], eax
mov eax, dword [0x481b4c]
cmp eax, ebx
je 0x41f57c
cmp dword [0x481b50], ebx
je 0x41f57c
push eax
call fcn.00413258
push dword [0x481b50]
mov esi, eax
call fcn.00413258
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f57c
test edi, edi
je 0x41f57c
call esi
test eax, eax
je 0x41f573
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f573
test byte [ebp - 0xc], 1
jne 0x41f57c
or dword [ebp + 0x10], 0x200000
jmp 0x41f5b5
mov eax, dword [0x481b44]
cmp eax, ebx
je 0x41f5b5
push eax
call fcn.00413258
pop ecx
test eax, eax
je 0x41f5b5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f5b5
mov eax, dword [0x481b48]
cmp eax, ebx
je 0x41f5b5
push eax
call fcn.00413258
pop ecx
test eax, eax
je 0x41f5b5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x481b40]
call fcn.00413258
pop ecx
test eax, eax
je 0x41f5d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f5d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x424320
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x47dc68]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x424375
mov eax, dword [esp]
cmp al, 2
jne 0x42436f
shr eax, 8
cmp al, 2
jne 0x42436f
call fcn.00424730
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040e0a0
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.0040e0a0
add esp, 0x194
ret
Function at 0x431260
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x431292
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x4313f0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x43140b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x43143f
cmp eax, 2
jg 0x43143f
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x46c9e8]
push 2
push edx
call fcn.0040e809
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.0040e809
add esp, 0x20
xor eax, eax
ret

Function at 0x4319d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [eax + ecx*4 + 0x190]
mov edx, ecx
shl edx, 4
push esi
lea esi, [edx + eax + 0x1b8]
mov edx, dword [eax + 0x440]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x431a7f
cmp dword [eax + ecx*4 + 0x1a8], 0x431760
jne 0x431a7f
cmp dword [esi], 0
je 0x431a12
test edi, edi
je 0x431a7f
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00424a20
add esp, 0x14
cmp eax, 0xffffffff
je 0x431a7f
test al, 1
je 0x431a7f
cmp dword [esi], 0
jne 0x431a5d
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x47ee7c]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x431a78
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x431a7f
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
ret

Function at 0x431a90
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi + ecx*4 + 0x190]
mov eax, esi
call fcn.004319d0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x431b14
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x431aeb
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.004374b0
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.004315d0
mov eax, dword [esi]
mov dword [eax + 0x473c], ebp
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4339b0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x538], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x4339ee
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00431540
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x53c]
push edx
mov dword [esp + 0xc], 1
call fcn.004351b0
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x540]
push eax
call fcn.004351b0
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x433a67
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00431540
add esp, 0x10
add esp, 0x14
ret