joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466490
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599ee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp + 8]
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x3c
call fcn.0058dfec
push str.Datadft.dat
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x40
call fcn.0058dfec
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0058df86
mov ecx, dword [ebp - 0x18]
add ecx, 0x40
call sub.MFC42.DLL_CString::MakeLower
push str.Datadft.ses
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x28]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x44
call fcn.0058dfec
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0058df86
mov ecx, dword [ebp - 0x18]
add ecx, 0x44
call sub.MFC42.DLL_CString::MakeLower
mov eax, dword [ebp - 0x18]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x34
call fcn.0058dfec
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0058df86
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x46df0a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a762
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00403760
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0x3ff00000
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00403710
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00403710
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 1
mov edx, dword [ebp - 0x10]
mov dword [edx], method.CObject.virtual_0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004038b0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004038b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x473639
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ecx
cmp dword [ebp + 8], 0
jne 0x473653
jmp 0x4737da
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.004739f0
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], 0
jmp 0x47367f
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x104]
cmp ecx, dword [ebp - 0x108]
jge 0x4737da
mov byte [ebp - 0x100], 0
mov dword [ebp - 0x110], 0
jmp 0x4736b3
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp + 0xc]
jge 0x4736d4
push 0x5ea174
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x4736a4
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.00473a10
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x473707
jmp 0x473670
mov ecx, dword [ebp - 0x10c]
call fcn.00490ea0
test eax, eax
jne 0x47374c
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp - 0x114]
call fcn.00490f93
push eax
mov edx, dword [ebp - 0x104]
push edx
push str._02d___operator___d__r_n
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x473780
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x118], ecx
mov ecx, dword [ebp - 0x118]
call fcn.004912d3
push eax
mov edx, dword [ebp - 0x104]
push edx
push str._02d___litteral___s__r_n
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x10c]
call fcn.00490ea0
test eax, eax
jne 0x4737d5
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x11c], edx
mov ecx, dword [ebp - 0x11c]
call fcn.0049102f
test eax, eax
je 0x4737d5
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 0x11c]
call fcn.0049102f
push eax
mov ecx, dword [ebp - 0x120]
call fcn.00473639
jmp 0x473670
mov esp, ebp
pop ebp
ret 8
Function at 0x4750b9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59abdd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
call fcn.0043ce70
test eax, eax
jne 0x475100
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xfc]
call fcn.004a200d
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xe4], 1
push 0x9e
call fcn.0040acc0
mov ecx, eax
call fcn.0041ccc0
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x60
call fcn.004754b0
push 1
push 0x3fe
mov ecx, dword [ebp - 0x14]
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
push 0x400
mov ecx, dword [ebp - 0x14]
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
push 0x401
mov ecx, dword [ebp - 0x14]
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
ja case.0x475188.14
mov ecx, dword [ebp - 0x18]
jmp dword [ecx*4 + 0x475310]
push 0x5ea1fc
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.ISO_mode_refused_by_CNC
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.ISO_block_refused
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Wrong_Object
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Wrong_Field
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Command_Failed
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Write_Failed
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Inc_Failed
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Syntax_Error
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.File_copy_failed
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Missing_REP
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Time_out
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Internal_synchronisation_problem
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.PLP_mode_refused_by_CNC
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Cycle_could_not_be_executed
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
jmp 0x475292
push str.Unknown_Error
lea ecx, [ebp - 0x10]
call fcn.0058e0f4
lea ecx, [ebp - 0x10]
call fcn.00403d90
push eax
push 0x40d
mov ecx, dword [ebp - 0x14]
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0x5ea338
push 0
push 0x5ea344
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4752f1
mov ecx, dword [ebp - 0x14]
call fcn.00475395
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
jmp 0x475300
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x47567b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40c]
call fcn.00516c38
test eax, eax
jne 0x4756bc
push 0xffffffffffffffff
push 0
push 0
push 0
push str.FIDIA_WS_NOPROC
call dword [sym.imp.LANGUAGE.dll_char_const____cdecl_ReadLanguageString_char_const___char_const___int_]
add esp, 0xc
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00436ac0
add esp, 0x10
jmp 0x47578c
push 0xffffffffffffffff
push 4
push 0
push 0
push 0x5ea39c
call dword [sym.imp.LANGUAGE.dll_char_const____cdecl_ReadLanguageString_char_const___char_const___int_]
add esp, 0xc
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00436ac0
add esp, 0x10
cmp eax, 6
je 0x4756e9
jmp 0x47578c
push 0
push 0
push 0
push 0x5ea3b8
call dword [sym.imp.LANGUAGE.dll_char_const____cdecl_ReadLanguageString_char_const___char_const___int_]
add esp, 0xc
push eax
mov ecx, dword [ebp - 4]
call fcn.00487e4c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40c]
call fcn.00516b04
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x40c]
call fcn.00516f22
cmp eax, 7
jne 0x475773
push 0x5ea3d0
push 0
push 0x5ea3dc
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x475763
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
call fcn.004869cf
jmp 0x475773
push 0
push 0
push 0
push 1
mov ecx, dword [ebp - 4]
call fcn.004869cf
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4b0], 0
je 0x47578c
mov eax, dword [ebp - 4]
mov dword [eax + 0x4b8], 1
mov esp, ebp
pop ebp
ret
Function at 0x475790
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40c]
call fcn.00516c38
test eax, eax
je 0x4758ad
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x4757e7
push 0xffffffffffffffff
push 4
push 0
push 0
push str.FIDIA_WS_CONFIRMABORTPROC
call dword [sym.imp.LANGUAGE.dll_char_const____cdecl_ReadLanguageString_char_const___char_const___int_]
add esp, 0xc
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00436ac0
add esp, 0x10
cmp eax, 6
je 0x4757e7
jmp 0x4758bd
push 0
push 0
push 0
push 0x5ea40c
call dword [sym.imp.LANGUAGE.dll_char_const____cdecl_ReadLanguageString_char_const___char_const___int_]
add esp, 0xc
push eax
mov ecx, dword [ebp - 4]
call fcn.00487e4c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40c]
call fcn.00516b04
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x71c], 0
je 0x475839
mov edx, dword [ebp - 4]
mov dword [edx + 0x71c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x544]
call fcn.00453477
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x475882
push 0x5ea424
push 0
push str.VerboseAbortProc
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x475882
push 0
push 0
push 1
push 0
mov ecx, dword [ebp - 4]
call fcn.004869cf
jmp 0x475892
push 0
push 0
push 1
push 1
mov ecx, dword [ebp - 4]
call fcn.004869cf
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4b0], 0
je 0x4758ab
mov eax, dword [ebp - 4]
mov dword [eax + 0x4b8], 1
jmp 0x4758bd
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
call fcn.004869cf
mov esp, ebp
pop ebp
ret 4
Function at 0x479717
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.0042ca70
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
jne 0x479746
xor eax, eax
jmp 0x4797e9
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call fcn.0042ca70
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jne 0x47976b
xor eax, eax
jmp 0x4797e9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x479785
xor eax, eax
jmp 0x4797e9
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
lea ecx, [ecx + eax + 0x400]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov ecx, dword [ecx]
lea edx, [eax + ecx + 0x400]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x47d3f5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b48c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::CFileFind
mov dword [ebp - 4], 0
push 0
push str.a:.
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x47d47a
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x38]
call fcn.00403d90
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0058df86
cmp dword [ebp - 0x10], 0
jne 0x47d432
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0058e9fa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x47db9d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 4], 1
lea eax, [ebp + 0xc]
push eax
push 0x5eb238
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_operator_2
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp + 0xc]
call fcn.0058dfec
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0058df86
mov ecx, 1
test ecx, ecx
je 0x47dc8c
push 0
lea ecx, [ebp + 0xc]
call fcn.00403d90
push eax
lea ecx, [ebp + 8]
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x47dc48
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0058df86
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0058df86
mov eax, dword [ebp - 0x14]
jmp 0x47dca7
push 0
push 0x11
push str.Change_Insert_floppy_disk
call sub.MFC42.DLL_AfxMessageBox
cmp eax, 1
je 0x47dc82
mov dword [ebp - 0x18], 2
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0058df86
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0058df86
mov eax, dword [ebp - 0x18]
jmp 0x47dca7
call fcn.0047d3f5
jmp 0x47dbf6
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0058df86
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0058df86
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48979e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jae 0x489829
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x489827
cmp dword [ebp - 0x1c], 0x12
jne 0x4897e1
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x489829
cmp dword [ebp - 0x1c], 0x112
jne 0x489813
mov ecx, dword [ebp - 0x18]
and ecx, 0xfff0
cmp ecx, 0xf060
jne 0x489813
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x489829
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4897ad
mov esp, ebp
pop ebp
ret

Function at 0x48f420
Capabilities:
Initialize winsock library
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov dword [ebp - 0x1a0], ecx
lea eax, [ebp - 0x198]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov word [ebp - 0x19c], ax
movsx ecx, word [ebp - 0x19c]
test ecx, ecx
je 0x48f468
push 0x5ffcd8
push str.933_Internal_error:_Could_not_initialise_network
mov ecx, dword [ebp - 0x1a0]
call fcn.0048f54f
call sub.ICMP.dll_IcmpCreateFile
mov dword [0x5ffc0c], eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x5ffc54], eax
push 0x40
push 0x59
push 0x5ffc14
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x5c
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x5ffc10], eax
push 0x5c
push 0
mov ecx, dword [0x5ffc10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [0x5ffc10]
mov dword [edx + 0x10], 0x5ffc9c
mov eax, dword [0x5ffc10]
mov word [eax + 0xc], 0x40
mov ecx, dword [ebp + 0xc]
push ecx
push 0x5c
mov edx, dword [0x5ffc10]
push edx
push 0
push 0x40
push 0x5ffc14
mov eax, dword [0x5ffc54]
push eax
mov ecx, dword [0x5ffc0c]
push ecx
call sub.ICMP.dll_IcmpSendEcho
mov dword [0x5ffc58], eax
mov edx, dword [0x5ffc10]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
mov ecx, dword [0x5ffc0c]
push ecx
call sub.ICMP.dll_IcmpCloseHandle
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x5ffc58], 0
jne 0x48f546
or eax, 0xffffffff
jmp 0x48f549
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x493ef5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c73d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp + 8]
push edx
push str.Fapi_d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x158], edx
push 0x5eee2c
push 0
push 0x5eee38
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x493faf
push 0x5eee40
mov ecx, dword [ebp - 0x90]
add ecx, 0x154
call fcn.0058e0f4
mov eax, dword [ebp - 0x90]
mov dword [eax + 0x15c], 2
jmp 0x494078
push 0x5eee48
push 0x80
lea ecx, [ebp - 0x8c]
push ecx
push str.FAPI1
lea edx, [ebp - 0x110]
push edx
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x8c]
push eax
mov ecx, dword [ebp - 0x90]
add ecx, 0x154
call fcn.0058e0f4
movsx ecx, byte [ebp - 0x8c]
push ecx
call dword [sym.imp.MSVCRT.dll_isdigit]
add esp, 4
test eax, eax
je 0x494024
mov edx, dword [ebp - 0x90]
mov dword [edx + 0x15c], 0
jmp 0x494078
push 0x5eee5c
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x494056
push 0x5eee60
lea ecx, [ebp - 0x8c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x494068
mov edx, dword [ebp - 0x90]
mov dword [edx + 0x15c], 3
jmp 0x494078
mov eax, dword [ebp - 0x90]
mov dword [eax + 0x15c], 2
lea ecx, [ebp - 0x118]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x11c]
cmp dword [ecx + 0x114], 0
je 0x4940a9
push str.TeleService
lea ecx, [ebp - 0x118]
call fcn.0058e0f4
lea ecx, [ebp - 0x118]
call fcn.00403d90
push eax
mov ecx, dword [ebp - 0x90]
add ecx, 0x154
call fcn.00403d90
push eax
mov edx, dword [ebp - 0x90]
mov ecx, dword [edx + 0xec]
call fcn.0045473c
mov ecx, dword [ebp - 0x11c]
call sub.MFC42.DLL_CWinApp::OnFileNew
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.0058df86
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x494794
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp + 8]
push eax
push str.CncDir_d
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5eeeac
push 0x80
lea edx, [ebp - 0xa0]
push edx
push str.C:Fidia
lea eax, [ebp - 0x20]
push eax
push 0x5eeec4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0xa0]
push ecx
mov ecx, dword [ebp - 0xa8]
add ecx, 0x484
call fcn.0058e0f4
mov edx, dword [ebp - 0xa8]
add edx, 0x484
push ecx
mov ecx, esp
mov dword [ebp - 0xa4], esp
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xa8]
add ecx, 0x58
call fcn.00461eaf
call fcn.0040acc0
cmp dword [eax + 0x110], 0
je 0x49484f
call fcn.0040acc0
add eax, 0x108
push eax
mov ecx, dword [ebp - 0xa8]
add ecx, 0x484
call sub.MFC42.DLL_CString::operator
mov esp, ebp
pop ebp
ret 4

Function at 0x495d30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [ebp + 8], 0
je 0x495d5c
mov ecx, dword [ebp - 0x6f]
and ecx, 0xff
and ecx, 1
test ecx, ecx
je 0x495d72
cmp dword [ebp + 8], 0
jne 0x495d94
mov edx, dword [ebp - 0x6f]
and edx, 0xff
and edx, 1
test edx, edx
je 0x495d94
push 0
push 1
push 0x45
push 0x91
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 3
push 0x45
push 0x91
call dword [sym.imp.USER32.dll_keybd_event]
mov esp, ebp
pop ebp
ret

Function at 0x495d98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x44
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
test ecx, ecx
je 0x495dcf
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x495dff
mov eax, 0xffffffbb
jmp 0x495e68
mov edx, dword [ebp + 0x14]
and edx, 0xff
test edx, edx
jne 0x495e3a
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x495e33
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
test ecx, ecx
jne 0x495e33
push 6
call fcn.0040fa80
mov ecx, eax
call sub.MFC42.DLL_CWnd::ShowWindow
mov eax, 1
jmp 0x495e68
mov dword [ebp - 0x5c], 0x103
cmp dword [ebp - 0x5c], 0x103
jne 0x495e65
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x495e41
mov eax, dword [ebp - 0x5c]
mov esp, ebp
pop ebp
ret