joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71bb3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0x76
mov word [esp + 0x19], sp
mov byte [esp + 0xb], ch
xchg bp, si
mov dword [esp + 0x13], ecx
jmp 0x71bb42
lea ebp, [esp + ecx]
mov ch, byte [esp]
jmp 0x71bb21
push word [esp + 0x14]
mov esi, dword [esp + 0xc]
mov bl, 0xc0
mov word [esp + 0x17], di
jmp 0x71bbd9
cmc
pop word [esp + 0x27]
xchg word [esp + 0x13], bx
xchg dword [esp + 0xb], eax
btr edx, edx
bsr si, bp
jmp 0x71bcef
btc edx, ebx
sub esp, 8
sub edx, eax
push dword [esp + 0xf]
mov si, word [esp + 0xc]
mov bl, bh
jmp 0x71bb8b
xchg word [esp + 0xd], di
push word [esp]
push word [esp + 0x14]
mov di, 0x65d3
lea esi, reloc.WINMM.dll_mmioCreateChunk
and esi, ecx
jmp 0x71bbb5
mov dh, byte [esp]
not dh
lea ebp, [ebx + ebx]
rdtsc
push word [esp + 1]
neg bx
jmp 0x71bcb2
rdtsc
xchg bh, cl
xchg word [esp + 0xa], ax
cld
pop ebp
add esp, 6
jmp 0x71bc24
mov dword [esp], ebp
xchg di, ax
lea ebp, [eax - 0xf9]
call fcn.0071bc6c
mov dl, 0x3c
bsf ax, si
btr edx, esp
inc ebx
rdtsc
mov bl, bh
jmp 0x71bcd8
cmc
neg bx
xchg dword [esp], eax
not ebx
btc ebx, ebx
not ch
jmp 0x71bc85
mov cl, ch
not ax
sub esp, 0xc
mov edi, 0x4abdd5e6
jmp 0x71bf7e
push esp
lea esi, [ebp - 0xd7]
mov edx, ebp
sete ah
mov cl, ch
lea edi, [eax + ebx]
jmp 0x71bcc2
xchg dx, bx
clc
mov edi, eax
lea ecx, reloc.WINMM.dll_mmioCreateChunk
popal
mov byte [esp + 9], bh
jmp 0x71bc41
mov eax, edi
neg ah
pop dword [esp + 9]
add esp, 1
mov di, 0xce89
mov cl, 0xe2
mov ebx, ebp
jmp 0x71bd93
mov ebp, dword [esp]
lea esp, [esp]
mov ecx, 0xda484d4c
neg ebp
pushal
mov bx, word [esp + 9]
and al, 0xb9
dec esp
dec ebp
dec eax
invalid
and al, 9
jmp 0x71bd2d
push word [esp + 0x2b]
xchg byte [esp + 7], al
cmc
xchg word [esp + 0x13], dx
call fcn.0071bda6
jne 0x71bd66
je 0x71bd95
out dx, al
pop es
test dword [ebx], ebx
mov ebp, esi
sbb eax, 0x127cedbc
jne 0x71bd13
jne 0x71bd5a
push 0x10ec838b
sub esp, 0x10
adc byte [edx], ch
fmul qword [ebp - 0x44f0c6c4]
fisub word [esi - 9]
fisttp word [edi]
xchg ecx, eax
invalid
sub bl, ah
lea edi, [ecx + edi]
btc esi, ebx
neg di
setno dh
jmp 0x71bd6a
pop ebx
mov ebx, dword [esp + 3]
mov dword [esp + 1], ebp
mov bl, bh
mov dword [esp + 7], esi
lea esp, [esp + 9]
jmp 0x71bd55
push word [esp + 3]
bswap esi
mov dl, 0x9c
xchg di, bp
pop si
btr eax, esp
jmp 0x71bdce

Function at 0x71bc6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
rdtsc
pushal
lea esp, [esp + 0x4d]
ror dh, 7
mov esi, dword [esp]
jmp 0x71bc95
push dword [esp]
xchg byte [esp], cl
pushal
jmp 0x71bc51
Function at 0x4011a4
Capabilities:
Get common file path

Disassembly:
jmp 0x410cc0
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
call ebp
mov ebx, eax
test ebx, ebx
jne 0x410d89
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.winhlp32.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x410d89
push 0x6a
push esi
call ebp
test eax, eax
je 0x410d73
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x401249
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x415590
push 0xffffffffffffffff
push 0x4193f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x14], ebx
push 0
mov dword [esp + 0x24], 0
mov dword [ebx], 0x41d928
mov dword [ebx + 4], 0
mov dword [ebx + 8], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x28]
mov edi, eax
mov eax, dword [esp + 0x2c]
and ecx, 0xffff
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x415669
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x415669
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, edi
mov edi, eax
mov edx, ecx
lea eax, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
push ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 4]
push eax
push ecx
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x401299
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status

Disassembly:
jmp 0x411120
sub esp, 0x11c
push esi
push 0
push 0
push 0
push 0
push 1
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [0x420f4c], eax
jne 0x41115f
push 0
push 0
push 0x4209ec
mov ecx, esi
call sub.MFC42.DLL_CWnd::MessageBoxA
xor eax, eax
pop esi
add esp, 0x11c
ret
mov eax, dword [0x420f08]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x26ad
mov dword [esp + 0x14], eax
mov word [esp + 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x420f4c]
lea ecx, [esp + 0xc]
push 0x10
push ecx
push edx
mov word [esp + 0x1a], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x411212
mov eax, dword [0x420f4c]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x20]
push 0
push edx
push 0
push 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x18], 0xa
mov dword [esp + 0x1c], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x411212
mov ecx, dword [0x420f7c]
push 0x4209dc
push 0x423
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov ecx, dword [0x420ef4]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [0x420f7c]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
xor eax, eax
pop esi
add esp, 0x11c
ret
mov eax, dword [esi + 0x20]
mov ecx, dword [0x420f4c]
push 0x21
push 0x402
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov eax, 1
pop esi
add esp, 0x11c
ret

Function at 0x4012ad
Capabilities:
Access peb ldr_data
Get hostname
Resolve dns

Disassembly:
jmp 0x412100
push 0xffffffffffffffff
push 0x4190cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
push 0x1e
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
lea ecx, [esp + 8]
mov esi, eax
call fcn.004163d8
mov edx, dword [esi + 0xc]
mov edi, 1
mov dword [esp + 0x38], edi
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_1
mov esi, dword [esp + 0x40]
lea edx, [esp + 8]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], edi
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x4012df
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x415130
push 0xffffffffffffffff
push 0x4193d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004163d8
mov eax, dword [0x420fa0]
mov dword [esp + 0x10], 0
dec eax
cmp eax, 0xb
ja case.default.0x415169
jmp dword [eax*4 + 0x415344]
push str.5:480p
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.480p
jmp 0x415255
push str.5:576p
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.576p
jmp 0x41529c
push str.5:720p
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.720p
jmp 0x4152df
push str.5:1080p
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.1080p
jmp 0x415255
push str.5:sxga
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.sxga
jmp 0x41529c
push str.5:480i
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.480i
jmp 0x4152df
push str.5:576i
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.576i
jmp 0x415255
push str.5:720i
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.720i
jmp 0x41529c
push str.5:1080i
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.1080i
jmp 0x4152df
push str.5:xga
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.sxga
mov ecx, 0x420f58
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [0x420f58]
push ecx
push 0x402
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov eax, dword [esp + 4]
mov edx, dword [0x420fb4]
push 0
mov ecx, dword [eax - 8]
push ecx
push eax
push edx
jmp 0x41530d
push str.5:svga
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.svga
mov ecx, 0x420f58
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [0x420f58]
mov ecx, esi
push eax
push 0x402
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov eax, dword [esp + 4]
push 0
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [0x420fb4]
push eax
push ecx
jmp 0x41530d
push str.5:wuxga
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
push str.wuxga
mov ecx, 0x420f58
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [0x420f58]
mov ecx, esi
push edx
push 0x402
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov eax, dword [esp + 4]
push 0
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [0x420fb4]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [0x420fb4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401334
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status

Disassembly:
jmp 0x411fd0
sub esp, 0x11c
push 0
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [0x420f48], eax
jne 0x411ffb
xor eax, eax
add esp, 0x11c
ret
mov eax, dword [0x420f08]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0xc350
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x420f48]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4120ad
mov eax, dword [0x420f48]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x20]
push 0
push edx
push 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x4120ad
mov ecx, dword [0x420f7c]
push 0x420a30
push 0x423
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov ecx, dword [0x420ef4]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [0x420f7c]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
xor eax, eax
add esp, 0x11c
ret
mov eax, 1
add esp, 0x11c
ret

Function at 0x401370
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
jmp 0x4043e0
sub esp, 0x120
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x420db8], eax
jne 0x404407
xor eax, eax
pop esi
add esp, 0x120
ret
mov eax, dword [0x420f08]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x232a
mov dword [esp + 0x18], eax
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x420db8]
mov esi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea ecx, [esp + 4]
mov word [esp + 0x12], ax
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x10], 1
call esi
mov eax, dword [0x420db8]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 5
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_connect]
lea edx, [esp + 8]
lea eax, [esp + 0x20]
push edx
push 0
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x4044d1
mov ecx, dword [0x420f7c]
push 0x4206fc
push 0x423
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov ecx, dword [0x420ef4]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [0x420f7c]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
xor eax, eax
pop esi
add esp, 0x120
ret
mov edx, dword [0x420db8]
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x10], 0
call esi
mov eax, 1
pop esi
add esp, 0x120
ret
Function at 0x401424
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
jmp 0x406ea0
push 0xffffffffffffffff
push 0x418298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.004163d8
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [esp + 0x10]
push edx
push 0
push 0x41a
push eax
call ebx
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x402
push ecx
call ebx
mov edx, dword [esi + 0x20]
push 0
push 0
push 0x401
push edx
mov edi, eax
call ebx
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov ecx, eax
mov eax, dword [0x420dd0]
sub eax, edx
sub edi, ecx
sub eax, ebx
mov ecx, dword [esp + 0x18]
imul eax, edi
sub ecx, edx
cdq
idiv ecx
test eax, eax
mov dword [0x420dc8], eax
jge 0x406f58
push 0
lea edx, [esp + 0x10]
push str._d__
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [0x420dc8]
add esp, 0xc
cmp eax, 0x64
jle 0x406f76
push 0x64
lea eax, [esp + 0x10]
push str._d__
push eax
call sub.MFC42.DLL_CString::Format
mov eax, dword [0x420dc8]
add esp, 0xc
test eax, eax
jl 0x406f92
cmp eax, 0x64
jg 0x406f92
push eax
lea ecx, [esp + 0x10]
push str._d__
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov edx, dword [esp + 0xc]
lea edi, [esi + 0xb8]
push 0
push esi
push edx
mov ecx, edi
call sub.MFC42.DLL_CToolTipCtrl::UpdateTipText
mov eax, dword [esp + 0xc]
add esi, 0x40
push 0
push esi
push eax
mov ecx, edi
call sub.MFC42.DLL_CToolTipCtrl::UpdateTipText
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x401438
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
jmp 0x415420
sub esp, 0x120
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x420fb4], eax
jne 0x415447
xor eax, eax
pop esi
add esp, 0x120
ret
mov eax, dword [0x420f08]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x232a
mov dword [esp + 0x18], eax
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x420fb4]
mov esi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea ecx, [esp + 4]
mov word [esp + 0x12], ax
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x10], 1
call esi
mov eax, dword [0x420fb4]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 5
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_connect]
lea edx, [esp + 8]
lea eax, [esp + 0x20]
push edx
push 0
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x415511
mov ecx, dword [0x420f7c]
push 0x420be8
push 0x423
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov ecx, dword [0x420ef4]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [0x420f7c]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
xor eax, eax
pop esi
add esp, 0x120
ret
mov edx, dword [0x420fb4]
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x10], 0
call esi
mov eax, 1
pop esi
add esp, 0x120
ret

Function at 0x401654
Capabilities:
Capture webcam image

Disassembly:
jmp 0x4071c0
sub esp, 0x20
lea eax, [esp]
push ebx
push esi
mov esi, ecx
push edi
push eax
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x1c]
push edx
push 0
push 0x419
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetStyle
mov ecx, dword [esp + 0x30]
and eax, 2
cmp al, 2
mov eax, dword [esi + 0xb4]
jne 0x407248
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov dword [ecx], eax
mov ebx, dword [esp + 0x28]
sub eax, edi
mov edi, dword [esp + 0x10]
add eax, esi
mov esi, dword [esp + 0x18]
mov dword [ecx + 8], eax
mov eax, esi
sub eax, edi
sub eax, ebx
mov ebx, dword [esp + 0x20]
add eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
mov dword [ecx + 4], eax
sub eax, edi
add eax, esi
pop edi
pop esi
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0x20
ret 4
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], eax
sub eax, edi
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x1c]
add eax, esi
mov esi, dword [esp + 0x14]
mov dword [ecx + 0xc], eax
mov eax, esi
sub eax, edx
sub eax, edi
add eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
mov dword [ecx], eax
sub eax, edi
add eax, esi
pop edi
pop esi
mov dword [ecx + 8], eax
pop ebx
add esp, 0x20
ret 4
Function at 0x4016e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status

Disassembly:
jmp 0x412470
sub esp, 0x11c
push 0
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [0x420f38], eax
jne 0x41249b
xor eax, eax
add esp, 0x11c
ret
mov eax, dword [0x420f08]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x2710
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x420f38]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x41254d
mov eax, dword [0x420f38]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x20]
push 0
push edx
push 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x41254d
mov ecx, dword [0x420f7c]
push 0x420a48
push 0x423
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov ecx, dword [0x420ef4]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, dword [0x420f7c]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
xor eax, eax
add esp, 0x11c
ret
mov eax, 1
add esp, 0x11c
ret
Function at 0x401762
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x4084c0
push 0xffffffffffffffff
push 0x418548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x2c]
xor ebx, ebx
push eax
lea ecx, [esi + 0x7c]
mov dword [esp + 0x20], ebx
mov dword [esi + 0x44], 1
call sub.MFC42.DLL_CString::operator
push 0xc
call sub.MFC42.DLL_operatornew
add esp, 4
cmp eax, ebx
je 0x408514
mov dword [eax + 4], ebx
mov dword [eax], 0x41c23c
mov dword [eax + 8], ebx
mov ebp, eax
jmp 0x408516
xor ebp, ebp
mov dword [esi + 0x68], ebp
mov ecx, dword [ebp + 4]
cmp ecx, ebx
je 0x408526
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [ebp + 8]
mov dword [ebp + 4], ebx
cmp eax, ebx
je 0x408544
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp + 8], ebx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
and edx, 0xffff
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x40865f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x40865f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x40865f
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x40865f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x408652
mov ecx, esi
mov esi, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x24], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x24]
push ecx
push ebx
push edx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x408648
mov edi, dword [esp + 0x24]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
cmp esi, ebx
je 0x408611
lea eax, [esp + 0x10]
mov dword [esi], 0x41c230
push eax
push edi
mov dword [esp + 0x18], ebx
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
jmp 0x408613
xor esi, esi
mov eax, dword [esp + 0x24]
mov dword [ebp + 4], esi
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp + 4]
cmp eax, ebx
je 0x408648
mov ecx, dword [eax + 8]
mov dword [eax + 8], ebx
cmp ecx, ebx
jne 0x408638
mov byte [esp + 0x28], 1
jmp 0x408663
mov ecx, dword [ebp + 4]
cmp ecx, ebx
je 0x408645
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp + 4], ebx
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp + 8], ebx
mov byte [esp + 0x28], bl
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
and esi, 0xff
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc