joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0x1000
call fcn.005d9990
mov eax, dword [esp + 0x1004]
push esi
push edi
push 0x40
push 0x5f5744
push eax
or esi, 0xffffffff
call fcn.005da940
mov edi, eax
add esp, 0xc
test edi, edi
je 0x463f0e
push edi
push 0x1000
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.005db6f3
add esp, 0x10
test eax, eax
jbe 0x463eff
xor ecx, ecx
test eax, eax
jbe 0x463edf
jmp 0x463ec0
xor edx, edx
mov dl, byte [esp + ecx + 8]
xor edx, esi
and edx, 0xff
mov edx, dword [edx*4 + 0x619978]
shr esi, 8
xor esi, edx
inc ecx
cmp ecx, eax
jb 0x463ec0
cmp eax, 0x1000
jb 0x463eff
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.005db6f3
add esp, 0x10
test eax, eax
ja 0x463eb5
test byte [edi + 0xc], 0x20
push edi
je 0x463f19
call fcn.005da869
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x1000
ret
call fcn.005da869
add esp, 4
mov eax, esi
pop edi
not eax
pop esi
add esp, 0x1000
ret

Function at 0x463f30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jg 0x463f3d
xor eax, eax
pop esi
ret
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jle 0x463f6f
push edi
mov edi, dword [esp + 0xc]
jmp 0x463f50
xor edx, edx
mov dl, byte [ecx + edi]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x619978]
shr eax, 8
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x463f50
pop edi
not eax
pop esi
ret
Function at 0x463f80
Capabilities:
Hash data with crc32

Disassembly:
mov eax, 0x188c
call fcn.005d9990
push esi
push edi
mov ecx, 6
mov esi, str.32a41d510205970402810880
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [esp + 0x14], 0x2d
jne 0x463fb3
pop edi
mov eax, 3
pop esi
add esp, 0x188c
ret
mov ecx, dword [0x6a0f3c]
push 0x400
lea eax, [esp + 0x464]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x46405c
push 0x40
lea edx, [esp + 0x464]
push 0x5f5744
push edx
call fcn.005da940
mov edi, eax
add esp, 0xc
test edi, edi
mov dword [esp + 0xc], edi
je 0x46405c
lea eax, [esp + 0x2c]
push 0x432
push eax
call fcn.004232e0
push 8
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.005da020
lea eax, [esp + 0x40]
push eax
call fcn.005d99cd
add esp, 0x18
test eax, eax
mov dword [esp + 8], eax
jbe 0x46405c
lea ecx, [esp + 0x2c]
push 0x432
push ecx
call fcn.004232e0
push 8
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.005da020
lea ecx, [esp + 0x40]
push ecx
call fcn.005d99cd
add esp, 0x18
test eax, eax
jg 0x464067
pop edi
xor eax, eax
pop esi
add esp, 0x188c
ret
push ebx
push ebp
push edi
push 0x1000
lea edx, [esp + 0x8a4]
push 1
push edx
or ebp, 0xffffffff
xor esi, esi
call fcn.005db6f3
add esp, 0x10
test eax, eax
jbe 0x464118
mov edi, edi
xor ebx, ebx
test eax, eax
jbe 0x4640dd
cmp esi, dword [esp + 0x10]
jb 0x4640ba
lea ecx, [esp + 0x18]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4640a3
mov edx, dword [esp + 0x10]
sub ecx, edi
mov edi, dword [esp + 0x14]
add ecx, edx
cmp esi, ecx
jb 0x4640d7
xor ecx, ecx
mov cl, byte [esp + ebx + 0x89c]
xor ecx, ebp
and ecx, 0xff
mov edx, dword [ecx*4 + 0x619978]
shr ebp, 8
xor ebp, edx
inc esi
inc ebx
cmp ebx, eax
jb 0x464096
cmp eax, 0x1000
jb 0x464118
push 1
push 0xffffffffffffffce
push edi
call fcn.005db7ce
add esp, 0xc
test eax, eax
push edi
jne 0x46415f
push 0x1000
lea eax, [esp + 0x8a4]
push 1
push eax
sub esi, 0x32
call fcn.005db6f3
add esp, 0x10
test eax, eax
ja 0x464090
test byte [edi + 0xc], 0x20
push edi
jne 0x46415f
call fcn.005da869
not ebp
push ebp
lea ecx, [esp + 0x3c]
push str._08lX
push ecx
call fcn.005d9929
push 8
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005f18c9
add esp, 0x1c
xor ecx, ecx
nop
nop
setne cl
pop ebp
pop ebx
pop edi
pop esi
inc ecx
mov eax, ecx
add esp, 0x188c
ret
call fcn.005da869
add esp, 4
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x188c
ret
Function at 0x481da0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x364
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x481dde
mov eax, dword [esp + 0x368]
push 0
lea ecx, [esp + 0x104]
push ecx
lea edx, [esp + 8]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
je 0x481de7
cmp eax, 2
je 0x481de7
xor eax, eax
add esp, 0x364
ret
movzx eax, word [esp + 0x100]
add esp, 0x364
ret
Function at 0x489cd0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x14c
push esi
mov esi, dword [esp + 0x154]
test esi, esi
je 0x489e7a
cmp dword [esp + 0x158], 1
jne 0x489d53
lea eax, [esp + 0x1c]
push 0x132
push eax
call fcn.004232e0
lea ecx, [esp + 0x24]
push 0x132
push ecx
call fcn.00423310
add esp, 0x10
push eax
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [0x676e94]
test eax, eax
je 0x489d48
lea eax, [esp + 0x1c]
push str.RichEdit20A
push eax
call fcn.005f1860
add esp, 8
test eax, eax
mov dword [esp + 0x158], 2
je 0x489d53
mov dword [esp + 0x158], 0
push ebx
push ebp
push edi
push esi
xor ebx, ebx
call fcn.0058ed50
push eax
call fcn.0058ea30
add esp, 8
test eax, eax
mov dword [esp + 0x24], eax
je 0x489d75
mov ebx, dword [eax + 0x18a4]
mov ebp, dword [esp + 0x16c]
test ebp, ebp
jle 0x489e30
mov esi, dword [esp + 0x168]
jmp 0x489d90
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x164], 2
jne 0x489e60
xor eax, eax
cmp ebx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
jne 0x489ddb
mov dword [esp + 0x18], 0x4b0
jmp 0x489dec
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0049caf0
add esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x160]
push esi
lea edx, [esp + 0x14]
push edx
push 0x45e
push eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x489e60
cmp ebx, 2
jne 0x489e56
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
call fcn.00584ef0
mov edi, eax
add esp, 8
test edi, edi
jne 0x489e45
xor ebx, ebx
jmp 0x489d90
mov ecx, dword [esp + 0x168]
pop edi
pop ebp
pop ebx
mov byte [ecx], 0
pop esi
add esp, 0x14c
ret
push ebp
push edi
push esi
call fcn.005da020
push edi
call fcn.005d9fa3
add esp, 0x10
mov byte [esi + ebp - 1], 0
cmp byte [esi], 0
jne 0x489e77
mov edx, dword [esp + 0x160]
push esi
push ebp
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [esi + ebp - 1], 0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14c
ret
Function at 0x48bc10
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, edi
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x48bc20
mov eax, 0x61a054
sub esi, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48bc31
sub eax, edx
mov ebp, eax
mov eax, dword [esp + 0x1c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x48bcc6
cmp esi, ebx
jle 0x48bcc6
push edi
call fcn.0048ba90
push edi
call fcn.0048bad0
movzx ecx, byte [esi + edi - 1]
add esp, 8
dec esi
sub ecx, 0x78
cmp ecx, ebx
jle 0x48bc6c
sub esi, ecx
movzx eax, byte [esi + edi - 1]
dec esi
sub eax, 0x6e
dec esi
mov dword [esp + 0x10], eax
movzx eax, byte [esi + edi]
sub eax, 0x64
add eax, ecx
cmp eax, ebp
mov byte [esi + edi], 0
jle 0x48bc8d
sub eax, ebp
mov esi, edi
lea edx, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x48bc92
sub esi, edx
cmp eax, ebx
jl 0x48bd34
cmp eax, ebp
jg 0x48bd34
xor ecx, ecx
cmp esi, ebx
jle 0x48bcc6
mov dl, byte [eax + 0x61a054]
sub byte [ecx + edi], dl
inc eax
cmp eax, ebp
jl 0x48bcc1
xor eax, eax
inc ecx
cmp ecx, esi
jl 0x48bcb1
push edi
call fcn.0048ba90
push edi
call fcn.0048bad0
add esp, 8
xor eax, eax
xor ecx, ecx
cmp esi, ebx
jle 0x48bcf5
lea ecx, [ecx]
mov dl, byte [eax + 0x61a054]
sub byte [ecx + edi], dl
inc eax
cmp eax, ebp
jl 0x48bcf0
xor eax, eax
inc ecx
cmp ecx, esi
jl 0x48bce0
cmp dword [esp + 0x1c], ebx
je 0x48bd68
xor ecx, ecx
test esi, esi
jle 0x48bd20
movzx eax, byte [ebx + edi]
add ecx, eax
cmp ecx, 0x1e
jl 0x48bd1b
mov eax, 0x88888889
mul ecx
shr edx, 4
imul edx, edx, 0xffffffe2
add ecx, edx
inc ebx
cmp ebx, esi
jl 0x48bd01
cmp ecx, dword [esp + 0x10]
je 0x48bd68
cmp dword [esp + 0x1c], 1
jne 0x48bd57
push 0
call fcn.005d9e7b
cmp dword [esp + 0x1c], 1
jne 0x48bd41
push ebx
call fcn.005d9e7b
mov eax, dword [str.None]
mov dword [edi], eax
mov cl, byte [0x5f88c8]
mov byte [edi + 4], cl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [str.None]
mov dword [edi], ecx
mov dl, byte [0x5f88c8]
mov byte [edi + 4], dl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x48e1c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x1068
call fcn.005d9990
push esi
mov esi, dword [esp + 0x1074]
test esi, esi
je 0x48e290
cmp byte [esi], 0
je 0x48e290
lea eax, [esp + 4]
push 0x1068
push eax
call fcn.004232e0
lea edx, [esp + 0xc]
add esp, 8
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x48e200
push edi
mov edi, dword [esp + 0x1074]
mov eax, dword [edi + 0x1428]
test eax, eax
je 0x48e257
mov edx, dword [edi + 0x2100]
mov eax, dword [edi]
push 1
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
call fcn.00586db0
mov eax, dword [0x693620]
add esp, 0x10
test eax, eax
je 0x48e257
mov edx, dword [edi + 0x2100]
mov eax, dword [edi]
push 0xa
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
call fcn.00586db0
add esp, 0x10
lea eax, [esp + 8]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e260
sub eax, edx
mov edx, dword [edi + 0x20fc]
push 0
mov esi, eax
push esi
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
sub eax, esi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x1068
ret
mov eax, 1
pop esi
add esp, 0x1068
ret
Function at 0x492f30
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x646228]
sub esp, 0x10
cmp eax, ecx
push 0
je 0x492f5a
push 0x9c7
call fcn.00424130
push eax
call fcn.00492e70
add esp, 0xc
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
shr ecx, 0x10
test ecx, ecx
jne 0x492f43
xor edx, edx
mov dx, word [0x61a70c]
push ecx
xor eax, eax
mov ax, word [0x61a708]
push 2
push ecx
mov dword [0x646228], ecx
push edx
push eax
call fcn.0052f8a0
add esp, 0x18
cmp eax, 0xffffffff
mov dword [0x61a084], eax
jne 0x492fad
push 0
push 0x9c8
call fcn.00424130
push eax
call fcn.00492e70
add esp, 0xc
add esp, 0x10
ret
xor ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
push 0x4f
mov dword [esp + 0x10], ecx
mov word [esp + 4], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x492fe2
mov dword [esp + 4], eax
jmp 0x492ff0
mov edx, dword [0x64623c]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov edx, dword [0x6a0f40]
mov eax, dword [0x61a084]
push 0x10
push 0x8023
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov edx, dword [0x61a084]
push 0x10
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x493044
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x493044
push 0
push 0x9c9
call fcn.00424130
push eax
call fcn.00492e70
add esp, 0xc
add esp, 0x10
ret

Function at 0x493050
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
shr eax, 0x10
sub esp, 0x434
test eax, eax
je 0x49306d
push 0
push 0x9c9
jmp 0x4931ae
mov al, byte [0x645fb8]
test al, al
push 0x6460f0
je 0x4930cb
push 0x645fb8
push 0
push 0x9ca
call fcn.00424130
add esp, 8
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.005d9929
mov edx, dword [0x63caa0]
mov ecx, dword [0x6a0f58]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0052ddc0
push 0x645fb8
lea edx, [esp + 0x20]
push 0x5f598c
push edx
call fcn.005d9929
add esp, 0x28
jmp 0x493113
push 0
push 0x9cb
call fcn.00424130
add esp, 8
push eax
lea eax, [esp + 8]
push eax
call fcn.005d9929
mov ecx, dword [0x63caa0]
mov eax, dword [0x6a0f58]
push ecx
lea edx, [esp + 0x10]
push edx
push eax
call fcn.0052ddc0
push 0x6460f0
lea ecx, [esp + 0x1c]
push str.__s_n
push ecx
call fcn.005d9929
add esp, 0x24
mov edx, dword [0x63ca9c]
mov eax, dword [0x6a0f58]
push edx
push eax
call fcn.0052dc60
push 0x132
push 0x645fb8
call fcn.004232e0
push 0x132
push 0x6460f0
call fcn.004232e0
push 0x1068
push 0x646630
call fcn.004232e0
mov ecx, dword [0x6a0f40]
mov edx, dword [0x61a084]
add esp, 0x20
push 0x21
push 0x8024
push ecx
push edx
mov dword [0x647698], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x493181
mov ecx, dword [0x61a084]
push esi
sub eax, edx
push 0
mov esi, eax
push esi
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
pop esi
je 0x4931bc
push 0
push 0x9cc
call fcn.00424130
push eax
call fcn.00492e70
add esp, 0xc
add esp, 0x434
ret
Function at 0x4931d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [0x646224]
sub esp, 0x43c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x4931f7
push 0x5f4c90
call fcn.00492e70
add esp, 4
pop ebx
add esp, 0x43c
ret
mov eax, dword [0x61a084]
push 1
push 1
push eax
push 0x8024
call fcn.00599d90
add esp, 0x10
test eax, eax
jne 0x493404
push ebp
push esi
push edi
lea esp, [esp]
mov eax, dword [0x64769c]
inc eax
cmp eax, 0x14
mov dword [0x64769c], eax
jl 0x493255
mov ecx, dword [0x61a084]
push ebx
push 1
push ecx
push 0x8024
mov dword [0x64769c], ebx
call fcn.00599d90
add esp, 0x10
test eax, eax
jne 0x493401
push ebx
lea edx, [esp + 0x1c]
push 0x432
push edx
call fcn.00423310
mov ecx, dword [0x61a084]
add esp, 8
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x493398
cmp edi, ebx
jle 0x4933bb
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x18], bl
mov dword [esp + 0x10], ebp
jle 0x493220
push 0x1068
push 0x646630
call fcn.00423310
mov edx, dword [0x647698]
add esp, 8
cmp edx, eax
jge 0x49334f
mov al, byte [esp + ebp + 0x18]
cmp al, 0xd
je 0x493386
cmp al, 0xa
jne 0x4932fa
cmp edx, ebx
jne 0x4932e0
mov byte [0x646630], 0x20
mov edx, 1
mov eax, dword [0x6a0f58]
mov byte [edx + 0x646630], bl
mov edx, dword [0x63caa4]
push edx
push 0x646630
push eax
jmp 0x493378
cmp al, 9
jne 0x493340
xor esi, esi
cmp edx, ebx
jl 0x49330d
lea esi, [edx + 8]
shr esi, 3
shl esi, 3
sub esi, edx
cmp esi, ebx
jle 0x493386
mov ecx, esi
mov ebp, ecx
shr ecx, 2
lea edi, [edx + 0x646630]
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, ebp
mov ebp, dword [esp + 0x10]
and ecx, 3
add edx, esi
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
mov dword [0x647698], edx
jmp 0x493386
mov byte [edx + 0x646630], al
inc edx
mov dword [0x647698], edx
jmp 0x493386
cmp edx, ebx
jne 0x49335f
mov byte [0x646630], 0x20
mov edx, 1
mov ecx, dword [0x63caa4]
push ecx
mov byte [edx + 0x646630], bl
mov edx, dword [0x6a0f58]
push 0x646630
push edx
mov dword [0x647698], ebx
call fcn.0052ddc0
add esp, 0xc
inc ebp
cmp ebp, edi
mov dword [esp + 0x10], ebp
jl 0x4932a0
jmp 0x493220
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x493401
push ebx
push 0x9cd
call fcn.00424130
push eax
call fcn.00492e70
add esp, 0xc
jmp 0x4933c8
push 0x5f4c90
call fcn.00492e70
add esp, 4
mov eax, dword [0x63ca9c]
mov ecx, dword [0x6a0f58]
push eax
push ecx
call fcn.0052dc60
mov edx, dword [0x63caa0]
add esp, 8
push edx
push ebx
push 0x9ce
call fcn.00424130
add esp, 8
push eax
mov eax, dword [0x6a0f58]
push eax
call fcn.0052ddc0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x43c
ret
Function at 0x493410
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x438
lea eax, [esp + 0x43c]
push edi
push eax
call fcn.00508c40
mov edi, eax
add esp, 4
test edi, edi
jne 0x493440
push eax
call fcn.00421dc0
add esp, 4
xor eax, eax
pop edi
add esp, 0x438
ret
push 0x6460f0
lea ecx, [esp + 0xc]
push 0x432
push ecx
call fcn.00425550
lea edx, [esp + 0x14]
push 0x20
push edx
call fcn.005d9b20
add esp, 0x14
test eax, eax
je 0x49346a
mov byte [eax], 0
push esi
lea eax, [esp + 0xc]
push 0x40
push eax
call fcn.005d9b20
mov esi, eax
add esp, 8
test esi, esi
je 0x4934b0
lea ecx, [esp + 0xc]
push ecx
push 0x132
push 0x645fb8
mov byte [esi], 0
call fcn.00425550
mov byte [esi], 0x40
inc esi
push esi
push 0x132
push 0x6460f0
call fcn.00425550
add esp, 0x18
jmp 0x4934c2
push 0x132
push 0x645fb8
call fcn.004232e0
add esp, 8
lea edx, [esp + 0xc]
push 0xf
push edx
call fcn.0055a760
mov al, byte [esp + 0x14]
add esp, 8
test al, al
pop esi
push 0
je 0x49342e
push 0x66c768
push 0
push 0x5f4ea4
push str.finger
call fcn.004ce600
push 0
push 1
lea ecx, [esp + 0x24]
push ecx
push eax
mov dword [esp + 0x28], eax
call fcn.004e9380
add esp, 0x24
test eax, eax
je 0x49352e
push 0x66c768
push 0x14
push 0x5f4ea4
push str.finger
push eax
mov dword [esp + 0x18], eax
call fcn.004cf490
add esp, 0x14
lea edx, [esp + 4]
push edx
call fcn.004e8c50
mov eax, dword [0x6a0f58]
add esp, 4
test eax, eax
je 0x4935d4
mov ecx, dword [0x63ca9c]
push ecx
push eax
call fcn.0052dc60
add esp, 8
push 0x6460f0
push 0
push 0x9c5
mov dword [0x646224], 1
call fcn.00424130
add esp, 8
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.005d9929
mov edx, dword [0x63caa0]
mov ecx, dword [0x6a0f58]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.0052ddc0
add esp, 0x18
push 0x6460f0
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x493640
push eax
push 0
push 0
mov dword [0x646228], 0
call fcn.00492f30
add esp, 0xc
mov eax, 1
pop edi
add esp, 0x438
ret
mov eax, dword [0x5f8adc]
mov edx, dword [str.Finger_Window]
mov ecx, dword [0x5f8ae0]
push 0x6a0f58
push edi
push 0
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edx
mov dx, word [0x5f8ae4]
lea eax, [esp + 0x18]
push 5
push eax
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], dx
call fcn.00596330
add esp, 0x18
test eax, eax
mov dword [0x6a0f58], eax
jne 0x493558
push eax
call fcn.00421dc0
push 0x5f4c90
call fcn.00492e70
add esp, 8
xor eax, eax
pop edi
add esp, 0x438
ret
push 0x400
push 0x646230
call fcn.004232e0
mov edx, dword [0x6a0f40]
add esp, 8
push 0x400
push 0x646230
push 0x6460f0
push 0x8022
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [0x646228], eax
jne 0x4935c7
push eax
push 0x9c7
call fcn.00424130
push eax
call fcn.00492e70
add esp, 0xc
xor eax, eax
pop edi
add esp, 0x438
ret
Function at 0x493c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x6476a0]
test eax, eax
push esi
mov esi, dword [0x6a0f40]
je 0x493c8e
pop esi
mov dword [esp + 4], 0
jmp fcn.00421dc0
mov eax, dword [0x646224]
test eax, eax
mov dword [0x6476a0], 1
je 0x493ce8
mov eax, dword [0x6a0f58]
test eax, eax
je 0x493ccf
mov eax, dword [0x63ca98]
push eax
push 0
push 0x2f3
call fcn.00424130
mov ecx, dword [0x6a0f58]
add esp, 8
push eax
push ecx
call fcn.0052ddc0
add esp, 0xc
push 0x5f4c90
call fcn.00492e70
add esp, 4
mov dword [0x6476a0], 0
pop esi
ret
mov eax, dword [esp + 8]
cmp eax, 5
mov dword [0x676e74], eax
je 0x493d00
cmp eax, 6
je 0x493d00
cmp eax, 8
jne 0x493d35
mov eax, dword [0x6a0f58]
test eax, eax
je 0x493d35
call fcn.0058ec80
mov ecx, dword [0x6a0f58]
cmp ecx, eax
jne 0x493d35
push ecx
call fcn.0058ee70
add esp, 4
test eax, eax
jne 0x493d2b
mov esi, dword [0x6a0f58]
mov dword [0x676e74], 5
push 0
push 0x493880
push 0x1b8
push esi
call fcn.004762c0
mov eax, dword [0x6a0f58]
add esp, 0x10
test eax, eax
je 0x493d5a
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [0x676e74], 0
mov dword [0x6476a0], 0
pop esi
ret

Function at 0x493e20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x61a08c], 0xffffffff
mov dword [0x61a088], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x61a088], eax
je 0x493e6b
push 0x4f
push eax
call fcn.0052f7d0
add esp, 8
test eax, eax
je 0x493e6b
mov eax, dword [0x61a088]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x493e76
push 0
call fcn.00493d70
add esp, 4
ret
mov ecx, dword [0x6a0f40]
mov edx, dword [0x61a088]
push 8
push 0x802e
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x494520
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
push esi
push edi
jne 0x4947a2
cmp ax, 0x20
je 0x4947a2
mov eax, dword [0x61a08c]
cmp eax, 0xffffffff
je 0x4947a2
cmp dword [0x61a088], 0xffffffff
je 0x4947a2
push 1
push 2
push eax
push 0x8030
call fcn.00599d90
add esp, 0x10
test eax, eax
jne 0x4947b3
mov ebp, dword [sym.imp.WSOCK32.dll_send]
xor ebx, ebx
lea esp, [esp]
mov eax, dword [0x648c88]
inc eax
cmp eax, 0x14
mov dword [0x648c88], eax
jl 0x4945b5
mov edx, dword [0x61a08c]
push ebx
push 2
push edx
push 0x8030
mov dword [0x648c88], ebx
call fcn.00599d90
add esp, 0x10
test eax, eax
jne 0x4947b3
cmp byte [0x647c20], bl
jne 0x494718
mov eax, dword [0x647ae4]
push eax
push 0x1068
push 0x647c20
call fcn.00423310
add esp, 8
push eax
push 0x647c20
call fcn.005da8ba
add esp, 0xc
test eax, eax
je 0x4947a2
push 0x647c20
call fcn.004ce5b0
add esp, 4
test eax, eax
jne 0x4947a2
push 0x647c20
call fcn.00493f40
add esp, 4
test eax, eax
je 0x49477e
push 0xa
push 0x647c20
call fcn.005d9b20
add esp, 8
test eax, eax
jne 0x494644
mov edi, 0x647c20
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x494632
mov cx, word [0x5f55fc]
mov word [edi], cx
push 0x5f55fc
push 0x647c20
call fcn.005f1860
add esp, 8
test eax, eax
jne 0x494718
mov edx, dword [0x647ae4]
push edx
call fcn.005dce9c
add esp, 4
mov edi, eax
mov eax, dword [0x647ae4]
push eax
push 0x1068
push 0x647c20
mov esi, 1
call fcn.00423310
add esp, 8
push eax
push 0x647c20
call fcn.005da8ba
add esp, 0xc
test eax, eax
je 0x4946f6
mov edi, edi
push 0x647c20
call fcn.004ce5b0
add esp, 4
test eax, eax
jne 0x4946f6
push 0x5f55fc
push 0x647c20
call fcn.005f1860
add esp, 8
test eax, eax
jne 0x4946f4
mov ecx, dword [0x647ae4]
push ecx
push 0x1068
push 0x647c20
call fcn.00423310
add esp, 8
push eax
push 0x647c20
call fcn.005da8ba
add esp, 0xc
test eax, eax
jne 0x4946a0
jmp 0x4946f6
xor esi, esi
mov edx, dword [0x647ae4]
push ebx
push edi
push edx
call fcn.005db7ce
add esp, 0xc
cmp esi, ebx
jne 0x49477e
mov byte [0x647c20], 0xa
mov byte [0x647c21], bl
mov eax, 0x647c20
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x494720
sub eax, edx
mov esi, eax
mov eax, 0x647c20
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x494733
push ebx
sub eax, edx
push eax
mov eax, dword [0x61a08c]
push 0x647c20
push eax
call ebp
cmp eax, 0xffffffff
je 0x494795
cmp eax, esi
jge 0x49477e
lea edx, [eax + 0x647c20]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x494760
sub eax, esi
inc eax
push eax
push edx
push 0x647c20
call fcn.005daa60
add esp, 0xc
jmp 0x494580
push 0x1068
push 0x647c20
call fcn.004232e0
add esp, 8
jmp 0x494580
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4947b3
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 2
jmp fcn.00493d70
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x497f40
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1068
call fcn.005d9990
mov eax, dword [0x649050]
test eax, eax
je 0x497fcf
push esi
mov esi, dword [esp + 0x1070]
jmp 0x497f60
cmp dword [eax], esi
je 0x497f76
mov eax, dword [eax + 0x578]
test eax, eax
jne 0x497f60
pop esi
add esp, 0x1068
ret
push eax
call fcn.00497ec0
call fcn.00424800
push 4
call fcn.00573450
mov eax, dword [0x6a0f40]
add esp, 8
cmp esi, eax
je 0x497fce
lea eax, [esp + 4]
push 0x1068
push eax
call fcn.004232e0
lea ecx, [esp + 0xc]
push 0x1068
push ecx
call fcn.00423310
add esp, 0x10
push eax
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
add esp, 0x1068
ret