joyce8/EMBER2024-capa huggingface dataset:
Function at 0x569490
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x696a88]
sub esp, 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x419
push ecx
call esi
cmp eax, 0xffffffff
je 0x5694eb
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [0x696a88]
push 0x41d
push eax
call esi
test eax, eax
je 0x5694eb
mov edx, dword [0x696a88]
push 1
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x696a88]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
add esp, 0x10
ret
Function at 0x56ddb0
Capabilities:
Hide graphical window

Disassembly:
call fcn.0056dd30
test eax, eax
je 0x56de1a
mov eax, dword [0x6a0f3c]
mov ecx, dword [0x6a0f40]
push 0
push eax
push 0x80b4
push ecx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x5f4c90
push str.mIRC_ToolBar
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x696a88], eax
je 0x56de1a
push 0
call fcn.0056a920
add esp, 4
test eax, eax
jne 0x56de1d
mov edx, dword [0x696a88]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x696a88], 0
xor eax, eax
ret
mov eax, dword [0x67b0c8]
push eax
push str.toolbar
push str.toolbar.ini
call fcn.00569950
mov eax, dword [0x61ab50]
add esp, 0xc
test eax, eax
je 0x56de53
mov ecx, dword [0x696a88]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x696a88]
ret
mov edx, dword [0x696a88]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x696a88]
ret

Function at 0x56dee0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
test ah, ah
js 0x56df4b
push 2
call esi
test ah, ah
js 0x56df4b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x697380]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x56df35
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp dword [0x697380], eax
je 0x56df41
call fcn.0056dea0
xor eax, eax
pop esi
add esp, 8
ret
mov eax, 1
pop esi
add esp, 8
ret
mov eax, dword [0x69737c]
xor esi, esi
cmp eax, esi
je 0x56df72
push 0x7c
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x69737c]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x69737c], esi
mov dword [0x697380], esi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x56ec80
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.005458a0
add esp, 4
test eax, eax
je 0x56ed6d
mov eax, dword [esi + 0xce8]
test eax, eax
push ebx
push edi
push 0
je 0x56ed2a
push 0x15be
call fcn.00424130
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
add esp, 8
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call edi
mov eax, dword [esi + 0xc0c]
test eax, eax
push 0
je 0x56ecf9
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 0
push 0x77
push edx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
push 0x15bf
call fcn.00424130
add esp, 8
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x77
push eax
call edi
mov ecx, dword [esi]
push 5
push 0x77
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop esi
ret
push 0x15bd
call fcn.00424130
mov edx, dword [esi]
add esp, 8
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret

Function at 0x56ed70
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0049ee50
add esp, 4
test eax, eax
je 0x56ee4a
mov eax, dword [esi + 0x10ec]
test eax, eax
push ebx
push edi
push 0
je 0x56ee07
push 0x15be
call fcn.00424130
add esp, 8
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 5
push 0x77
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x103c]
test eax, eax
je 0x56edf3
mov eax, dword [esi]
push 1
push 0x77
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
push 0x15bd
call fcn.00424130
mov edx, dword [esi]
add esp, 8
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
Function at 0x573860
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
mov eax, dword [0x6a0f40]
push esi
push edi
push 0x80
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [0x698858], 0
call edi
xor esi, esi
mov si, ax
push 0x11
and esi, 0x8000
sub esi, 0x8000
neg esi
sbb esi, esi
inc esi
call edi
test ah, ah
jns 0x5738db
mov eax, dword [0x673f64]
test eax, eax
je 0x5738bd
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [0x6a0f40]
push 1
push 0
push 0x8043
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x5739c0
mov eax, dword [0x61ade8]
test eax, eax
jne 0x5738fa
mov eax, dword [0x61ade4]
test eax, eax
je 0x5738f6
test esi, esi
je 0x5738fa
pop edi
xor eax, eax
pop esi
ret
test esi, esi
je 0x5738f1
push 1
call fcn.00573450
add esp, 4
test eax, eax
je 0x5738f1
mov eax, dword [0x61ade4]
test eax, eax
push 6
je 0x57393b
test esi, esi
je 0x573920
mov edx, dword [0x6a0f40]
push edx
jmp 0x573961
mov eax, dword [0x6a0f40]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov ecx, dword [0x6a0f40]
push 0
push ecx
call esi
jmp 0x573967
test esi, esi
je 0x57395a
mov edx, dword [0x6a0f40]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edx
call esi
mov eax, dword [0x6a0f40]
push 0
push eax
call esi
jmp 0x573967
mov ecx, dword [0x6a0f40]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x673f5c]
test eax, eax
je 0x5739c0
mov esi, dword [0x6a0f38]
test esi, esi
je 0x5739c0
mov edi, dword [sym.imp.USER32.dll_IsIconic]
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, dword [esi]
push edx
call fcn.0058ee70
add esp, 4
test eax, eax
jne 0x5739b5
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x5739b5
mov ecx, dword [esi]
push ecx
call ebx
test eax, eax
je 0x5739b5
mov edx, dword [esi]
push 1
push edx
call fcn.004a8840
add esp, 8
mov esi, dword [esi + 0x21c0]
test esi, esi
jne 0x573987
pop ebx
pop edi
mov eax, 1
pop esi
ret
Function at 0x5739d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x61ade8]
test eax, eax
je 0x5739f0
mov eax, dword [0x698408]
test eax, eax
je 0x5739e6
push 5
jmp 0x5739e8
push 1
call fcn.00573450
add esp, 4
mov eax, dword [0x61ade4]
test eax, eax
push esi
je 0x573a85
mov eax, dword [0x6a0f40]
mov esi, dword [sym.imp.USER32.dll_IsIconic]
push eax
call esi
test eax, eax
jne 0x573a4d
mov ecx, dword [0x6a0f40]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x573a4d
mov eax, dword [0x698408]
test eax, eax
je 0x573add
mov eax, dword [0x61ade8]
test eax, eax
jne 0x573a41
push 2
call fcn.00573450
add esp, 4
push 0
call fcn.00573770
add esp, 4
pop esi
ret
push 1
call fcn.00573450
mov edx, dword [0x6a0f40]
add esp, 4
test eax, eax
je 0x573ad4
push edx
call esi
test eax, eax
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x573a78
mov eax, dword [0x6a0f40]
push 7
push eax
call esi
mov ecx, dword [0x6a0f40]
push 0
push ecx
call esi
pop esi
ret
mov eax, dword [0x698408]
test eax, eax
je 0x573add
mov eax, dword [0x6a0f40]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x573ac4
mov ecx, dword [0x6a0f40]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x573ac4
mov eax, dword [0x61ade8]
test eax, eax
jne 0x573add
push 2
call fcn.00573450
add esp, 4
pop esi
ret
push 2
call fcn.00573450
mov edx, dword [0x6a0f40]
add esp, 4
push 7
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x573b90
Capabilities:
Find taskbar

Disassembly:
mov eax, dword [0x61dfa0]
sub esp, 0x30
push edi
xor edi, edi
cmp eax, edi
jne 0x573dc1
mov eax, dword [0x673f64]
cmp eax, edi
je 0x573bb8
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
add esp, 0x30
ret
cmp dword [0x698860], edi
jne 0x573dc1
movzx eax, byte [esp + 0x38]
cmp eax, 2
mov dword [0x698860], 1
jl 0x573dbb
cmp eax, 3
jle 0x573bfa
cmp eax, 5
jne 0x573dbb
call fcn.00572bd0
mov dword [0x698860], edi
pop edi
add esp, 0x30
ret
cmp eax, 2
jne 0x573c0d
cmp dword [0x698410], edi
je 0x573dbb
jmp 0x573c1e
cmp eax, 3
jne 0x573c1e
cmp dword [0x698410], edi
jne 0x573dbb
cmp dword [0x698858], edi
jne 0x573dbb
mov ecx, dword [0x6a0f40]
push ebx
push ebp
push esi
lea eax, [esp + 0x20]
push eax
push edi
push edi
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call fcn.00508880
add esp, 0x10
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, edi
je 0x573d8d
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, edi
je 0x573d66
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebp, dword [sym.imp.USER32.dll_WindowFromPoint]
jmp 0x573ca0
cmp esi, dword [0x6a0f40]
je 0x573d6e
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x573d4f
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x573d4f
push esi
call fcn.00573ea0
add esp, 4
test eax, eax
jne 0x573d4f
lea edx, [esp + 0x30]
push edx
push esi
call ebx
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
sub eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x3c]
sar ecx, 1
add ecx, edi
mov edi, dword [esp + 0x34]
sub eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
push eax
push ecx
call ebp
cmp eax, esi
je 0x573d17
push eax
push esi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x573d4d
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call fcn.00508880
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x573d64
xor edi, edi
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, edi
jne 0x573ca0
jmp 0x573d66
xor edi, edi
cmp esi, dword [0x6a0f40]
jne 0x573d8d
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x573d8d
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x573d8d
call fcn.00573860
test eax, eax
jne 0x573db8
cmp dword [0x673f5c], edi
je 0x573dae
mov ecx, dword [0x6a0f40]
push 2
push edi
push 0x8043
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x573db8
push 1
call fcn.00573770
add esp, 4
pop esi
pop ebp
pop ebx
mov dword [0x698860], edi
pop edi
add esp, 0x30
ret
Function at 0x5752f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
jns 0x575311
mov eax, dword [0x6a0f3c]
push 0x47
push eax
call esi
test eax, eax
jne 0x57531a
push 0x7f00
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop esi
ret
Function at 0x57fc10
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax]
push ecx
call fcn.005db1b0
add esp, 4
cmp al, 0x41
mov byte [esp + 3], al
jb 0x57fd83
cmp al, 0x5a
ja 0x57fd83
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x57fd83
push ebx
push ebp
mov ebx, 0x640
push ebx
mov dword [esp + 0x1c], eax
call fcn.005d9f91
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x57fd6f
push esi
push edi
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], ebx
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x57fcb5
mov eax, dword [esp + 0x18]
push eax
push ebp
mov ebx, eax
call fcn.005dbd64
add esp, 8
test eax, eax
je 0x57fd60
mov ebp, eax
jmp 0x57fc71
test eax, eax
jne 0x57fd60
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x57fc71
lea edi, [ebp + 0x10]
lea ebx, [ebx]
mov eax, dword [edi]
test eax, eax
je 0x57fceb
movzx eax, byte [eax]
push eax
call fcn.005db1b0
movzx ecx, byte [esp + 0x17]
add esp, 4
cmp ecx, eax
je 0x57fcfc
mov eax, dword [esp + 0x14]
inc esi
add edi, 0x20
cmp esi, eax
jl 0x57fcd0
jmp 0x57fc71
mov edi, dword [esp + 0x28]
shl esi, 5
mov esi, dword [esi + ebp + 0x14]
mov ecx, edi
lea esp, [esp]
mov al, byte [esi]
inc esi
mov byte [ecx], al
inc ecx
test al, al
jne 0x57fd10
mov eax, dword [esp + 0x2c]
cmp byte [eax + 1], 0x3a
jne 0x57fd58
mov cl, byte [eax + 2]
add eax, 2
cmp cl, 0x5c
jne 0x57fd58
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x57fd31
sub eax, edx
dec edi
jmp 0x57fd40
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x57fd40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], 1
test ebp, ebp
pop edi
pop esi
je 0x57fd6f
push ebp
call fcn.005d9fa3
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call sub.MPR.dll_WNetCloseEnum
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret
Function at 0x580020
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1068
call fcn.005d9990
mov eax, dword [0x69a884]
test eax, eax
push ebx
push esi
push edi
push 0
je 0x5800ef
push 0x1613
call fcn.00424130
mov esi, dword [esp + 0x1080]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
add esp, 8
push eax
push 0
push 0xc
push 0x64
push esi
call edi
lea eax, [esp + 0xc]
push 0x1068
push eax
call fcn.004232e0
push 0x69a888
lea ecx, [esp + 0x18]
push str.mIRC__s
push ecx
call fcn.005d9929
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0
push 0xc
push 0x66
push esi
call edi
push 0
push 0x1618
call fcn.00424130
add esp, 8
push eax
push 0
push 0xc
push 1
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 1
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 5
push 0x64
push esi
call edi
push eax
call ebx
push 0
push 0x65
push esi
call edi
push eax
call ebx
push 5
push 0x66
push esi
call edi
push eax
call ebx
push 0
push 0x67
push esi
call edi
push eax
call ebx
push 5
jmp 0x58016c
push 0x1614
call fcn.00424130
mov esi, dword [esp + 0x1080]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
add esp, 8
push eax
push 0
push 0xc
push 0x64
push esi
call edi
push 0
push 0x1616
call fcn.00424130
add esp, 8
push eax
push 0
push 0xc
push 1
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 1
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 5
push 0x64
push esi
call edi
push eax
call ebx
push 0
push 0x65
push esi
call edi
push eax
call ebx
push 0
push 0x66
push esi
call edi
push eax
call ebx
push 0
push 0x67
push esi
call edi
push eax
call ebx
push 0
push 0x69
push esi
call edi
push eax
call ebx
push 1
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
add esp, 0x1068
ret
Function at 0x581870
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1068
call fcn.005d9990
push esi
call fcn.005d9ec8
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [esp + 0x1070]
or esi, 0xffffffff
test eax, eax
jne 0x58189d
mov esi, 3
jmp 0x581918
cmp eax, 1
jne 0x5818c2
xor eax, eax
cmp edx, 0x1f4
setg al
add eax, 4
mov esi, eax
mov eax, dword [0x670138]
test eax, eax
je 0x581918
call fcn.004e71c0
jmp 0x581918
cmp eax, 2
jne 0x5818d9
xor ecx, ecx
cmp edx, 0x1f4
setg cl
add ecx, 6
mov esi, ecx
jmp 0x581918
cmp eax, 3
jne 0x5818ee
xor eax, eax
cmp edx, 0x1f4
setg al
add eax, 8
jmp 0x581916
cmp eax, 4
jne 0x581903
xor ecx, ecx
cmp edx, 0x1f4
setg cl
inc ecx
mov esi, ecx
jmp 0x581918
cmp eax, 5
jne 0x581918
xor eax, eax
cmp edx, 0x1f4
setg al
add eax, 0x12
mov esi, eax
lea ecx, [esp + 4]
push 0x1068
push ecx
call fcn.004232e0
lea edx, [esp + 0xc]
push esi
push edx
call fcn.00426590
add esp, 0x10
cmp eax, 1
pop esi
push 0
je 0x581942
call fcn.005d9e7b
lea eax, [esp + 4]
push 2
push eax
call fcn.005813a0
add esp, 0xc
add esp, 0x1068
ret
Function at 0x597d30
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x597d52
push esi
mov esi, dword [0x6a0f38]
test esi, esi
je 0x597d51
cmp dword [esi], eax
je 0x597d53
mov esi, dword [esi + 0x21c0]
test esi, esi
jne 0x597d43
pop esi
ret
mov eax, dword [esi + 0x131c]
test eax, eax
jne 0x597d51
mov eax, dword [esi]
push eax
call fcn.00597230
add esp, 4
test eax, eax
je 0x597d51
push esi
mov dword [esi + 0x131c], 1
call fcn.00590d80
add esp, 4
pop esi
mov dword [esp + 4], 0
jmp fcn.0055f1c0

Function at 0x598680
Capabilities:
Get hostname

Disassembly:
sub esp, 0x434
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
lea ebp, [esi + 0x14bc]
push ebp
lea eax, [esp + 0x10]
push 0x432
push eax
mov dword [esi + 0x424], 1
call fcn.00425550
mov eax, dword [0x61a52c]
add esp, 0xc
test eax, eax
jne 0x5986dc
cmp byte [ebp], 0
je 0x5986dc
push 0
push 0x1772
call fcn.00424130
push eax
push ebp
call fcn.005f1860
add esp, 0x10
test eax, eax
jne 0x59871a
push 0x132
push ebp
call fcn.004232e0
add esp, 8
push 0x100
push ebp
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
je 0x59871a
push 0
push 0x1772
call fcn.00424130
add esp, 8
mov edx, ebp
jmp 0x598710
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x598710
mov eax, dword [0x61a530]
test eax, eax
jne 0x598764
mov eax, dword [esi + 0x1720]
test eax, eax
je 0x598764
lea edi, [esp + 0xc]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x598757
test cl, cl
je 0x598753
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x598757
add eax, 2
add edi, 2
test cl, cl
jne 0x598733
xor eax, eax
jmp 0x59875c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5987e6
push 0
push 0x1772
call fcn.00424130
push eax
push ebp
call fcn.005f1860
add esp, 0x10
test eax, eax
jne 0x5987f2
push eax
push 0x1772
call fcn.00424130
add esp, 8
lea edx, [esi + 0x15ee]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x598792
mov eax, dword [esi + 0x420]
test eax, eax
mov dword [esi + 0x1720], 0
je 0x5987e6
lea edi, [esi + 0x440]
push edi
push 0x1777
mov dword [esi + 0x14ac], 1
call fcn.00424130
push esi
call fcn.00598080
add esp, 0xc
test eax, eax
push esi
je 0x598873
push edi
call fcn.00597e60
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x434
ret
lea edi, [esi + 0x1c]
push 0x400
push edi
call fcn.004232e0
mov eax, dword [0x6a0f40]
add esp, 8
push 0x400
push edi
push ebp
push 0x8009
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x5987e6
mov dword [esi + 0x424], eax
mov eax, dword [esi + 0x41c]
test eax, eax
jne 0x5987e6
mov eax, dword [esi + 0x420]
test eax, eax
mov dword [esi + 0x1720], 0
je 0x5987e6
lea edi, [esi + 0x440]
push edi
push 0x1778
mov dword [esi + 0x14ac], 2
call fcn.00424130
push esi
call fcn.00598080
add esp, 0xc
test eax, eax
push esi
jne 0x5987dd
push 7
push edi
call fcn.00461840
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x434
ret
Function at 0x599a60
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x11f8
call fcn.005d9990
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x599a8a
mov eax, 1
add esp, 0x11f8
ret
push eax
call fcn.00597da0
add esp, 4
push eax
push 0
push 0x177e
call fcn.00424130
add esp, 8
push eax
lea ecx, [esp + 0x198]
push ecx
call fcn.005d9929
push 0
push 0
push 0
push 0
push 4
push 3
push 0
lea edx, [esp + 0x1b8]
push edx
push 0x61b650
push 0
call fcn.004d53f0
add esp, 0x34
xor eax, eax
add esp, 0x11f8
ret

Function at 0x599ae0
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00508aa0
add esp, 4
test eax, eax
je 0x599c4f
push esi
push 4
call fcn.004d2190
mov eax, dword [esi + 0x1720]
add esp, 8
test eax, eax
je 0x599b1a
push esi
call fcn.005984f0
push esi
call fcn.004d3250
add esp, 8
push ebx
push ebp
push edi
lea ebp, [esi + 0x1c]
push 0x400
push ebp
call fcn.004232e0
mov eax, dword [esi + 0x10]
mov ebx, dword [sym.imp.WSOCK32.dll_inet_addr]
add esp, 8
test eax, eax
je 0x599b7c
or edi, 0xffffffff
mov edi, edi
cmp edi, 0xffffffff
jne 0x599b67
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push ecx
call ebx
mov edx, dword [esi + 0x10]
push edx
mov edi, eax
call fcn.004e8950
add esp, 4
test eax, eax
mov dword [esi + 0x10], eax
jne 0x599b40
cmp edi, 0xffffffff
je 0x599b7c
push esi
push edi
push 0
push 0
call fcn.005988c0
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
lea edi, [esi + 0x37fe]
push edi
call ebx
cmp eax, 0xffffffff
je 0x599b9f
push esi
push eax
push 0
push 0
call fcn.005988c0
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
mov eax, dword [0x649044]
test eax, eax
je 0x599bed
mov eax, dword [0x64903c]
test eax, eax
je 0x599bed
mov eax, dword [esi + 8]
push eax
call fcn.00494ff0
push edi
call fcn.00494ea0
add esp, 8
test eax, eax
jne 0x599bed
mov ecx, dword [esi + 8]
push esi
push ecx
push eax
add esi, 0x36cc
push esi
call fcn.005d9a55
add esp, 4
push eax
push edi
call fcn.00497450
add esp, 0x14
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
mov edx, dword [0x6a0f40]
push 0x400
push ebp
push edi
push 0x800c
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x599c4c
mov eax, dword [esi + 0x41c]
test eax, eax
jne 0x599c4c
mov eax, dword [esi + 0x420]
test eax, eax
je 0x599c2b
mov dword [esi + 0x14ac], 3
lea edi, [esi + 0x440]
push edi
push 0x1779
call fcn.00424130
push esi
call fcn.00598080
push esi
push edi
call fcn.00597e60
add esp, 0x14
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret