joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f462c15
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5f462d04
mov eax, dword [ebp - 4]
push eax
call sym.MFC42D.DLL_Ordinal_2220
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5f462cf0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
cmp edx, dword [ebp - 4]
je 0x5f462cf0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
push edx
call sym.MFC42D.DLL_Ordinal_1120
test eax, eax
je 0x5f462cf0
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x5f462cb6
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x5f462cb6
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], ecx
jmp 0x5f462cf0
cmp dword [ebp + 8], 0
je 0x5f462cf0
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x5f462cf0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x28]
and edx, 2
test edx, edx
je 0x5f462cf0
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x28]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x28], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x5f462c30
mov esp, ebp
pop ebp
ret 4

Function at 0x5f465581
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xe701
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 5
ja case.0x5f4655b2.3
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x5f465652]
mov dword [ebp - 8], 0x14
jmp 0x5f46560b
mov dword [ebp - 8], 0x90
jmp 0x5f46560b
mov dword [ebp - 8], 0x91
jmp 0x5f46560b
mov dword [ebp - 8], 0x15
cmp dword [0x5f4cfcec], 0
jne 0x5f4655eb
mov dword [ebp - 4], 0x8000
jmp 0x5f46560b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
push str.Warning:_OnUpdateKeyIndicator___unknown_indicator_0x_04X._n
call sym.MFC42D.DLL_Ordinal_1179
add esp, 8
mov ecx, dword [ebp + 8]
call sym.MFC42D.DLL_Ordinal_1567
jmp 0x5f465649
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
jne 0x5f465643
push 0x6c0
push str.winfrm.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f465643
int3
xor edx, edx
test edx, edx
jne 0x5f465626
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5f46600d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov word [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
xor ecx, ecx
test eax, eax
setge cl
dec ecx
and ecx, 8
mov dx, word [ebp - 4]
or dx, cx
mov word [ebp - 4], dx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
xor ecx, ecx
test eax, eax
setge cl
dec ecx
and ecx, 4
mov dx, word [ebp - 4]
or dx, cx
mov word [ebp - 4], dx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
jne 0x5f46609e
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
shl ecx, 0x10
mov edx, dword [ebp - 4]
and edx, 0xffff
or ecx, edx
push ecx
push 0x20a
mov ecx, dword [ebp - 0x14]
call sym.MFC42D.DLL_Ordinal_4475
mov dword [ebp - 0x10], eax
jmp 0x5f4660e7
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
shl ecx, 0x10
mov edx, dword [ebp - 4]
and edx, 0xffff
or ecx, edx
push ecx
push 0x20a
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
jne 0x5f4660e7
cmp dword [ebp - 0xc], 0
je 0x5f4660e7
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jne 0x5f46609e
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x5f470472
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
je 0x5f470486
jmp 0x5f470505
call sym.MFC42D.DLL_Ordinal_1110
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [edx]
cmp ecx, dword [eax + 0x1c]
jne 0x5f4704af
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 4]
cmp ecx, dword [eax + 0x20]
je 0x5f470501
lea edx, [ebp - 0xc]
push edx
push 4
push 0x12
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
and edx, 0x40
test edx, edx
je 0x5f4704db
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
or ecx, 0x40
mov dword [ebp - 0x14], ecx
jmp 0x5f4704e6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
and al, 0xbf
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax + 4], edx
mov eax, 1
jmp 0x5f470507
xor eax, eax
jmp 0x5f470507
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5f48764b
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jne 0x5f487672
push 0x3cc
push 0x5f4ac2cc
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f487672
int3
xor ecx, ecx
test ecx, ecx
jne 0x5f487655
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f48768c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jne 0x5f4876b3
push 0x3ce
push 0x5f4ac2cc
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f4876b3
int3
xor ecx, ecx
test ecx, ecx
jne 0x5f487696
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f489226
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4a9a2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call sym.MFC42D.DLL_Ordinal_484
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x1c], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call sym.MFC42D.DLL_Ordinal_492
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov dword [edx], vtable.CInternetFile.0
push 0xffffffffffffffff
mov eax, dword [ebp + 0x14]
push eax
call sym.MFC42D.DLL_Ordinal_1123
test eax, eax
jne 0x5f489298
push 0x2e0
push str.inet.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f489298
int3
xor ecx, ecx
test ecx, ecx
jne 0x5f489275
push 0xffffffffffffffff
mov edx, dword [ebp + 0x10]
push edx
call sym.MFC42D.DLL_Ordinal_1123
test eax, eax
jne 0x5f4892c1
push 0x2e1
push str.inet.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f4892c1
int3
xor eax, eax
test eax, eax
jne 0x5f48929e
cmp dword [ebp + 8], 0
jne 0x5f4892e1
push 0x2e2
push str.inet.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f4892e1
int3
xor ecx, ecx
test ecx, ecx
jne 0x5f4892c7
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call sym.MFC42D.DLL_Ordinal_736
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call sym.MFC42D.DLL_Ordinal_736
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x1c]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5f48937a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4a9a57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call sym.MFC42D.DLL_Ordinal_484
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call sym.MFC42D.DLL_Ordinal_492
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CInternetFile.0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call sym.MFC42D.DLL_Ordinal_1123
test eax, eax
jne 0x5f4893e5
push 0x2f7
push str.inet.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f4893e5
int3
xor edx, edx
test edx, edx
jne 0x5f4893c2
cmp dword [ebp + 0x10], 0
jne 0x5f489405
push 0x2f8
push str.inet.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f489405
int3
xor eax, eax
test eax, eax
jne 0x5f4893eb
push 0x2f9
push str.inet.cpp
mov ecx, dword [ebp + 0x10]
push ecx
call sym.MFC42D.DLL_Ordinal_1042
cmp dword [ebp + 8], 0
jne 0x5f489438
push 0x2fa
push str.inet.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f489438
int3
xor edx, edx
test edx, edx
jne 0x5f48941e
mov ecx, dword [ebp + 0x10]
call sym.MFC42D.DLL_Ordinal_3035
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x5f4cff78
call fcn.5f48ed60
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call sym.MFC42D.DLL_Ordinal_736
mov ecx, dword [ebp + 0x10]
call sym.MFC42D.DLL_Ordinal_2342
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x1c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
call sym.MFC42D.DLL_Ordinal_3034
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call sym.MFC42D.DLL_Ordinal_734
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call sym.MFC42D.DLL_Ordinal_684
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5f49125c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x5f491282
push 0x146
push str.afxtls.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f491282
int3
xor eax, eax
test eax, eax
jne 0x5f491268
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x5f4912a1
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x5f491324
cmp dword [ebp + 0xc], 0
je 0x5f4912c4
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x5f491309
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5f4912f0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x5f4912f7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x5f49131f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x5f49131f
mov dword [ebp - 4], 0
jmp 0x5f491298
cmp dword [ebp - 4], 0
je 0x5f491398
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call sym.MFC42D.DLL_Ordinal_4308
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5f491383
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x5f49138a
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f4913a1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x5f4913e4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5f4913e2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call sym.MFC42D.DLL_Ordinal_1819
jmp 0x5f491419
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call sym.MFC42D.DLL_Ordinal_859
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5f491419
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call sym.MFC42D.DLL_Ordinal_1819
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x5f4913f2
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8
Function at 0x5f4946b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ecx, 0x5f4cfb40
call fcn.5f4947e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 8]
test ecx, ecx
jne 0x5f49479e
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x5f4946f6
push 0x2f
push str.ccdata.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f4946f6
int3
xor eax, eax
test eax, eax
jne 0x5f4946dc
push str.COMCTL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5f494761
push 5
mov ecx, dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5f494761
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sym.MFC42D.DLL_Ordinal_2516
add esp, 0xc
mov ecx, dword [ebp + 8]
call sym.MFC42D.DLL_Ordinal_2640
add eax, 1
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 8]
call sym.MFC42D.DLL_Ordinal_880
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov word [edx + 8], cx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
call sym.MFC42D.DLL_Ordinal_736
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov ax, word [edx + 8]
mov word [ecx], ax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dx, word [ecx]
xor eax, eax
cmp edx, 0xffff
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5f49979a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4aa009
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call sym.MFC42D.DLL_Ordinal_303
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call sym.MFC42D.DLL_Ordinal_260
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call sym.MFC42D.DLL_Ordinal_260
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CDynLinkLibrary.0
push 0x20
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call sym.MFC42D.DLL_Ordinal_1563
push 0x14
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call sym.MFC42D.DLL_Ordinal_1563
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
jne 0x5f49981f
push 0x31
push str.dllinit.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f49981f
int3
xor edx, edx
test edx, edx
jne 0x5f499805
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0
push 0
call sym.MFC42D.DLL_Ordinal_1128
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x1c]
add ecx, 0x1048
call sym.MFC42D.DLL_Ordinal_1003
push 0
call sym.MFC42D.DLL_Ordinal_1185
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f499ac2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 1
jne 0x5f499bf4
mov eax, dword [ebp + 8]
push eax
push 0x5f4cffb8
call sym.MFC42D.DLL_Ordinal_1114
test eax, eax
jne 0x5f499afe
push 0x1d7
push str.dllinit.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f499afe
int3
xor ecx, ecx
test ecx, ecx
jne 0x5f499ad8
push 0x40
call sym.MFC42D.DLL_Ordinal_717
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x5f499b34
push 1
push 0x5f4cffb8
mov ecx, dword [ebp - 0x130]
call sym.MFC42D.DLL_Ordinal_333
mov dword [ebp - 0x13c], eax
jmp 0x5f499b3e
mov dword [ebp - 0x13c], 0
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5f499b6d
push 0x1ea
push str.dllinit.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f499b6d
int3
xor ecx, ecx
test ecx, ecx
jne 0x5f499b53
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], 0
push 0x112
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.MFC42
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x5f4b96f4
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str..DLL
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x120], eax
call sym.MFC42D.DLL_Ordinal_1100
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x120]
mov dword [edx + 0x1050], eax
jmp 0x5f499d02
cmp dword [ebp + 0xc], 0
jne 0x5f499cf5
call sym.MFC42D.DLL_Ordinal_1100
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
cmp dword [ecx + 0x1050], 0
je 0x5f499c3b
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 0x1050]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x124]
mov dword [ecx + 0x1050], 0
mov ecx, dword [ebp - 0x124]
add ecx, 0x1048
call sym.MFC42D.DLL_Ordinal_858
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x5f499ca3
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x5f499c97
push 1
mov ecx, dword [ebp - 0x134]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x134]
call dword [edx + 4]
mov dword [ebp - 0x140], eax
jmp 0x5f499ca1
mov dword [ebp - 0x140], 0
jmp 0x5f499c3b
mov ecx, dword [ebp - 0x124]
add ecx, 0x1048
call sym.MFC42D.DLL_Ordinal_3354
test eax, eax
jne 0x5f499ccc
push 0x210
push str.dllinit.cpp
call sym.MFC42D.DLL_Ordinal_1041
test eax, eax
je 0x5f499ccc
int3
xor eax, eax
test eax, eax
jne 0x5f499ca3
push 0
push 0x5f4cffb8
call sym.MFC42D.DLL_Ordinal_1164
push 1
push 0x5f4cffb8
call sym.MFC42D.DLL_Ordinal_1164
push 1
push 0
call sym.MFC42D.DLL_Ordinal_1165
jmp 0x5f499d02
cmp dword [ebp + 0xc], 3
jne 0x5f499d02
push 0
call sym.MFC42D.DLL_Ordinal_1166
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100010b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ebp
test ebp, ebp
jle 0x100010ef
mov eax, dword [esp + 0x14]
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x100010e8
cmp eax, 0xffffffff
je 0x100010e8
add ebx, eax
add esi, eax
sub edi, eax
cmp ebx, ebp
jge 0x100010ef
jmp 0x100010c4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x10001100
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ebp
test ebp, ebp
jle 0x1000113f
mov eax, dword [esp + 0x14]
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x10001138
cmp eax, 0xffffffff
je 0x10001138
add ebx, eax
add esi, eax
sub edi, eax
cmp ebx, ebp
jge 0x1000113f
jmp 0x10001114
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret