joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418c50
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 4]
sub esp, 0x100
push ebx
mov ebx, dword [esp + 0x110]
push ebp
push esi
push edi
push eax
mov esi, ecx
mov ecx, dword [esp + 0x11c]
push ebx
push ecx
push edx
mov ecx, esi
call fcn.00428520
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esi + 0x10]
push edi
push 0xa
lea eax, [esi + 0x215e]
push eax
push 0x4554a0
push 0x4554ac
push 0x4554b4
mov dword [esi], 0x44668c
call ebp
push edi
push 0x32
lea ecx, [esi + 0x2169]
push ecx
push 0x4554bc
push 0x4554c8
push 0x4554d0
call ebp
push edi
push 0
push 0x4554d8
push 0x4554e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0
push 0x4554e8
push 0x4554f4
mov dword [esi + 0x2155], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0
push 0x4554fc
push 0x455504
mov dword [esi + 0x2159], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0xfa
lea edx, [esp + 0x1c]
push edx
push 0x467cc6
push 0x45550c
push 0x455510
mov dword [esi + 0x2178], eax
call ebp
lea eax, [esi + 0x2180]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00418b80
movzx edx, ax
mov eax, dword [esi + 0x2178]
mov dword [esi + 0x217c], edx
mov dword [esi + 0x2151], ebx
mov ecx, dword [ebx + 0x2c]
add esp, 8
cmp eax, ecx
jl 0x418d63
xor ecx, ecx
mov dword [esi + 0x2178], ecx
jmp 0x418d65
xor ecx, ecx
cmp dword [ebx + 0x2c], ecx
mov eax, 0xff
jne 0x418d75
mov dword [esi + 0x2178], eax
mov dword [esi + 0x2174], ecx
mov dword [esi + 0x6c1c], ecx
push 4
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esi + 0x215d], 1
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 0x2c
call fcn.004394b0
add esp, 0xc
push 0x455518
lea eax, [esi + 0x21e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0x6c1c]
mov dl, byte [esi + 0x2178]
mov ecx, dword [esp + 0x10]
inc eax
pop edi
mov dword [esi + 0x6c1c], eax
mov dword [esi + 0x21f2], 0xffffffff
mov dword [esi + 0x21ee], ecx
mov byte [esi + 0x21f6], dl
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0x10
Function at 0x419270
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x3c
push ebp
mov ebp, ecx
push esi
mov al, 7
mov cl, 0x3a
push edi
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov al, 0x30
mov byte [esp + 0x28], cl
mov byte [esp + 0x3a], cl
mov edi, 0xffffe09b
xor ecx, ecx
mov byte [esp + 0x20], 0x86
mov byte [esp + 0x21], 0x7b
mov byte [esp + 0x23], 0xea
mov byte [esp + 0x24], 4
mov byte [esp + 0x26], 0x91
mov byte [esp + 0x27], 0xef
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], 0xd3
mov byte [esp + 0x2b], 0xd4
mov byte [esp + 0x2c], 0xd5
mov byte [esp + 0x2d], 0xe4
mov byte [esp + 0x2e], 0x23
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], 0xc6
mov byte [esp + 0x31], 0x57
mov byte [esp + 0x32], 0x9f
mov byte [esp + 0x33], 0x9c
mov byte [esp + 0x34], 0xb1
mov byte [esp + 0x35], 0x61
mov byte [esp + 0x36], 0x3f
mov byte [esp + 0x37], 0x4d
mov byte [esp + 0x38], 5
mov byte [esp + 0x39], al
mov byte [esp + 0x3b], 0x19
mov byte [esp + 0x3c], 0x4b
mov byte [esp + 0x3d], 0x7d
mov byte [esp + 0x3e], 0x55
lea esi, [ebp + 0x1f65]
sub edi, ebp
push ebx
mov al, byte [esi]
cmp al, 0x2d
je 0x419357
cmp al, 0x20
je 0x419357
test al, al
je 0x419357
xor edx, edx
movzx eax, al
mov ebx, 5
div ebx
inc ecx
inc ecx
inc esi
mov dl, byte [esp + edx + 0x24]
mov al, byte [esp + eax + 0x24]
mov byte [esp + ecx + 0xe], dl
mov byte [esp + ecx + 0xf], al
lea edx, [edi + esi]
cmp edx, 6
jb 0x419322
xor esi, esi
xor eax, eax
test ecx, ecx
pop ebx
jbe 0x41936c
movzx edx, byte [esp + eax + 0xc]
add esi, edx
inc eax
cmp eax, ecx
jb 0x419360
lea eax, [ebp + 0x1ff9]
push eax
push 0
push 0x455854
push 0x455860
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp esi, eax
jne 0x419392
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x3c
ret
pop edi
pop esi
mov byte [ebp + 0x1f64], 0
xor al, al
pop ebp
add esp, 0x3c
ret

Function at 0x4195d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xc
push esi
push edi
push str.ADVAPI32.dll
mov esi, ecx
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x419623
push 0x45588c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x455898
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419623
push 0
lea ecx, [esp + 0x10]
push ecx
push 1
push 0x455868
call eax
push 0
push 0x40000080
push 3
lea edx, [esp + 0x14]
push edx
push 0
push 0xc0000000
push 0x4558d0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x20fe], eax
jne 0x4196a6
push 0x4558dc
push 0x455918
push 0x455920
mov byte [esi + 0x20fd], 0
mov byte [esi + 0x2102], 0
call fcn.0040d190
mov ecx, dword [esi + 0x1f5c]
add esp, 0xc
push 0x10
push 0x455928
push 0x466a30
call fcn.00401480
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor al, al
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esi + 0x10]
push 0x45593c
call fcn.004359d0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, 1
pop esi
add esp, 0xc
ret 4
Function at 0x419fa0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x20fd]
test al, al
je 0x419fcb
mov eax, dword [esi + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push eax
call edi
mov esi, dword [esi + 0x30ce]
test esi, esi
je 0x419fca
mov ecx, dword [esi + 8]
push ecx
call edi
pop edi
pop esi
ret

Function at 0x419fd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
push esi
push edi
mov esi, ecx
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0xc]
cmp eax, 5
mov ecx, dword [esp + 0x10]
jne 0x41a018
cmp ecx, 1
jne 0x41a018
mov dword [esi + 0x30d2], ecx
mov edx, dword [0x466c98]
test edx, edx
jne 0x41a035
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
call fcn.004196d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 5
jne 0x41a051
test ecx, ecx
jne 0x41a051
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call fcn.00419760
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.004195d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41ae60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x5dc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x5ec]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x467980
push 0xff
push 0x466a30
push 0x455da8
mov ebx, ecx
push 0x455dbc
push 0x455dc4
mov dword [ebx], esi
mov dword [ebx + 4], eax
call edi
push 0x466a30
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x467980
push 0xff
push 0x466a30
push 0x455dd0
push 0x455dd4
push 0x455dd8
call edi
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x466a30
push 1
push esi
call ebp
push 0x467980
push 0xff
push 0x466a30
push 0x455de4
push 0x455dec
push 0x455df4
call edi
push 0x466a30
push 2
push esi
call ebp
push 0x467980
push 0xff
push 0x466a30
push 0x455e00
push 0x455e0c
push 0x455e10
call edi
push 0x466a30
push 0x64
push esi
call ebp
push 0x467980
push 0xff
push 0x466a30
push 0x455e1c
push str.DELETE
push 0x455e2c
call edi
push 0x466a30
push 0x66
push esi
call ebp
push 0x467980
push 0xff
push 0x466a30
push 0x455e38
push str.SELECTPORT
push 0x455e58
call edi
push 0x466a30
push 0x65
push esi
call ebp
lea ecx, [esp + 0x10]
xor edi, edi
push ecx
push edi
mov ecx, dword [ebx + 4]
call fcn.00402130
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
je 0x41afc4
lea edx, [esp + 0x10]
push edx
push 0
push 0x180
push 0x67
push esi
call ebp
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x10]
push eax
inc edi
push edi
call fcn.00402130
test eax, eax
jne 0x41afa0
push 0
push 0
push 0x18b
push 0x67
push esi
call ebp
test eax, eax
jle 0x41afe4
push 0
push 0
push 0x186
push 0x67
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x5dc
ret 8
Function at 0x4231f0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0xffffffffffffffff
push 0x445586
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00412b10
lea eax, [esi + 0xbd0]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
mov dword [esi], 0x4466c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0xc08]
mov byte [esp + 0x14], 1
call fcn.00424790
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xc14], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xc00], eax
mov dword [esi + 0xe18], ebx
mov byte [esi + 0xbcf], bl
mov byte [esi + 0xbce], bl
mov byte [esi + 0x15], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x423290
Capabilities:
Print debug messages
Resume thread

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
push 0
push 0
mov esi, ecx
lea eax, [esp + 0xc]
push eax
mov eax, dword [edx]
lea ecx, [esi + 0xbf0]
push ecx
push eax
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_WSAAccept]
cmp eax, 0xffffffff
mov dword [esi + 0xc14], eax
jne 0x4232d7
push 0x45d838
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ax, ax
pop esi
pop ecx
ret 4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0xbe8], eax
jne 0x423302
push 0x45d84c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ax, ax
pop esi
pop ecx
ret 4
mov ecx, dword [esi + 0xc14]
push 0x21
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
je 0x423329
push 0x45d85c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ax, ax
pop esi
pop ecx
ret 4
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xbe8]
push eax
mov dword [esi + 0xe18], 1
mov dword [esi + 0xc18], edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ax, 1
pop esi
pop ecx
ret 4
Function at 0x423530
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push esi
mov esi, ecx
je 0x42368e
mov eax, dword [esi + 0xe18]
dec eax
cmp ebx, eax
ja 0x42368e
push edi
mov edi, dword [esi + ebx*4 + 0xd18]
test edi, edi
je 0x42368d
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 8]
push eax
call fcn.0043904c
mov ecx, dword [edi + 0xc]
push ecx
call fcn.0043904c
push edi
call fcn.0043904c
mov edi, dword [esi + 0xe18]
add esp, 0xc
dec edi
mov eax, edi
cmp ebx, eax
mov dword [esi + 0xe18], edi
mov ecx, ebx
jge 0x4235c2
lea eax, [esi + ebx*4 + 0xc18]
mov edx, dword [eax + 4]
mov dword [eax], edx
mov edx, dword [eax + 0x104]
mov dword [eax + 0x100], edx
mov edx, dword [esi + 0xe18]
inc ecx
add eax, 4
cmp ecx, edx
jl 0x4235a3
lea ebx, [esi + 0xc08]
mov ecx, ebx
call fcn.004247a0
test al, al
je 0x42368d
push ebp
mov ecx, ebx
call fcn.00424810
push 0
mov edi, eax
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [esi + 0xc14]
push 0
lea ecx, [esp + 0x20]
push ecx
push 1
lea edx, [edi + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebp, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp ebp, 0xffffffff
pop ebp
jne 0x42365e
cmp eax, 0x3e5
je 0x42362a
cmp eax, 0x2733
je 0x42368d
mov ecx, esi
call fcn.004234b0
pop edi
pop esi
pop ebx
ret 4
mov eax, dword [esi + 0xe18]
inc eax
mov dword [esi + 0xe18], eax
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx + 0x10]
mov dword [esi + eax*4 + 0xc14], edx
mov eax, dword [esi + 0xe18]
mov ecx, ebx
mov dword [esi + eax*4 + 0xd14], edi
call fcn.004247b0
pop edi
pop esi
pop ebx
ret 4
mov ecx, ebx
call fcn.004247b0
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 8]
push eax
call fcn.0043904c
mov ecx, dword [edi + 0xc]
push ecx
call fcn.0043904c
push edi
call fcn.0043904c
add esp, 0xc
pop edi
pop esi
pop ebx
ret 4
Function at 0x4236b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20
mov eax, dword [ecx + 0xbf4]
cmp al, 0x7f
mov dword [esp], eax
mov dl, byte [esp + 3]
mov cl, byte [esp + 2]
push ebx
jne 0x4236d7
test ah, ah
jne 0x4236d7
test cl, cl
jne 0x4236d7
cmp dl, 1
je 0x4236e8
cmp al, 0x80
jne 0x4236f1
test ah, ah
jne 0x4236f1
test cl, cl
jne 0x4236f1
cmp dl, 1
jne 0x4236f1
mov al, 1
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esp + 0x30]
push 0x45e2c4
push eax
call fcn.00439958
add esp, 8
test eax, eax
je 0x42371a
push 0x45e2c8
push 0
call fcn.00439958
add esp, 8
test eax, eax
jne 0x423723
xor al, al
pop ebx
add esp, 0x20
ret 0xc
push ebp
push esi
push edi
push 0x45e2cc
push 0
call fcn.00439958
mov esi, eax
add esp, 8
test esi, esi
je 0x4237fb
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x4668f8
push 0x14
lea ecx, [esp + 0x18]
push ecx
push 0x467ff3
push 0x45e2d0
push 0x45e2d8
call edi
mov al, byte [esp + 0x10]
test al, al
je 0x4237fb
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push esi
lea edx, [esp + 0x14]
push edx
call ebp
test eax, eax
jne 0x4237fb
mov eax, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push eax
call ebx
push 0x45e2e0
push 0
call fcn.00439958
add esp, 8
test eax, eax
je 0x4237fb
push 0x45e2e4
push 0
call fcn.00439958
mov esi, eax
add esp, 8
test esi, esi
je 0x4237fb
push 0x4668f8
push 0x14
lea ecx, [esp + 0x18]
push ecx
push 0x467ff4
push str.PASSWORD
push str.HTTPIF
call edi
mov al, byte [esp + 0x10]
test al, al
je 0x4237fb
push esi
lea edx, [esp + 0x14]
push edx
call ebp
test eax, eax
jne 0x4237fb
mov eax, dword [esp + 0x38]
push esi
push eax
call ebx
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 0xc
Function at 0x423810
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x10
mov ebp, ecx
call fcn.004394a2
mov esi, dword [esp + 0x20]
mov ebx, eax
lea eax, [esi + 0xa]
push eax
call fcn.004394a2
push 0x14
mov dword [ebx + 8], eax
call fcn.004394a2
mov edi, dword [ebx + 8]
lea ecx, [esi + 1]
mov esi, dword [esp + 0x24]
mov edx, ecx
shr ecx, 2
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
push 0
mov ecx, edx
push 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea esi, [ebx + 4]
push 0
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebx + 0xc]
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp + 0xc14]
push 0
mov dword [esp + 0x14], 0
mov edx, dword [ebx + 0xc]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
push esi
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, 0xffffffff
jne 0x423913
cmp eax, 0x3e5
je 0x4238e4
cmp eax, 0x2733
je 0x4238d0
mov edx, dword [ebp + 0xc14]
push 1
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
pop edi
pop esi
mov byte [ebp + 0xbcf], 1
pop ebp
pop ebx
pop ecx
ret 8
push ebx
lea ecx, [ebp + 0xc08]
call fcn.004247d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [ebp + 0xe18]
inc eax
mov dword [ebp + 0xe18], eax
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + 0x10]
mov dword [ebp + eax*4 + 0xc14], edx
mov eax, dword [ebp + 0xe18]
pop edi
pop esi
mov dword [ebp + eax*4 + 0xd14], ebx
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
push eax
call fcn.0043904c
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.0043904c
push ebx
call fcn.0043904c
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x423f80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0xbf4]
cmp al, 0x7f
mov dword [esp + 0xc], eax
mov dl, byte [esp + 0xf]
mov cl, byte [esp + 0xe]
push edi
jne 0x423fb0
test ah, ah
jne 0x423fb0
test cl, cl
jne 0x423fb0
cmp dl, 1
je 0x4240b6
cmp al, 0x80
jne 0x423fc5
test ah, ah
jne 0x423fc5
test cl, cl
jne 0x423fc5
cmp dl, 1
je 0x4240b6
mov eax, dword [esp + 0x74]
push 0x45e184
push eax
call fcn.00439958
add esp, 8
test eax, eax
je 0x42406d
push 0x45e188
push 0
call fcn.00439958
mov edi, eax
add esp, 8
test edi, edi
je 0x42406d
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x4668f8
push 0x14
lea ecx, [esp + 0x18]
push ecx
push 0x467ff1
push str.LOGIN
push 0x45e194
call ebp
mov al, byte [esp + 0x10]
test al, al
je 0x42410c
push edi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x42410c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [esp + 0x54]
push eax
call ebx
push 0x45e1c4
push 0
call fcn.00439958
add esp, 8
test eax, eax
je 0x42406d
push 0x45e1c8
push 0
call fcn.00439958
mov edi, eax
add esp, 8
test edi, edi
jne 0x424079
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x60
ret 4
push 0x4668f8
push 0x14
lea ecx, [esp + 0x18]
push ecx
push 0x467ff2
push 0x45e1cc
push 0x45e1d8
call ebp
mov al, byte [esp + 0x10]
test al, al
je 0x4240e3
push edi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4240e3
push edi
lea eax, [esp + 0x34]
push eax
call ebx
push str.Main_Menu
push 0x45e214
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x5c]
push edx
mov ecx, esi
call fcn.00423bb0
mov ecx, esi
call fcn.00423950
mov eax, dword [esi + 0xc14]
push 1
push eax
jmp 0x42412b
push str.http600.html
push str.Authorization_Failure
push 0x258
mov ecx, esi
call fcn.004239b0
mov ecx, esi
call fcn.004234b0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x60
ret 4
push 0x45e19c
push 0x45e1ac
push 0x258
mov ecx, esi
call fcn.004239b0
mov ecx, dword [esi + 0xc14]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
pop edi
mov byte [esi + 0xbcf], 1
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x60
ret 4
Function at 0x4242d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x178c
call fcn.00439bd0
push edi
push 0
push 0xbb8
mov edi, ecx
mov ecx, dword [edi + 0xc14]
lea eax, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x14], 0xd
mov byte [esp + 0x15], 0
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x424323
mov edx, dword [edi + 0xc14]
push 1
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
mov byte [edi + 0xbcf], 1
pop edi
add esp, 0x178c
ret
mov al, byte [edi + 0xbce]
test al, al
lea eax, [esp + 8]
push eax
je 0x424351
lea ecx, [edi + 0x3fe]
push ecx
lea edx, [esp + 0xbd4]
push 0x45e0b4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x42435f
lea ecx, [esp + 0xbd0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push ebp
push esi
lea edx, [esp + 0xbd8]
push edx
lea eax, [esp + 0x18]
push eax
mov byte [edi + 0xbce], 0
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00439958
mov esi, eax
add esp, 8
test esi, esi
je 0x424407
xor ebp, ebp
test ebx, ebx
jle 0x4243ba
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
push 0
call fcn.00439958
mov esi, eax
add esp, 8
test esi, esi
je 0x424407
inc ebp
cmp ebp, ebx
jl 0x4243a0
push esi
mov ecx, edi
call fcn.00424150
test al, al
jne 0x4243db
push esi
lea ecx, [edi + 0x3fe]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [edi + 0xbce], 1
lea edx, [esp + 0xbd8]
push edx
lea eax, [esp + 0x18]
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00439958
mov esi, eax
add esp, 8
test esi, esi
jne 0x424396
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x178c
ret
Function at 0x425070
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
xor ecx, ecx
test edx, edx
jle 0x42508a
push esi
mov esi, dword [esp + 8]
xor al, byte [ecx + esi]
inc ecx
cmp ecx, edx
jl 0x425081
pop esi
ret

Function at 0x425090
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
xor ecx, ecx
test esi, esi
jle 0x4250c6
push edi
mov edi, dword [esp + 0xc]
xor edx, edx
mov dl, byte [ecx + edi]
xor edx, eax
and edx, 0xff
movzx edx, word [edx*2 + 0x45e318]
movzx ax, ah
xor dx, ax
inc ecx
cmp ecx, esi
mov eax, edx
jl 0x4250a2
pop edi
pop esi
ret

Function at 0x425550
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x148]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edi, [esi + 0x10]
push edi
push 0x80
push 0x45eadc
push 0x45eae4
call ebx
push edi
push 0xf
push 0x45eae8
push 0x45eaf0
mov dword [esi + 0x14c7], eax
call ebx
push edi
push 4
push 0x45eaf4
push 0x45eafc
mov dword [esi + 0x14cb], eax
call ebx
push edi
push 0x19
push 0x45eb00
push 0x45eb08
mov dword [esi + 0x14d3], eax
call ebx
push edi
push 0xa
push 0x45eb0c
push 0x45eb14
mov dword [esi + 0x14d7], eax
call ebx
push edi
push 0xc
push 0x45eb18
push 0x45eb20
mov dword [esi + 0x14db], eax
call ebx
push edi
push 0x78
lea eax, [eax + eax*4]
push 0x45eb24
shl eax, 1
push 0x45eb2c
mov dword [esi + 0x14df], eax
call ebx
push edi
push 0xb4
push 0x45eb30
push 0x45eb38
mov dword [esi + 0x14e3], eax
call ebx
push edi
push 0
lea ecx, [eax + eax*4]
push 0x45eb3c
shl ecx, 1
push 0x45eb44
mov dword [esi + 0x14e7], ecx
call ebx
push edi
push 0
push 0x45eb48
push 0x45eb54
mov dword [esi + 0x14eb], eax
call ebx
push edi
push 6
push 0x45eb58
push 0x45eb64
mov dword [esi + 0x14ef], eax
call ebx
mov dword [esi + 0x14cf], eax
push edi
push 0x40
push 0x45eb68
push 0x45eb78
call ebx
mov byte [esi + 0x14fb], al
mov eax, dword [esi + 0x14cf]
test eax, eax
mov ecx, 1
jg 0x42568d
mov dword [esi + 0x14cf], ecx
mov edx, dword [esi + 0x14cf]
mov eax, 7
cmp edx, eax
jle 0x4256a2
mov dword [esi + 0x14cf], eax
push ebp
mov dword [esi + 0x114], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4256c0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14c3]
test eax, eax
je 0x4256f1
mov eax, dword [esi + 0x162c]
test eax, eax
je 0x4256e1
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esi + 0x2145]
test ecx, ecx
je 0x4256f1
pop esi
jmp 0x429a50
pop esi
ret
mov eax, dword [ecx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret