joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e86f8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov dword [esp + 0x24], ecx
mov byte [esp + 0x19], 1
mov al, byte [esp + 0x19]
xor ebp, ebp
xor esi, esi
xor edi, edi
mov byte [esp + 0x1a], al
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x80], ebp
mov bl, 7
fld qword [0x4f6a20]
movsx ecx, bl
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
call fcn.004c5ee0
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x20], eax
movzx eax, byte [esp + 0x1a]
fldcw word [esp + 0x20]
fistp dword [esp + 0x20]
mov dl, byte [esp + 0x20]
mov dword [esp + 0x20], eax
movzx ecx, dl
fldcw word [esp + 0x1c]
mov byte [esp + 0x1c], dl
fild dword [esp + 0x20]
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
fdivp st(1)
fcomp qword [0x4f6a28]
fnstsw ax
test ah, 1
jne 0x445e73
mov cl, 7
sub cl, bl
test esi, esi
mov byte [esp + 0x1b], cl
je 0x445e3d
mov eax, edi
sub eax, esi
sub ebp, esi
cmp eax, ebp
jae 0x445e3d
mov byte [edi], cl
add edi, 1
mov dword [esp + 0x44], edi
jmp 0x445e67
cmp esi, edi
jbe 0x445e46
call fcn.004c000c
lea edx, [esp + 0x1b]
push edx
push edi
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x4c]
call fcn.00444890
mov edi, dword [esp + 0x44]
mov dl, byte [esp + 0x1c]
sub byte [esp + 0x1a], dl
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
add bl, 0xff
jns 0x445db9
mov cl, byte [esp + 0x19]
lea edx, [esp + 0x3c]
mov byte [esp + 0x60], cl
push edx
lea ecx, [esp + 0x68]
call fcn.00444690
mov al, byte [esp + 0x60]
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x84], 1
mov byte [esp + 0x50], al
call fcn.00444690
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x88], 2
call fcn.00445ca0
mov eax, dword [esp + 0x54]
xor esi, esi
cmp eax, esi
je 0x445ede
push eax
call fcn.004aef39
add esp, 4
mov eax, dword [esp + 0x68]
cmp eax, esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
je 0x445efb
push eax
call fcn.004aef39
add esp, 4
mov eax, dword [esp + 0x40]
cmp eax, esi
mov dword [esp + 0x80], 0xffffffff
je 0x445f17
push eax
call fcn.004aef39
add esp, 4
add byte [esp + 0x19], 1
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
jne 0x445d96
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4468f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e87a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.0048ee20
mov dword [edi + 4], eax
mov byte [eax + 0x19], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x28]
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
call fcn.0048ee20
mov dword [edi + 4], eax
mov byte [eax + 0x19], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
push 0x4454d0
push 0x445590
push 2
push 0xc
lea eax, [esi + 0x38]
push eax
mov byte [esp + 0x34], 1
call fcn.004c612a
lea ebp, [esi + 0x50]
mov ecx, ebp
mov byte [esp + 0x20], 2
call fcn.00440d40
mov dword [ebp + 4], eax
mov byte [eax + 0x31], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x5c]
mov ecx, ebp
mov byte [esp + 0x20], 3
call fcn.00440d40
mov dword [ebp + 4], eax
mov byte [eax + 0x31], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x68]
mov ecx, ebp
mov byte [esp + 0x20], 4
call fcn.00440dc0
mov dword [ebp + 4], eax
mov byte [eax + 0x1d], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x74]
mov ecx, ebp
mov byte [esp + 0x20], 5
call fcn.00440e80
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
mov ecx, dword [esp + 0x28]
mov dx, word [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi], ecx
mov word [esi + 4], dx
mov dword [esi + 8], eax
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
push edx
mov ecx, edi
mov byte [esp + 0x24], 6
call fcn.0048ede0
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], ebx
mov dword [eax], eax
mov edi, dword [edi + 4]
mov dword [edi + 8], edi
push ebx
mov byte [esi + 0x34], 1
call fcn.004c0de9
push eax
call fcn.004c1658
add esp, 8
mov byte [esi + 0x80], 1
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x44bf10
Capabilities:
Query service status

Disassembly:
mov eax, dword [ecx + 0x38]
sub esp, 0x1c
test eax, eax
jne 0x44bf1e
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
cmp dword [ecx + 0x34], 8
jb 0x44bf2d
mov ecx, dword [ecx + 0x20]
jmp 0x44bf30
add ecx, 0x20
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x44bf5e
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x44bf57
mov edi, dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x44bff0
Capabilities:
Start service

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x44c055
call fcn.0044bf10
sub eax, 0
je 0x44c055
sub eax, 2
je 0x44c051
sub eax, 2
je 0x44c051
push ebx
xor bl, bl
cmp dword [esi + 0x34], 8
jb 0x44c01b
mov eax, dword [esi + 0x20]
jmp 0x44c01e
lea eax, [esi + 0x20]
push 0xf01ff
push eax
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x44c04c
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x44c045
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop ebx
pop esi
ret
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x44c060
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x44c0d1
call fcn.0044bf10
sub eax, 0
je 0x44c0d1
sub eax, 1
je 0x44c0ca
sub eax, 2
je 0x44c0ca
push ebx
xor bl, bl
cmp dword [esi + 0x34], 8
jb 0x44c08e
mov eax, dword [esi + 0x20]
jmp 0x44c091
lea eax, [esi + 0x20]
push 0xf01ff
push eax
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x44c0c2
lea ecx, [esp + 8]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x44c0bb
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop ebx
pop esi
add esp, 0x1c
ret
mov al, 1
pop esi
add esp, 0x1c
ret
xor al, al
pop esi
add esp, 0x1c
ret
Function at 0x44c470
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4e8e23
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0040cce0
xor edi, edi
lea ecx, [esi + 0x4e]
mov dword [esi], vtable.Clunet::CCluCallerThread.0
mov dword [esp + 0x18], edi
mov dword [ecx], edi
mov word [ecx + 4], di
mov dword [ecx + 6], edi
mov word [ecx + 0xa], 3
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x20], edi
mov dword [ecx + 0x24], edi
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], edi
mov dword [ecx + 0x30], edi
mov dword [ecx + 0x34], edi
mov dword [ecx + 0x38], edi
mov dword [ecx + 0x3c], edi
mov dword [ecx + 0x40], edi
mov word [ecx + 0x44], di
mov edx, dword [esp + 0x20]
mov al, byte [esp + 0x24]
push edx
mov byte [esp + 0x1c], 1
mov byte [esi + 0x4c], al
call fcn.004026a0
mov eax, dword [esp + 0x28]
push edi
mov dword [esi + 0x94], eax
mov dword [esi + 0x44], edi
call fcn.004c0de9
mov dword [esi + 0x3c], eax
add esp, 4
mov dword [esi + 0x40], edx
mov dword [esi + 0x48], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc

Function at 0x44c890
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x670f1c]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push esi
mov esi, ecx
mov eax, 0x4fe8d0
lea edx, [esi + 4]
sub edx, eax
xor ebx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x44c8b4
push 0x14
mov dword [esi + 0x88], ebx
call fcn.004aef0e
add esp, 4
cmp eax, ebx
je 0x44c8dd
mov dword [eax + 0x10], 0xffffffff
jmp 0x44c8df
xor eax, eax
mov dword [esi + 0x68], eax
lea eax, [esi + 0x78]
push eax
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea ecx, [esp + 8]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44c93b
mov edx, dword [esi + 0x68]
mov dword [edx + 0x10], 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax]
push ebx
push 0x4fe8ac
mov ecx, esi
call edx
pop esi
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x194
ret
mov eax, dword [0x66e850]
push eax
call fcn.004aef3e
mov ecx, dword [esp + 0x19c]
add esp, 4
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x88], eax
pop esi
pop ebx
xor ecx, esp
call fcn.004bfdfd
add esp, 0x194
ret
Function at 0x44cad0
Capabilities:
Connect socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov eax, dword [ecx + 0x10]
cmp eax, 0xffffffff
jne 0x44caf4
mov eax, dword [esi]
mov edx, dword [eax]
push 0xfffffffffffffffd
push 0x4fe9fc
mov ecx, esi
call edx
xor al, al
pop esi
ret 4
push 0x10
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x44cb31
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2733
je 0x44cb31
sub ecx, 2
je 0x44cb31
sub ecx, 0x13
je 0x44cb31
mov edx, dword [esi]
push eax
mov eax, dword [edx]
push 0x4fe9e4
mov ecx, esi
call eax
xor al, al
pop esi
ret 4
mov al, 1
pop esi
ret 4

Function at 0x44cbe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
cmp ebp, dword [0x66e850]
mov ebx, ecx
mov dword [esp + 8], ebx
jle 0x44cc0b
mov eax, dword [ebx]
mov edx, dword [eax]
push 0xfffffffffffffffc
push 0x4feb0c
call edx
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
push esi
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
jne 0x44cc2b
mov eax, dword [ebx]
mov edx, dword [eax]
push 0xfffffffffffffffd
push 0x4feaf0
call edx
or eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
cmp ebp, 0x19000
push 0
jg 0x44cc6d
mov eax, dword [esp + 0x1c]
push ebp
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x44cc82
cmp eax, 0xffffffff
jne 0x44cd3e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebx]
push eax
mov eax, dword [edx]
push 0x4feadc
mov ecx, ebx
call eax
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
push 0x19000
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x44cc9b
mov edx, dword [ebx]
mov eax, dword [edx]
push 0xfffffffffffffffb
push 0x4feac0
mov ecx, ebx
call eax
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
cmp eax, 0xffffffff
je 0x44cc4f
push edi
mov edi, eax
add ebx, 0x8c
lea esp, [esp]
lea ecx, [edi + 0x19000]
cmp ecx, ebp
mov eax, 0x19000
jle 0x44ccc3
mov eax, ebp
sub eax, edi
push 0
push eax
push ebx
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x44ccf7
cmp esi, 0xffffffff
je 0x44cd13
mov edx, dword [esp + 0x1c]
push esi
lea eax, [edi + edx]
push ebx
push eax
call fcn.004c1770
add edi, esi
add esp, 0xc
cmp ebp, edi
je 0x44cd3b
mov esi, dword [esp + 0x18]
jmp 0x44ccb0
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx]
push 0xfffffffffffffffb
push 0x4feac0
call eax
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x44cd3b
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push eax
mov eax, dword [edx]
push 0x4feadc
call eax
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x44d830
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 0xc
push ebp
push esi
push 6
push 1
push 2
mov ebp, ecx
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi + 0x10], eax
je 0x44d874
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x44d893
mov ecx, ebp
call fcn.0044d1f0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp]
push eax
mov eax, dword [edx]
push 0x4fec50
mov ecx, ebp
call eax
pop esi
xor al, al
pop ebp
add esp, 0xc
ret 4
mov eax, dword [esi + 0x10]
push edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x80
push 0xffff
push eax
mov dword [esp + 0x24], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x80
push 0xffff
push eax
mov word [esp + 0x30], 1
mov word [esp + 0x32], 0
call edi
cmp dword [ebp + 0x6c], 1
jne 0x44d938
mov ecx, dword [0x66e854]
push 4
lea eax, [esp + 0x10]
push eax
push 0x1001
lea edx, [ecx + ecx + 1]
mov ecx, dword [esi + 0x10]
push 0xffff
push ecx
mov dword [esp + 0x20], edx
call edi
mov edx, dword [0x66e854]
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1002
lea eax, [edx + edx + 1]
mov edx, dword [esi + 0x10]
push 0xffff
push edx
mov dword [esp + 0x20], eax
call edi
cmp dword [ebp + 0x6c], 2
jne 0x44d9a6
mov ecx, dword [0x66e854]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
mov eax, dword [esi + 0x10]
push 4
lea edx, [esp + 0x10]
push edx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x20], ecx
call edi
mov ecx, dword [0x66e854]
mov eax, 0x66666667
imul ecx
push 4
sar edx, 2
mov ecx, edx
lea eax, [esp + 0x10]
push eax
shr ecx, 0x1f
push 0x1002
lea edx, [edx + ecx + 1]
mov ecx, dword [esi + 0x10]
push 0xffff
push ecx
mov dword [esp + 0x20], edx
call edi
cmp dword [ebp + 0x6c], 3
jne 0x44d9d0
mov edx, dword [0x66e854]
mov ecx, dword [esi + 0x10]
push 4
lea eax, [esp + 0x10]
push eax
push 0x1001
push 0xffff
add edx, 1
push ecx
mov dword [esp + 0x20], edx
call edi
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0xc
ret 4
Function at 0x44dd20
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_gethostbyname]
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0x14], ebx
call ebp
cmp eax, ebx
jne 0x44dd81
push edi
call ebp
cmp eax, ebx
jne 0x44dd81
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esi]
push eax
mov eax, dword [edx]
push 0x4fe8ec
mov ecx, esi
call eax
mov esi, dword [esp + 0x18]
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x4f678c
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004017d0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, byte [eax]
mov cl, byte [eax + 1]
mov byte [esp + 0x1c], dl
movzx edx, byte [eax + 2]
mov al, byte [eax + 3]
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], al
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, dword [esp + 0x18]
mov ecx, eax
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x44ddc4
sub ecx, edi
push ecx
push eax
mov ecx, esi
call fcn.004017d0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x450720
Capabilities:
Get socket status

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov ebx, ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x44]
push edi
push esi
mov dword [esp + 0x14], ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x48]
push edi
push esi
mov ecx, ebx
call edx
mov al, byte [esi + 0x1d]
test al, al
jne 0x450759
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 8
cmp al, 1
je 0x45074d
mov edx, dword [esi + 0x28]
push ebp
lea ebp, [esi + 0x28]
xor eax, eax
test edx, edx
mov dword [esp + 0x1c], ebp
jbe 0x450785
mov ecx, dword [esi + 0x14]
mov edi, dword [ecx + 0x10]
lea ecx, [esi + 0x2c]
cmp dword [ecx], edi
je 0x450785
add eax, 1
add ecx, 4
cmp eax, edx
jb 0x450777
cmp eax, edx
jne 0x45079c
cmp edx, 1
jae 0x45079c
mov edx, dword [esi + 0x14]
mov ecx, dword [edx + 0x10]
mov dword [esi + eax*4 + 0x2c], ecx
add dword [ebp], 1
mov edx, dword [esi + 0x30]
lea edi, [esi + 0x30]
xor eax, eax
test edx, edx
jbe 0x4507bf
mov ecx, dword [esi + 0x14]
mov ebx, dword [ecx + 0x10]
lea ecx, [esi + 0x34]
cmp dword [ecx], ebx
je 0x4507bf
add eax, 1
add ecx, 4
cmp eax, edx
jb 0x4507b1
cmp eax, edx
jne 0x4507d5
cmp edx, 1
jae 0x4507d5
mov edx, dword [esi + 0x14]
mov ecx, dword [edx + 0x10]
mov dword [esi + eax*4 + 0x34], ecx
add dword [edi], 1
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x38]
xor ecx, ecx
test ebx, ebx
jbe 0x450802
mov edx, dword [esi + 0x14]
mov ebp, dword [edx + 0x10]
lea edx, [esi + 0x3c]
lea ebx, [ebx]
cmp dword [edx], ebp
je 0x4507fe
add ecx, 1
add edx, 4
cmp ecx, ebx
jb 0x4507f0
mov ebp, dword [esp + 0x1c]
cmp ecx, ebx
jne 0x450818
cmp ebx, 1
jae 0x450818
mov edx, dword [esi + 0x14]
mov edx, dword [edx + 0x10]
mov dword [esi + ecx*4 + 0x3c], edx
add dword [eax], 1
mov ebx, dword [esp + 0x10]
lea ecx, [ebx + 0x80]
push ecx
push eax
push edi
push ebp
push 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
pop ebp
je 0x45074d
cmp eax, 0xffffffff
jne 0x450868
mov esi, dword [ebx]
mov ecx, ebx
call sub.WS2_32.dll_WSAGetLastError
mov edx, dword [esi]
push eax
push 0x4fed90
mov ecx, ebx
call edx
push 0x522f88
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0
call fcn.004c0c8a
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x450e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e92e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], vtable.CWz_FTP_DOWNLOAD.0
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
push 0x19000
mov byte [esp + 0x18], 1
mov dword [esi + 0x10], 0x19000
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
call fcn.004aef3e
mov dword [esi + 0x38], eax
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x454870
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4548a6
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0xc]
push esi
push edi
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call edi
push ebx
call edi
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
add esp, 8
ret
Function at 0x4548f0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45491b
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
test eax, eax
push ebx
push esi
push edi
je 0x454956
mov edx, dword [esp + 0x10]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call edi
push ebp
call edi
test esi, esi
je 0x454a1b
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0xc
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [esp + 0x14], 0
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push eax
call ebx
test eax, eax
jne 0x454a28
cmp dword [esp + 0x14], eax
jbe 0x454a00
mov eax, dword [esp + 0x18]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004aef3e
mov ecx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
add eax, 1
push eax
push esi
push 0
push ecx
call edi
test eax, eax
jne 0x454a3d
mov edx, dword [esp + 0x10]
push edx
push eax
push esi
call fcn.004548f0
add esp, 0xc
test eax, eax
push esi
je 0x454a5b
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x14], 0
ja 0x454970
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x454a6e
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0xc
ret
push esi
call fcn.004aef39
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0xc
ret
call fcn.004aef39
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0xc
ret