joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435b58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00406998
xor eax, eax
push ebp
push 0x435cc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x435c07
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.00406a3c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x435c9c
lea eax, [ebp + 8]
call fcn.00405c14
call fcn.00406d20
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call fcn.00406a3c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00406a3c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x435c9c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.00406bf4
mov eax, dword [ebp - 0x14]
call fcn.004061d8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x435c9c
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, 0
call fcn.00406bf4
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c44
call fcn.00405ddc
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004061d8
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.00406bf4
mov eax, dword [ebp - 0x18]
call fcn.004061d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435cce
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405a3c
lea eax, [ebp - 4]
call fcn.00405a18
lea eax, [ebp + 8]
call fcn.004069a0
ret
Function at 0x435cdc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x435dc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x435d4f
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.00406a3c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x435dac
mov eax, dword [ebp - 4]
call fcn.00406a3c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x435dac
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.00406bf4
mov eax, dword [ebp - 0xc]
call fcn.004061d8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x435dac
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406bf4
mov eax, dword [ebp - 0x10]
call fcn.004061d8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435dce
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405a3c
ret

Function at 0x436460
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041a670
test eax, eax
je 0x436511
cmp word [eax + 0x18], 0x20b
jne 0x43649e
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x4364b0
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x436511
jmp 0x43650b
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x4364c7
push ebp
call fcn.004362a0
pop ecx
jmp 0x436511
cmp dword [esi + 0x10], 0
je 0x436508
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x436503
cmp edi, dword [ebx]
jne 0x436500
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x436500
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x4364d5
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x4364b6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4378e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.004069b0
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x4378b9
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4378b9
cmp dword [0x633d0c], 0
jne 0x4377e2
push 0x4378f4
push 0x437920
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409db4
mov dword [0x633d0c], eax
cmp dword [0x633d0c], 0
je 0x437814
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x633d0c]
test eax, eax
je 0x437814
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406bb0
jmp 0x43784b
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x43784b
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.00405cfc
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.00406bcc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x437877
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.004350e8
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040f404
cmp dword [edi], 0
je 0x4378b9
mov eax, dword [edi]
call fcn.00406d20
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x4378b9
test bl, bl
je 0x4378a4
mov eax, edi
mov edx, 0x437944
call fcn.00406dc4
jmp 0x4378b9
mov eax, dword [edi]
call fcn.00406d20
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.0040722c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4378ec
lea eax, [ebp - 0x21c]
call fcn.004069a0
lea eax, [ebp - 0x218]
call fcn.00405a18
lea eax, [ebp - 4]
call fcn.00408d3c
ret
Function at 0x438390
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
xor eax, eax
push ebp
push 0x438446
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4383c4
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438430
lea eax, [ebp - 4]
call fcn.00405c14
call fcn.00406d20
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x43842b
lea eax, [ebp - 4]
call fcn.00405c14
call fcn.00406d20
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.00406a3c
mov edx, esi
pop ecx
call fcn.00403294
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43844d
lea eax, [ebp - 4]
call fcn.004069a0
ret
Function at 0x43a5e4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x43a798
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.0043a518
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43a776
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x619eb0], 0
jne 0x43a74a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.00435e9c
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040db34
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x43a7b8
call fcn.00405ed8
mov eax, dword [ebp - 0x2c]
call fcn.004061d8
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x43a6be
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040db34
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x43a7b8
call fcn.00405ed8
mov eax, dword [ebp - 0x34]
call fcn.004061d8
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x43a6d9
xor esi, esi
push 0
push 0x43a7d0
push 0x43a7dc
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x43a739
test bl, bl
je 0x43a720
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.0040abf0
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x43a739
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x43a74a
mov eax, esi
call fcn.00468b98
mov dword [0x619eb0], esi
cmp dword [0x619eb0], 0
je 0x43a760
mov eax, dword [0x619eb0]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a77d
mov eax, dword [ebp - 8]
call fcn.0043a5d0
ret

Function at 0x43e7ec
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x619edc], 0
jne 0x43e87f
xor eax, eax
call fcn.00419e10
mov dword [0x619edc], eax
cmp dword [0x619edc], 0
je 0x43e87f
mov eax, 0x43e650
xor ecx, ecx
xor edx, edx
call fcn.0041a314
mov dword [0x619ee0], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x619ef0], eax
push 0x619ed4
push 4
push 0
push 0x43e698
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x619ed8], eax
cmp dword [0x619ed8], 0
je 0x43e87f
mov edx, 0x43e88c
mov eax, dword [0x619ed4]
call fcn.00436af8
push 2
mov eax, dword [0x619ed8]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x619ed8]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x43e8c8
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x619edc], 0
je 0x43e999
mov ebx, dword [0x619ef0]
xor eax, eax
mov dword [0x619ef0], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x619eec], 0
je 0x43e911
mov ebx, dword [0x619eec]
xor eax, eax
mov dword [0x619eec], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x619ee8], 0xffffffff
mov eax, 0x43e650
xor ecx, ecx
xor edx, edx
call fcn.0041a540
push 0x1f4
mov eax, dword [0x619ed8]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43e95e
push 0
mov eax, dword [0x619ed8]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x619ef4], 0
je 0x43e95e
mov eax, dword [0x619ef4]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x619ef4], eax
mov eax, dword [0x619ed8]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x619ed4]
call fcn.0043686c
xor eax, eax
mov dword [0x619ed8], eax
xor eax, eax
mov dword [0x619ed4], eax
xor eax, eax
mov dword [0x619edc], eax
pop ebx
ret
Function at 0x446900
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004061d8
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44692c
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x44692c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x448528
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x619578], 0
je 0x44854e
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004484c0
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.004344b0
test al, al
jne 0x4485ce
cmp esi, 0x80090318
jne 0x4485d6
test edi, edi
je 0x4485d6
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x448606
cmp dword [ebp - 0x24], 0
je 0x448606
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4485fc
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44861a
cmp dword [ebp - 0x18], 0
je 0x44861a
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x448628
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeac
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x4486ad
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x619598]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x4487e7
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x4487e7
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
mov dword [esp + 0x160], 2
xor eax, eax
mov dword [esp + 0x164], eax
lea eax, [esp + 0x160]
push eax
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.004484c0
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.00448528
mov ebp, eax
sub ebp, 0x80090318
je 0x4487df
sub ebp, 0x7ff6fce8
je 0x44875c
sub ebp, 0x90312
je 0x4487a4
sub ebp, 0xe
je 0x4487d0
jmp 0x4487e7
cmp dword [esp + 0x30], 5
jne 0x44879e
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403294
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x4487e7
cmp dword [esp + 0x30], 5
jne 0x4487c9
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403294
mov esi, dword [esp + 0x2c]
jmp 0x448642
xor esi, esi
jmp 0x448642
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x448642
or edi, 0xffffffff
jmp 0x448642
movzx eax, byte [esp]
add esp, 0x154
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4487f8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004061c8
xor eax, eax
push ebp
push 0x448975
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.004061d8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c44
call fcn.00405ddc
mov edi, eax
mov dword [ebp - 0x10], 0x400
cmp dword [ebx + 8], 0
je 0x448951
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x68]
jbe 0x448951
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
jmp 0x448951
cmp edi, dword [ebp - 0x10]
jbe 0x44886e
mov esi, dword [ebp - 0x10]
jmp 0x448870
mov esi, edi
cmp dword [ebx + 8], 0
je 0x448936
mov edx, dword [ebx + 0x78]
add edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.00403294
push 3
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
add eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 3
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x6c]
push eax
push 3
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], 6
xor eax, eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
push 3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004484c0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebx + 0x54]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x44892b
push 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x44892f
xor eax, eax
jmp 0x448931
mov al, 1
mov byte [ebp - 5], al
jmp 0x44894c
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg byte [ebp - 5]
add dword [ebp - 0xc], esi
sub edi, esi
cmp byte [ebp - 5], 0
je 0x44895f
test edi, edi
ja 0x448864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44897c
lea eax, [ebp - 4]
call fcn.00405a18
ret
Function at 0x4496e8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x44994f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x44990b
cmp byte [0x619580], 0
jne 0x449773
mov eax, ebx
call fcn.00436570
test al, al
je 0x4497b0
push 0x449970
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.0040f0f4
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041c18c
push dword [ebp - 0x21c]
push 0x449988
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405fc8
jmp 0x4497bf
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00406bf4
push 0x449998
lea eax, [ebp - 0x228]
mov edx, dword [0x619f64]
mov ecx, 0
call fcn.00405cfc
push dword [ebp - 0x228]
push 0x4499a8
push 0x4499b8
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.00447348
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.00406bf4
push dword [ebp - 0x22c]
push 0x4499d4
push dword [ebp - 4]
push 0x4499ec
push 0x4499a8
push 0x4499fc
push 0x4499a8
push 0x449a2c
push dword [ebp - 4]
push 0x4499ec
push 0x4499a8
push 0x4499a8
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.00405fc8
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.004487f8
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x44990b
cmp esi, 0xff
jbe 0x44987d
mov ebx, 0xff
jmp 0x44987f
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44989f
cmp ebx, dword [ebp - 0x14]
je 0x4498b1
mov edx, 0x4499a8
mov eax, edi
call fcn.004487f8
mov byte [ebp - 0xd], 0
jmp 0x44990b
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.0041c054
lea eax, [ebp - 0x234]
mov edx, 0x4499a8
call fcn.00405e10
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.004487f8
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x449903
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x44986e
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449956
lea eax, [ebp - 0x234]
call fcn.00405a18
lea eax, [ebp - 0x230]
call fcn.004069a0
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.00405a3c
lea eax, [ebp - 4]
call fcn.00405a18
ret
Function at 0x44bb14
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44bc3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x44bb5e
mov dword [ebp - 0x10], 0x600
jmp 0x44bb65
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00406378
test esi, esi
jbe 0x44bc1d
cmp esi, dword [ebp - 0x10]
jae 0x44bb8b
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.00406378
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c44
call fcn.00405ddc
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44bbc6
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c44
call fcn.00405ddc
cmp eax, dword [ebp - 0x14]
je 0x44bbca
xor ebx, ebx
jmp 0x44bc1d
cmp byte [ebp + 8], 0
je 0x44bbe9
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0041c18c
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.0044ae58
mov ebx, eax
jmp 0x44bbf5
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0044ae58
mov ebx, eax
test bl, bl
je 0x44bc1d
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0044b3ec
test esi, esi
ja 0x44bb7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bc42
lea eax, [ebp - 0x18]
call fcn.00405a18
lea eax, [ebp - 4]
call fcn.00405a18
ret