joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b100
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4ded
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov ecx, 0x534838
call fcn.004c63e1
xor eax, eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], 0
push 0x104
push 0
lea ecx, [ebp - 0x154]
push ecx
call fcn.004c9920
add esp, 0xc
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
mov ecx, dword [eax]
mov dword [ebp - 0x15c], ecx
push 0
push 0
lea edx, [ebp - 0x15c]
push edx
push 0x41bb50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x38]
call fcn.004035d0
mov byte [ebp - 4], 1
call fcn.0040d2c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x40
jne 0x41b1bc
push str.http:__dw.gptchrome.net_bropkg_GInstallerx64_162.exe
lea ecx, [ebp - 0x38]
call fcn.00405590
jmp 0x41b1c9
push str.http:__dw.gptchrome.net_bropkg_GInstallerx86_162.exe
lea ecx, [ebp - 0x38]
call fcn.00405590
lea ecx, [ebp - 0x38]
call fcn.00410160
movzx eax, al
test eax, eax
je 0x41b1ff
mov byte [ebp - 0xd], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00403800
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004082a0
mov al, byte [ebp - 0xd]
jmp 0x41b2e2
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x14], 0
jmp 0x41b218
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 5
jge 0x41b276
push 0
lea edx, [ebp - 0x154]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
lea eax, [ebp + 8]
push eax
call fcn.004078e0
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48], esp
lea edx, [ebp - 0x38]
push edx
call fcn.00407bc0
mov byte [ebp - 4], 1
call fcn.00414310
add esp, 0x24
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x41b269
jmp 0x41b276
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41b20f
mov dword [ebp - 0x50], 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp + 8]
call fcn.004086f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41b2c0
mov byte [ebp - 0xf], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00403800
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004082a0
mov al, byte [ebp - 0xf]
jmp 0x41b2e2
mov byte [ebp - 0x10], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00403800
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004082a0
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41bdc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3c9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x808
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov ecx, 0x534838
call fcn.004c63e1
mov ecx, dword [ebp + 8]
call fcn.004078b0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0x800
push 0
lea ecx, [ebp - 0x814]
push ecx
call fcn.004c9920
add esp, 0xc
push 0x800
push 0
lea edx, [ebp - 0x814]
push edx
call fcn.004c9920
add esp, 0xc
push 0
push 0x17
lea eax, [ebp - 0x814]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41be70
lea ecx, [ebp - 0x814]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00408610
push 0x4fd220
mov ecx, dword [ebp + 8]
call fcn.00408a50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42a510
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f58b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov ecx, 0x534b41
call fcn.004c63e1
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x465
ja 0x42a565
cmp dword [ebp - 0x18], 0x465
je 0x42a5a5
cmp dword [ebp - 0x18], 0x113
je 0x42a585
jmp case.0x42a57e.2
mov ecx, dword [ebp - 0x18]
sub ecx, 0x466
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 7
ja case.0x42a57e.2
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x42a744]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0042ac00
mov dword [ebp - 0x24], eax
jmp case.0x42a57e.2
mov ecx, dword [ebp - 0x14]
call fcn.0042b1a0
jmp case.0x42a57e.2
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0047e223
jmp case.0x42a57e.2
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x7a4], 1
jmp case.0x42a57e.2
cmp dword [ebp + 0xc], 0
je 0x42a5e9
push 1
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0047e78a
jmp 0x42a618
push 1
push 0
mov ecx, dword [ebp - 0x14]
call fcn.0047e78a
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x7cc], 0
je 0x42a618
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x7cc]
call fcn.00476795
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x42a57e.2
lea ecx, [ebp - 0x1c]
call fcn.004078b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
shl ecx, 1
push ecx
push 0x4ff7b4
lea edx, [ebp - 0x1c]
push edx
call fcn.00409950
add esp, 0xc
mov eax, dword [ebp + 0xc]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x7c0]
call fcn.00483fba
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004082a0
jmp case.0x42a57e.2
cmp dword [ebp + 0xc], 1
jne 0x42a68d
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x7a0], 0xffffffdc
cmp dword [ebp + 0xc], 0
je 0x42a699
mov byte [ebp - 0xd], 1
jmp 0x42a69d
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c4]
mov eax, dword [ebp - 0x14]
mov edx, dword [edx]
mov ecx, dword [eax + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
jmp case.0x42a57e.2
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x772]
test edx, edx
je 0x42a6d8
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0047e223
jmp case.0x42a57e.2
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.00407940
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004086f0
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c8]
mov eax, dword [ebp - 0x14]
mov edx, dword [edx]
mov ecx, dword [eax + 0x7c8]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004082a0
jmp case.0x42a57e.2
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42aee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f593e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
mov ecx, 0x534b41
call fcn.004c63e1
mov dword [ebp - 0x14], reloc.WS2_32.dll_accept
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x42af31
mov dword [ebp - 0x14], reloc.WS2_32.dll_bind
mov ecx, dword [ebp + 8]
call fcn.004078b0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x18]
call fcn.004079c0
mov dword [ebp - 4], 2
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00408a20
lea edx, [ebp - 0x1c]
push edx
push 0x20119
push 0
lea ecx, [ebp - 0x18]
call fcn.004086f0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42aff6
mov dword [ebp - 0x14], reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x1c]
push ecx
push 0x20119
push 0
lea ecx, [ebp - 0x18]
call fcn.004086f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42aff6
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004082a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
and eax, 1
je 0x42afdf
and dword [ebp - 0x10], 0xfffffffe
mov ecx, dword [ebp + 8]
call fcn.004082a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004082a0
mov eax, dword [ebp + 8]
jmp 0x42b097
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x104
push 0x208
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.004c9920
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42b04d
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
call fcn.00408610
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004082a0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x42b085
and dword [ebp - 0x10], 0xfffffffe
mov ecx, dword [ebp + 8]
call fcn.004082a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004082a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x42b0b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, 0x534b41
call fcn.004c63e1
push str.https:__www.gptchrome.net_privacy.html
lea ecx, [ebp - 4]
call fcn.004079c0
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004086f0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004082a0
mov esp, ebp
pop ebp
ret
Function at 0x42b100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, 0x534b41
call fcn.004c63e1
push str.https:__www.gptchrome.net_userspe_
lea ecx, [ebp - 4]
call fcn.004079c0
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004086f0
push eax
push 0x4ff300
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004082a0
mov esp, ebp
pop ebp
ret

Function at 0x42b150
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, 0x534b41
call fcn.004c63e1
push str.https:__www.gptchrome.net_license_
lea ecx, [ebp - 4]
call fcn.004079c0
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004086f0
push eax
push 0x4ff2a8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004082a0
mov esp, ebp
pop ebp
ret
Function at 0x42c640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x534e55
call fcn.004c63e1
push 0x5003f0
push 0x81
call fcn.00478fc8
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42c6df
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call fcn.00478fc8
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42c6d5
mov ecx, dword [ebp - 4]
push ecx
call fcn.00478fc8
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x42c6d5
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0047daf8
add esp, 0xc
push 0
push ecx
mov ecx, esp
push str.res.xml
call fcn.0042c540
call fcn.0042c570
mov ecx, eax
call fcn.004843fc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret
Function at 0x42c780
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov ecx, 0x534e55
call fcn.004c63e1
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0xc]
call fcn.004079c0
lea ecx, [ebp - 0x4c]
call fcn.0042a020
call fcn.0042c6f0
movzx ecx, al
test ecx, ecx
je 0x42c7cf
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x4c]
call fcn.0042a220
lea ecx, [ebp - 0xc]
call fcn.004082a0
mov eax, dword [ebp - 0x1c]
jmp 0x42c996
call fcn.0040d2c0
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x10]
call fcn.004079c0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.004183f0
add esp, 8
lea ecx, [ebp - 0x10]
call fcn.004082a0
push str.GCMainWnd
lea ecx, [ebp - 8]
call fcn.004079c0
movzx edx, byte [ebp - 0x4c]
test edx, edx
jne 0x42c821
movzx eax, byte [ebp - 0x45]
test eax, eax
jne 0x42c821
lea ecx, [ebp - 0x4c]
push ecx
call fcn.004186c0
add esp, 4
movzx edx, byte [ebp - 0x4b]
test edx, edx
jne 0x42c873
movzx eax, byte [ebp - 0x4a]
test eax, eax
jne 0x42c873
movzx ecx, byte [ebp - 0x45]
test ecx, ecx
jne 0x42c873
lea edx, [ebp - 0x4c]
push edx
call fcn.00419470
add esp, 4
movzx eax, al
test eax, eax
jne 0x42c873
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 8]
call fcn.004082a0
lea ecx, [ebp - 0x4c]
call fcn.0042a220
lea ecx, [ebp - 0xc]
call fcn.004082a0
mov eax, dword [ebp - 0x20]
jmp 0x42c996
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047d858
add esp, 4
call fcn.0042c640
lea ecx, [ebp - 0x3c]
call fcn.00476e9d
push 2
lea ecx, [ebp - 0x3c]
call fcn.00477170
push 0x7e0
call fcn.004c6436
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42c8bd
lea edx, [ebp - 0x4c]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00429d80
mov dword [ebp - 0x18], eax
jmp 0x42c8c4
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x4a]
test edx, edx
jne 0x42c943
push 0
push 0
push 0
push 0
push 0xfffffc18
push 0
push 0x96ca0000
lea ecx, [ebp - 8]
call fcn.004086f0
push eax
push 0
mov ecx, dword [ebp - 4]
call fcn.0047e249
push 0x6b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
push 1
push 0x80
mov ecx, dword [ebp - 4]
call fcn.00476795
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
call fcn.0047e0f3
push 5
mov ecx, dword [ebp - 4]
call fcn.00476795
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42c96f
mov ecx, dword [ebp - 4]
call fcn.0042adc0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 8]
call fcn.004082a0
lea ecx, [ebp - 0x4c]
call fcn.0042a220
lea ecx, [ebp - 0xc]
call fcn.004082a0
mov eax, dword [ebp - 0x2c]
jmp 0x42c996
call fcn.0047b939
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 8]
call fcn.004082a0
lea ecx, [ebp - 0x4c]
call fcn.0042a220
lea ecx, [ebp - 0xc]
call fcn.004082a0
mov eax, dword [ebp - 0x30]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x434980
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x1505
lea ebx, [esi + eax]
cmp esi, ebx
jae 0x4349b6
mov al, byte [esi]
push eax
call fcn.00442720
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x434998
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x440b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x440b30
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x501bfc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x501c0c
push esi
mov dword [ebp - 8], ebx
call fcn.004dba02
add esp, 8
test eax, eax
je 0x440b7c
test ebx, ebx
je 0x440b6c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x440ba5
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x440ba5
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x440c68
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440bc1
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x530018]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x440c5e
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x440c5e
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440c00
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440c20
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x440c35
mov eax, dword [ebp - 8]
test eax, eax
je 0x440c55
push 8
push 0
push ebx
call eax
jmp 0x440c5c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x53001c]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x440c80
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x530400]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
je 0x440cd9
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x440cc6
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x440cc0
shr eax, 8
cmp al, 2
je 0x440cd9
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c6ee6
mov esp, ebp
pop ebp
ret
push str.iphlpapi.dll
call fcn.00440b10
add esp, 4
mov dword [0x5327d4], eax
test eax, eax
je 0x440d04
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x440d04
mov dword [0x5327d0], eax
push 3
push 2
push 0
push 0
push 6
call fcn.0046e210
add esp, 0x14
test al, al
setne byte [0x533e78]
push 0x533e80
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004c6ee6
mov esp, ebp
pop ebp
ret

Function at 0x443550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44357b
cmp dword [esi + 0x84], 0
je 0x44357b
push 2
push 3
push esi
call fcn.00442ce0
push dword [ebp + 0xc]
call fcn.00442fd0
add esp, 0x10
jmp 0x44358a
push dword [ebp + 0xc]
call fcn.00442fd0
add esp, 4
test esi, esi
je 0x44359e
cmp dword [esi + 0x84], 0
je 0x44359e
push 3
push esi
call fcn.00442d20
add esp, 8
pop esi
pop ebp
ret

Function at 0x443680
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4436c1
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x100], 0
jne 0x4436b1
push 0
call fcn.00443680
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x100], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x100], 2
sete al
pop ebp
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x4436d7
xor al, al
pop esi
pop ebp
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
pop ebp
ret
Function at 0x44e140
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x44e15b
cmp dword [edi], 0
jne 0x44e16d
test esi, esi
je 0x44e164
cmp dword [esi], 0
jne 0x44e16d
test ebx, ebx
je 0x44e1b6
cmp dword [ebx], 0
je 0x44e1b6
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push eax
call fcn.004732e0
add esp, 0xc
test ebx, ebx
je 0x44e188
cmp dword [ebx], 0
jne 0x44e18a
xor ebx, ebx
test esi, esi
je 0x44e193
cmp dword [esi], 0
jne 0x44e195
xor esi, esi
test edi, edi
je 0x44e19e
cmp dword [edi], 0
jne 0x44e1a0
xor edi, edi
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0044e0f0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451010
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00435370
push dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call fcn.0044f980
push dword [ebp + 0xc]
mov edi, eax
call fcn.0044f980
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x451097
lea eax, [ebp - 0x20]
push eax
call fcn.00435370
movups xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.00435420
add esp, 0x20
test edx, edx
ja 0x4510ba
jb 0x451085
cmp eax, 0x3e8
ja 0x4510ba
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x451050
test edi, edi
je 0x4510a4
push edi
call fcn.004cdd14
add esp, 4
test esi, esi
je 0x4510b1
push esi
call fcn.004cdd14
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x4510c7
push edi
call fcn.004cdd14
add esp, 4
test esi, esi
je 0x4510d4
push esi
call fcn.004cdd14
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret