joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4305a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44568b
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
test ebx, ebx
push edi
je 0x4306ba
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4306ba
mov eax, dword [ebx]
push 0
push ebx
call dword [eax + 0xfc]
push esi
mov word [esp + 0x1c], 8
call fcn.004429db
test eax, eax
mov dword [esp + 0x20], eax
jne 0x430602
push 0x8007000e
call fcn.0044292e
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
lea edx, [esp + 0x38]
push edx
mov ecx, dword [ebx]
sub esp, 0x10
mov dword [esp + 0x44], 0
mov edx, esp
push ebx
mov dword [edx], edi
mov edi, dword [esp + 0x34]
mov dword [edx + 4], edi
mov dword [edx + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 0xc], eax
call dword [ecx + 0xe8]
test eax, eax
jge 0x430644
push 0x454ae8
push ebx
push eax
call fcn.0044293c
lea ecx, [esp + 0x18]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x34], edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x430660
push eax
call fcn.0044292e
cmp word [esp + 0x38], di
je 0x430771
push 0
push 0x80
push 4
push 0
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
mov dword [esp + 0x10], ebp
cmp ebp, edi
mov dword [esp + 0x30], 1
je 0x4306ba
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea edx, [esi + 1]
push edx
call fcn.0041b540
mov edi, eax
add esp, 4
test edi, edi
jne 0x4306cf
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
lea eax, [esp + 0x38]
push 0
push eax
push esi
push edi
push ebp
mov dword [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ecx
mov byte [edi + esi], 0
mov dword [esp + 0x40], esp
mov dword [esp + 0x40], esp
push 0xc
call fcn.0041b540
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
mov byte [esp + 0x34], 2
je 0x430733
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004429db
test eax, eax
mov dword [esi], eax
jne 0x430735
push 0x8007000e
call fcn.0044292e
jmp 0x430735
xor esi, esi
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x34], 1
test esi, esi
mov dword [ecx], esi
jne 0x43074e
push 0x8007000e
call fcn.0044292e
mov ecx, ebx
call fcn.00430860
push edi
mov esi, eax
call fcn.0041da60
add esp, 4
cmp si, 0xffff
push ebp
jne 0x4306b4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x430950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x445730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi], 0x44cccc
mov dword [esi + 4], 0x44a7f4
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esp + 0x10], esi
mov byte [esi + 0x68], al
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov cl, byte [esp + 0xf]
mov dword [esp + 0x1c], ebx
mov byte [esi + 0x78], cl
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dl, byte [esp + 0xf]
push 0x2c
mov byte [esp + 0x20], 1
mov byte [esi + 0x88], dl
call fcn.0041b540
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], ebx
mov al, byte [esp + 0xf]
mov dl, byte [esp + 0xf]
lea ecx, [esi + 0x94]
mov byte [esp + 0x1c], 2
mov byte [ecx], al
mov byte [ecx + 1], dl
mov byte [ecx + 8], bl
call fcn.00434c40
mov al, byte [esp + 0xf]
push 0x30
mov byte [esp + 0x20], 3
mov byte [esi + 0xa4], al
call fcn.0041b540
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xe0], eax
mov dword [esi + 0xe4], ebx
lea ecx, [esi + 0xe8]
mov byte [esp + 0x1c], 5
call fcn.0042dd60
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0xb0]
push ecx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi], 0x44cca0
mov dword [esi + 4], 0x44cc98
call edi
lea edx, [esi + 0xc8]
push edx
call edi
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x430e60
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
sub esp, 8
fld dword [esi + 0x5c]
fstp qword [esp]
fld dword [esi + 0x58]
sub esp, 8
fstp qword [esp]
push str.By:FWX_DownloadMaxSpeed___f__UploadMaxSpeed___f
call fcn.00430f00
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x38]
push eax
push ecx
push edx
call dword [esi + 0x1c]
mov eax, dword [esi + 0x60]
add esp, 0x20
push eax
push str.By:FWX_MaxPeer___u
call fcn.00430f00
mov ecx, dword [esi + 0x60]
mov edx, dword [esi + 0x38]
push ecx
push edx
call dword [esi + 0x20]
mov eax, dword [esi + 0x64]
add esp, 0x10
push eax
push str.By:FWX_TaskExpSec___u
call fcn.00430f00
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x38]
push ecx
push edx
call dword [esi + 0x24]
push 0
push 0
push esi
push 0x431c20
push 0
push 0
mov dword [esi + 0x54], 1
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x28
mov dword [esi + 0x3c], eax
neg eax
sbb eax, eax
pop esi
and eax, 0x7fffbffb
add eax, 0x80004005
ret
Function at 0x430f10
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push fcn.00431090
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00431090
add esp, 4
test eax, eax
je 0x430f87
lea ecx, [esp + 8]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
push str.P2PCLient.dll
je 0x430f80
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.004325a0
mov dword [esi + 0x11c], eax
jmp 0x430f97
lea ecx, [esp + 0xc]
push ecx
jmp 0x430f91
lea edx, [esp + 8]
push str.P2PCLient.dll
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 8], eax
je 0x431076
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.P2P_Start
push eax
call edi
test eax, eax
mov dword [esi + 0xc], eax
je 0x43106c
mov ecx, dword [esi + 8]
push str.P2P_Download
push ecx
call edi
test eax, eax
mov dword [esi + 0x10], eax
je 0x43106c
mov edx, dword [esi + 8]
push str.P2P_Stop
push edx
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x43106c
mov eax, dword [esi + 8]
push str.P2P_CancelDownload
push eax
call edi
test eax, eax
mov dword [esi + 0x18], eax
je 0x43106c
mov ecx, dword [esi + 8]
push str.P2P_SetSpeedLimit
push ecx
call edi
test eax, eax
mov dword [esi + 0x1c], eax
je 0x43106c
mov edx, dword [esi + 8]
push str.P2P_SetMaxPeerCount
push edx
call edi
test eax, eax
mov dword [esi + 0x20], eax
je 0x43106c
mov eax, dword [esi + 8]
push str.P2P_SetP2PExpired
push eax
call edi
test eax, eax
mov dword [esi + 0x24], eax
je 0x43106c
mov ecx, dword [esi + 8]
push str.P2P_InitLog
push ecx
call edi
test eax, eax
mov dword [esi + 0x28], eax
je 0x43106c
mov edx, dword [esi + 8]
push str.P2P_ClearLog
push edx
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x43106c
mov eax, dword [esi + 8]
push str.P2P_UninitLog
push eax
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x431081
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
Function at 0x4325a0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x1c]
push esi
lea eax, [esp + 4]
push edi
xor esi, esi
push eax
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, esi
je 0x432692
push ebx
push ebp
push edi
mov dword [esp + 0x1c], esi
call fcn.0041b540
add esp, 4
mov ebx, eax
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x2c]
push ebp
push edi
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x453ce0
push ebp
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x14]
push esi
mov ecx, dword [eax + 0x10]
mov dx, word [eax + 0x10]
shr ecx, 0x10
mov word [esp + 0x20], cx
mov ecx, dword [eax + 0x14]
mov word [esp + 0x22], dx
mov dx, word [eax + 0x14]
shr ecx, 0x10
mov word [esp + 0x24], cx
mov word [esp + 0x26], dx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x22]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1e]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x20]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
push str._d._d._d._d
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
mov eax, ebx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret 4
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret 4
Function at 0x433f20
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x433f48
pop esi
ret 4
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x434460
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x4344c1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4344c1
push esi
mov ecx, edi
call fcn.00433f20
mov edi, eax
test edi, edi
je 0x4344c1
push 0x465a30
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4344c1
mov eax, dword [esp + 0x10]
push esi
push edi
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x28]
add esp, 0x14
inc edi
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
ret 0xc
pop edi
mov eax, 0x80004003
pop esi
ret 0xc

Function at 0x4352e0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
cmp word [edi + 0x110], 0
je 0x4352fc
pop edi
pop esi
mov eax, 0x80070057
pop ebx
ret 0x10
lea esi, [edi + 0xe8]
mov ecx, esi
call fcn.0041e990
mov ecx, esi
call fcn.0041e940
test eax, eax
je 0x43531f
pop edi
pop esi
mov eax, 0x80070057
pop ebx
ret 0x10
mov ebx, dword [esp + 0x14]
push 0
push ebx
mov ecx, esi
call fcn.0041e9b0
test eax, eax
jge 0x43539a
mov ecx, esi
call fcn.0041e990
mov ecx, esi
call fcn.0041e940
test eax, eax
je 0x43534e
pop edi
pop esi
mov eax, 0x80070057
pop ebx
ret 0x10
mov ebx, dword [esp + 0x18]
push 0
push ebx
mov ecx, esi
call fcn.0041e9b0
test eax, eax
jge 0x43539a
mov ecx, esi
call fcn.0041e990
mov ecx, esi
call fcn.0041e940
test eax, eax
je 0x43537d
pop edi
pop esi
mov eax, 0x80070057
pop ebx
ret 0x10
mov ebx, dword [esp + 0x1c]
push 0
push ebx
mov ecx, esi
call fcn.0041e9b0
test eax, eax
jge 0x43539a
pop edi
pop esi
mov eax, 0x80070057
pop ebx
ret 0x10
mov eax, dword [edi + 0x118]
mov word [edi + 0x110], bx
test eax, eax
jne 0x4353cd
lea eax, [edi + 0x11c]
push eax
push 0
push edi
push 0x435880
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [edi + 0x118], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x4372c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x445f03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push 1
mov dword [esp + 0xc], esi
call fcn.0042ef20
lea eax, [esi + 0x18]
mov dword [esp + 0x14], 0
push eax
mov dword [esi + 0x14], 0x44a7fc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov cl, byte [esp + 7]
push 0xc
mov byte [esp + 0x18], 1
mov byte [esi + 0x30], cl
call fcn.0041b540
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0
mov dword [esi], 0x44cd08
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x43aae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4461c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov edx, dword [esp + 0x28]
push ebx
xor ebx, ebx
push esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
cmp ecx, eax
push edi
mov dword [esp + 0xc], ebx
jle 0x43ab52
mov esi, dword [esp + 0x30]
mov al, byte [esp + 0x30]
mov edi, 0x46641c
or ecx, 0xffffffff
mov byte [esi], al
xor eax, eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x46641c
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov esi, dword [edx + 0xc]
sub eax, ecx
inc eax
add esi, ecx
mov cl, byte [esp + 0x30]
push ebp
mov ebp, eax
mov byte [esp + 0x14], cl
push 1
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x43aba1
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov esi, dword [esp + 0x34]
mov al, byte [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
mov ecx, esi
push edx
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x18]
pop ebp
cmp ecx, ebx
je 0x43ac06
mov al, byte [ecx - 1]
cmp al, bl
je 0x43abfc
cmp al, 0xff
je 0x43abfc
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.0041da60
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4418c0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4466ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd38
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004303e0
push eax
lea ecx, [esp + 0x24]
call fcn.00428790
xor edi, edi
lea ecx, [esp + 0x20]
mov dword [esp + 0xd50], edi
call fcn.00428a60
mov ebx, eax
mov eax, dword [esp + 0xd58]
cmp ebx, edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
jle 0x441a71
mov ebp, dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esi + 4]
test eax, eax
jne 0x441a71
lea eax, [esp + 0x138]
push edi
push eax
lea ecx, [esp + 0x28]
call fcn.00428a20
lea ecx, [esp + 0x23c]
push 0x104
push ecx
lea edx, [esp + 0x140]
push str.PATH
push edx
lea ecx, [esp + 0x30]
call fcn.00428870
test eax, eax
je 0x441a57
lea eax, [esp + 0x340]
push 0x104
push eax
lea ecx, [esp + 0x140]
push 0x46553c
push ecx
lea ecx, [esp + 0x30]
call fcn.00428870
test eax, eax
je 0x441a68
lea edx, [esp + 0x18]
lea eax, [esp + 0x340]
push edx
push eax
call fcn.0042ecf0
add esp, 8
test al, al
je 0x441a68
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp ecx, eax
ja 0x441a68
jb 0x4419d8
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp edx, eax
ja 0x441a68
lea ecx, [esp + 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x441a68
lea edx, [esp + 0x23c]
lea eax, [esp + 0x444]
push edx
push str._s_DIR_
push 0x104
push eax
call ebp
lea ecx, [esp + 0x454]
push 0
push ecx
call fcn.00427e50
mov eax, dword [esi + 0x14]
add esp, 0x18
test eax, eax
je 0x441a57
lea edx, [esp + 0x548]
push 0x800
push edx
lea eax, [esp + 0x140]
push 0x465534
push eax
lea ecx, [esp + 0x30]
call fcn.00428870
test eax, eax
je 0x441a57
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x548]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
lea eax, [esp + 0x138]
lea ecx, [esp + 0x20]
push eax
call fcn.00428b90
inc edi
cmp edi, ebx
jl 0x441926
lea ecx, [esp + 0x20]
call fcn.00428b20
lea ecx, [esp + 0x20]
mov dword [esp + 0xd50], 0xffffffff
call fcn.004287d0
mov ecx, dword [esp + 0xd48]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xd44
ret 4
Function at 0x441b50
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x441b8b
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x441b86
call fcn.00441da0
test eax, eax
je 0x441b7d
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, esi
call fcn.00441ca0
jmp 0x441b8b
call fcn.00441cd0
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], 0
test eax, eax
je 0x441bab
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
lea eax, [esi + 0x14]
lea ecx, [esi + 4]
push eax
push 0
push ecx
push 0x441b10
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x441bfb
mov eax, dword [esi + 8]
test eax, eax
je 0x441bee
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
pop edi
mov eax, 1
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x442d60
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x442d70
mov eax, 0x80004005
ret 4
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
inc eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
ret 4

Function at 0x442da0
Capabilities:
Resolve dns

Disassembly:
push esi
push edi
mov edi, ecx
mov al, byte [edi + 0xd]
test al, al
je 0x442db5
pop edi
mov eax, 0x80004004
pop esi
ret 4
mov esi, dword [esp + 0xc]
test esi, esi
je 0x442df7
cmp byte [esi], 0
je 0x442df7
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [edi + 8], eax
jne 0x442df0
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x442de6
pop edi
mov eax, 0x80004005
pop esi
ret 4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [edi + 8], edx
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov eax, 0x80070057
pop esi
ret 4
Function at 0x442e10
Capabilities:
Check for time delay via gettickcount
Connect socket
Get socket status

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x224
test eax, eax
push ebx
push esi
push edi
mov esi, ecx
je 0x442e38
cmp byte [eax], 0
je 0x442e38
push eax
mov ecx, esi
call fcn.00442da0
test eax, eax
jne 0x442fea
cmp dword [esi + 4], 0xffffffff
jne 0x442e4d
mov ecx, esi
call fcn.00442c60
test eax, eax
jne 0x442fea
mov al, byte [esi + 0xd]
test al, al
je 0x442e65
pop edi
pop esi
mov eax, 0x80004004
pop ebx
add esp, 0x224
ret 0xc
mov ecx, dword [esp + 0x234]
mov eax, dword [esi + 8]
push ecx
mov dword [esp + 0x20], eax
mov word [esp + 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x442ec1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x442ec1
cmp eax, 0x2734
je 0x442ec1
pop edi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0x224
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
mov al, byte [esi + 0xd]
test al, al
jne 0x442f93
mov edi, dword [sym.imp.WS2_32.dll_select]
mov ebx, 1
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x130]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x134], eax
push edx
push ecx
inc eax
push 0
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc350
call edi
cmp eax, 0xffffffff
je 0x442fde
test eax, eax
je 0x442f5c
mov eax, dword [esi + 4]
lea edx, [esp + 0x28]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x442fa4
mov edx, dword [esi + 4]
lea ecx, [esp + 0x12c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x442eb0
jmp 0x442f67
mov al, byte [esi + 0xd]
test al, al
jne 0x442e54
cmp dword [esp + 0x238], 0xffffffff
je 0x442f88
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x238]
sub eax, edx
cmp ecx, eax
jle 0x442fcd
mov al, byte [esi + 0xd]
test al, al
je 0x442ee1
pop edi
pop esi
mov eax, 0x80004004
pop ebx
add esp, 0x224
ret 0xc
mov al, byte [esi + 0xd]
test al, al
je 0x442fbc
pop edi
pop esi
mov eax, 0x80004004
pop ebx
add esp, 0x224
ret 0xc
mov byte [esi + 0xc], bl
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x224
ret 0xc
pop edi
pop esi
mov eax, 0x8001011f
pop ebx
add esp, 0x224
ret 0xc
mov al, byte [esi + 0xd]
neg al
sbb eax, eax
add eax, 0x80004005
pop edi
pop esi
pop ebx
add esp, 0x224
ret 0xc