joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor ebx, ebx
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], 0
call fcn.004a8c80
add esp, 0xc
push 5
call fcn.0040e927
pop ecx
call fcn.00473333
test eax, eax
je 0x43544b
mov eax, dword [ebp + 8]
dec eax
je 0x4353a5
dec eax
dec eax
je 0x435320
dec eax
je 0x43544b
dec eax
je 0x43544b
push ebx
push ebx
call fcn.0045ba18
push eax
lea eax, [ebp - 0x110]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.004a8bfe
add esp, 0x14
lea edi, [ebp - 0x110]
call fcn.00419e19
test eax, eax
je 0x4352fe
push 1
call fcn.004760af
test eax, eax
pop ecx
je 0x4352eb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x20001
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
push str._n_n
call fcn.0040e927
mov dword [esp], str._n___Paula_has_left_the_building.__She_is_no_longer_here.
call fcn.0040e927
mov dword [esp], str._n___Please_press_any_key_to_terminate_this_window...
jmp 0x435423
push ebx
push ebx
call fcn.0045ba18
push eax
lea eax, [ebp - 0x110]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.004a8bfe
add esp, 0x14
lea edi, [ebp - 0x110]
call fcn.00419e19
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x3e8
je 0x435378
push 1
call fcn.004760af
test eax, eax
pop ecx
je 0x435365
push edi
call esi
push 0x20001
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
call fcn.0040db3e
push str._n_nPAULA_has_left..._n
call fcn.00410436
pop ecx
push 3
pop ebx
push ebx
push str._rThis_screen_will_terminate_in__d_seconds.
call fcn.00410436
pop ecx
pop ecx
push edi
call esi
dec ebx
test ebx, ebx
jg 0x43538b
jmp 0x43544b
push ebx
push ebx
call fcn.0045ba18
push eax
lea eax, [ebp - 0x110]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.004a8bfe
add esp, 0x14
lea edi, [ebp - 0x110]
call fcn.00419e19
test eax, eax
je 0x4353fa
push 1
call fcn.004760af
test eax, eax
pop ecx
je 0x4353e7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x20001
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
push str._n_n
call fcn.0040e927
mov dword [esp], str._n___Paula_has_left_the_building.__She_is_no_longer_here.
call fcn.0040e927
mov dword [esp], str._n___You_will_have_to_reclick_Paula_to_get_her_to_come_back.
call fcn.0040e927
mov dword [esp], str._n___Press_any_key_to_close_this_window...
call fcn.0040e927
mov dword [esp], str._n_n_n_n
call fcn.0040e927
mov dword [esp], str.Press_any_key_to_exit..._n_n_n_n_n_n_n
call fcn.0040e927
pop ecx
mov eax, 0xea60
call fcn.0041f05b
call fcn.00434ea2
push dword [ebp + 8]
call fcn.004ab697
int3
Function at 0x43c6d6
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp + 0x88], eax
mov eax, dword [ebp + 0x98]
push esi
mov esi, ecx
test esi, esi
push edi
mov dword [ebp - 0x80], eax
jg 0x43c707
mov esi, 0x200
push 1
push 0x1f0
call fcn.004a7b08
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x43c722
xor eax, eax
jmp 0x43c80f
lea eax, [esi + 0xa]
push eax
push 1
call fcn.004a7b08
test eax, eax
pop ecx
pop ecx
mov dword [edi], eax
jne 0x43c73e
push edi
call fcn.004a795c
pop ecx
jmp 0x43c71b
and dword [edi + 4], 0
and dword [edi + 0xc], 0
inc dword [0x5f8098]
mov eax, dword [0x5f8098]
push ebx
mov ebx, dword [0x5f8094]
test ebx, ebx
mov dword [edi + 0x2c], eax
mov dword [edi + 8], esi
jne 0x43c76f
call fcn.0046a3c9
mov ebx, eax
mov dword [0x5f8094], ebx
push edi
call fcn.0046a47b
cmp dword [0x5f8094], 0
pop ecx
jne 0x43c792
push dword [edi]
call fcn.004a795c
push edi
call fcn.004a795c
pop ecx
pop ecx
xor eax, eax
jmp 0x43c80e
lea ebx, [edi + 0x30]
push str..Message.c
push ebx
call fcn.0041c68c
pop ecx
pop ecx
mov esi, str.A_Message_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0041c887
mov eax, 0x7d0
mov ecx, ebx
call fcn.0041c8b0
cmp dword [ebp - 0x80], 0
mov eax, dword [ebp + 0x94]
mov dword [edi + 0x10], eax
je 0x43c805
push 0x103
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.004a8c80
push dword [ebp - 0x80]
mov ecx, 0x104
lea eax, [ebp - 0x7c]
call fcn.00477a48
mov esi, eax
call fcn.00477d45
mov eax, esi
push eax
push 0x16
lea eax, [edi + 0x14]
pop ecx
call fcn.00477a48
add esp, 0x14
mov eax, edi
call fcn.0043d3fb
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x88]
pop edi
xor ecx, ebp
pop esi
call fcn.004a8565
add ebp, 0x8c
leave
ret

Function at 0x43cfde
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x43d048
cmp byte [ebx], 0
je 0x43d048
mov eax, esi
call fcn.0043c8ed
test eax, eax
je 0x43d048
mov eax, esi
call fcn.0043d3e5
test eax, eax
je 0x43d048
cmp dword [ebp + 8], edi
mov dword [ebp - 4], 1
je 0x43d04e
xor ecx, ecx
mov edx, ebx
call fcn.0041a3e7
test eax, eax
jbe 0x43d023
mov dword [ebp - 4], edi
push 0x4ad
mov edx, 0x4cc810
push str..Message.c
mov ecx, ebx
call fcn.0041bb64
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
jne 0x43d05a
mov eax, esi
call fcn.0043d3fb
xor eax, eax
pop edi
pop ebx
leave
ret
push 0x4b2
mov edx, 0x4c9fe4
jmp 0x43d02d
cmp dword [esi + 4], edi
jle 0x43d0a7
cmp dword [ebp + 8], edi
je 0x43d076
cmp dword [ebp - 4], edi
jne 0x43d076
push ebx
push 0xa
call fcn.004a8abf
pop ecx
xor edi, edi
pop ecx
inc edi
push ebx
push dword [esi + 4]
push 1
push dword [esi]
call fcn.004a7ca6
add edi, eax
add esp, 0x10
cmp edi, dword [esi + 4]
jge 0x43d0a7
mov eax, dword [esi]
call fcn.00477a38
test eax, eax
jne 0x43d0a7
inc dword [0x5f809c]
mov ecx, ebx
call fcn.0041bf91
jmp 0x43d041
mov ecx, ebx
call fcn.0041bf91
mov eax, esi
call fcn.0043d3fb
xor eax, eax
inc eax
jmp 0x43d04a
Function at 0x43e670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
cmp dword [0x5fbc34], esi
push edi
jne 0x43e79f
push 0x103
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.004a8c80
add esp, 0xc
push str.FtpMode.dat
push esi
push esi
call fcn.0045bc06
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x110]
push 0x4c8500
push eax
call fcn.004a8bfe
push 0x672
mov ebx, str..Network.c
mov esi, 0x4c722c
push ebx
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.0041bb64
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x43e743
lea edi, [ebp - 0x110]
call fcn.00419e19
test eax, eax
je 0x43e79f
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x677
push ebx
mov edx, esi
mov ecx, edi
call fcn.0041bb64
test eax, eax
pop ecx
pop ecx
jne 0x43e79f
cmp dword [0x5fbd3c], eax
jne 0x43e79f
mov dword [0x5fbd3c], 1
jmp 0x43e79f
push edi
push 1
lea eax, [ebp - 0x114]
push 4
push eax
mov dword [ebp - 0x114], 0xfffe4df9
call fcn.004a8fc5
add esp, 0x10
cmp eax, 1
mov ecx, edi
jae 0x43e76f
call fcn.0041bf91
jmp 0x43e79f
call fcn.0041bf91
mov eax, dword [ebp - 0x114]
lea ecx, [eax + 3]
cmp ecx, 6
ja 0x43e79f
test eax, eax
je 0x43e79f
jle 0x43e791
and dword [0x5f8b54], 0
jmp 0x43e79f
test eax, eax
jge 0x43e79f
mov dword [0x5f8b54], 0x8000000
mov ecx, dword [ebp - 4]
mov eax, dword [0x5f8b54]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
Function at 0x43e7b3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x103
lea eax, [ebp - 0x10f]
push edi
push eax
mov dword [ebp - 0x114], edi
mov byte [ebp - 0x110], 0
call fcn.004a8c80
mov ecx, dword [ebp + 8]
mov eax, dword [0x5f8b54]
add esp, 0xc
cmp ecx, 0x8000000
mov dword [ebp - 0x120], eax
je 0x43e80b
cmp ecx, edi
jne 0x43e9b4
push str.FtpMode.dat
push edi
push edi
mov dword [0x5f8b54], ecx
call fcn.0045bc06
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x110]
push 0x4c8500
push eax
call fcn.004a8bfe
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
mov dword [ebp - 0x118], edi
mov ebx, 0x96
jmp 0x43e849
xor edi, edi
push 0x6c5
push str..Network.c
mov edx, 0x4c7478
lea ecx, [ebp - 0x110]
call fcn.0041bb64
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp - 0x11c], eax
jne 0x43e8d5
lea edi, [ebp - 0x110]
call fcn.00419e19
test eax, eax
je 0x43e890
push ebx
call esi
inc dword [ebp - 0x118]
cmp dword [ebp - 0x118], 5
jl 0x43e847
and dword [ebp - 0x118], 0
xor edi, edi
cmp dword [ebp - 0x11c], edi
jne 0x43e8e3
push 0x6da
push str..Network.c
mov edx, 0x4c73d4
lea ecx, [ebp - 0x110]
call fcn.0041bb64
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x11c], eax
jne 0x43e8e1
push ebx
call esi
inc edi
cmp edi, 5
jl 0x43e8a1
jmp 0x43e9ae
mov dword [ebp - 0x118], 1
jmp 0x43e899
xor edi, edi
cmp dword [ebp - 0x118], edi
je 0x43e90f
push dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
push 1
push 4
push eax
call fcn.004a8fc5
add esp, 0x10
cmp eax, 1
jae 0x43e90f
mov dword [ebp - 0x114], edi
push 3
pop eax
push 0xfffffffffffffffd
pop ecx
cmp dword [ebp - 0x114], ecx
jl 0x43e925
cmp dword [ebp - 0x114], eax
jle 0x43e92b
mov dword [ebp - 0x114], edi
cmp dword [ebp + 8], edi
jne 0x43e944
inc dword [ebp - 0x114]
jne 0x43e95c
mov dword [ebp - 0x114], 1
jmp 0x43e95c
cmp dword [ebp + 8], 0x8000000
jne 0x43e95c
dec dword [ebp - 0x114]
jne 0x43e95c
or dword [ebp - 0x114], 0xffffffff
cmp dword [ebp - 0x114], eax
jle 0x43e96c
mov dword [ebp - 0x114], eax
jmp 0x43e97a
cmp dword [ebp - 0x114], ecx
jge 0x43e97a
mov dword [ebp - 0x114], ecx
push edi
push edi
push dword [ebp - 0x11c]
call fcn.004a81cf
add esp, 0xc
push dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
push 1
push 4
push eax
call fcn.004a7ca6
mov ecx, dword [ebp - 0x11c]
add esp, 0x10
call fcn.0041bf91
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
Function at 0x43f7a7
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
xor esi, esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x43f7e5
push 1
push dword [ebp - 4]
call fcn.004a7b08
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
jne 0x43f7da
xor eax, eax
jmp 0x43f836
push edi
lea eax, [ebp - 4]
push eax
push esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, edi
je 0x43f7f6
cmp esi, edi
je 0x43f7d6
push esi
call fcn.004a795c
pop ecx
jmp 0x43f7d6
mov edx, dword [esi]
xor eax, eax
cmp edx, edi
push ebx
jle 0x43f82c
lea ecx, [esi + 4]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x43f80f
cmp dword [ecx + 0x10], ebx
jne 0x43f81b
mov ebx, dword [ecx]
cmp ebx, dword [ebp + 8]
jne 0x43f81b
cmp dword [ecx + 0xc], edi
jne 0x43f825
inc eax
add ecx, 0x38
cmp eax, edx
jl 0x43f802
jmp 0x43f82c
imul eax, eax, 0x38
mov edi, dword [eax + esi + 0x10]
push esi
call fcn.004a795c
pop ecx
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x43f83a
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x2c], bl
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
stosw word es:[edi], ax
mov edx, esi
mov dword [ebp - 0x38], esi
stosb byte es:[edi], al
call fcn.00477a16
test eax, eax
jne 0x43f942
mov al, byte [esi]
cmp al, bl
je 0x43f89c
mov ecx, esi
cmp al, 0x2e
je 0x43f89c
cmp al, 0x3f
je 0x43f93b
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x43f889
mov eax, esi
call fcn.00441f1f
test eax, eax
je 0x43f942
mov eax, str._._._._
call fcn.00441f1f
test eax, eax
je 0x43f942
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
mov dword [ebp - 0x34], ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x43f942
push 1
push dword [ebp - 0x34]
call fcn.004a7b08
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x43f942
push ebx
lea eax, [ebp - 0x34]
push eax
push esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp dword [esi], ebx
mov dword [ebp - 0x30], ebx
jle 0x43f963
lea edi, [esi + 4]
mov ecx, dword [edi]
lea eax, [ebp - 0x18]
call fcn.004425d3
mov ecx, dword [edi + 0xc]
lea eax, [ebp - 0x2c]
call fcn.004425d3
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x18]
call fcn.00441ff7
test eax, eax
je 0x43f95b
lea edx, [ebp - 0x2c]
mov ecx, str._._._._
call fcn.00441ff7
test eax, eax
je 0x43f95b
push edi
call sub.iphlpapi.dll_DeleteIpForwardEntry
test eax, eax
jne 0x43f954
inc dword [ebp - 0x30]
jmp 0x43f95b
mov byte [0x517aaa], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
mov byte [0x517aab], 1
inc ebx
add edi, 0x38
cmp ebx, dword [esi]
jl 0x43f8f7
push esi
call fcn.004a795c
mov eax, dword [ebp - 0x30]
pop ecx
jmp 0x43f945
Function at 0x441d08
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x5025d0]
xor eax, esp
mov dword [esp + 0x198], eax
and word [esp + 4], 0
push edi
push 0x18e
lea eax, [esp + 0xe]
push 0
push eax
call fcn.004a8c80
add esp, 0xc
test esi, esi
je 0x441d80
cmp dword [ebp + 8], 0
jle 0x441d80
lea eax, [esp + 8]
push eax
push 0x101
mov byte [esi], 0
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x441d7c
push dword [ebp + 8]
push esi
call sub.WSOCK32.dll_gethostname
mov edi, eax
call sub.WSOCK32.dll_WSACleanup
test edi, edi
jne 0x441d7c
push esi
call fcn.004a7f30
test eax, eax
pop ecx
ja 0x441d80
xor eax, eax
jmp 0x441d82
mov eax, esi
mov ecx, dword [esp + 0x19c]
pop edi
xor ecx, esp
call fcn.004a8565
mov esp, ebp
pop ebp
ret
Function at 0x4429a5
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x18e
lea eax, [ebp - 0x322]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov word [ebp - 0x324], bx
call fcn.004a8c80
push 0x7f
lea eax, [ebp - 0x8b]
push ebx
push eax
mov byte [ebp - 0x8c], bl
call fcn.004a8c80
push 0x103
lea eax, [ebp - 0x193]
push ebx
push eax
mov byte [ebp - 0x194], bl
call fcn.004a8c80
add esp, 0x24
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x330], ebx
jge 0x442a22
mov dword [ebp + 8], 0x104
cmp edi, ebx
je 0x442b5d
cmp esi, ebx
je 0x442b5d
cmp dword [ebp + 8], ebx
jle 0x442b5d
call fcn.0049a965
push edi
push 0x7e
pop ecx
lea eax, [ebp - 0x8c]
mov byte [esi], bl
call fcn.00477a48
lea eax, [ebp - 0x194]
call fcn.00477999
mov edi, 0x4dbb58
push edi
lea eax, [ebp - 0x330]
lea ecx, [ebp - 0x8c]
call fcn.00479341
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x328], eax
je 0x442a94
push edi
lea eax, [ebp - 0x330]
xor ecx, ecx
call fcn.00479341
pop ecx
mov dword [ebp - 0x328], eax
mov edx, dword [ebp - 0x328]
call fcn.00477a16
test eax, eax
jne 0x442aca
push dword [ebp - 0x328]
mov ecx, 0x104
lea eax, [ebp - 0x194]
call fcn.00477a48
push 0x3a
xor eax, eax
lea edi, [ebp - 0x194]
call fcn.00478799
pop ecx
pop ecx
lea ebx, [ebp - 0x8c]
call fcn.00441d95
test eax, eax
je 0x442b5d
call fcn.004bbf64
test eax, eax
jne 0x442b6e
mov byte [esi], al
lea eax, [ebp - 0x324]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x442b5d
mov ecx, ebx
call fcn.0044262c
push 2
mov dword [ebp - 0x32c], eax
push 4
lea eax, [ebp - 0x32c]
push eax
call sub.WSOCK32.dll_gethostbyaddr
mov edi, eax
test edi, edi
je 0x442b46
mov eax, dword [edi]
test eax, eax
je 0x442b46
push eax
call fcn.004a7f30
test eax, eax
pop ecx
jbe 0x442b46
push dword [edi]
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00477a48
pop ecx
xor edi, edi
jmp 0x442b49
or edi, 0xffffffff
call sub.WSOCK32.dll_WSACleanup
test edi, edi
jne 0x442b5d
push esi
call fcn.004a7f30
test eax, eax
pop ecx
ja 0x442b96
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
cmp eax, 1
jne 0x442b7a
push str.WebSrv22
jmp 0x442b8b
cmp eax, 2
jne 0x442b86
push str.WebSrv21
jmp 0x442b8b
push str.Mission_Control
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00477a48
pop ecx
lea eax, [ebp - 0x194]
push eax
mov eax, dword [ebp + 8]
call fcn.00477b18
pop ecx
call fcn.0049a965
mov eax, esi
jmp 0x442b5f
Function at 0x44448d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and word [ebp - 0x14], 0
and dword [ebp - 4], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x2130
mov esi, str..Network.c
push esi
stosd dword es:[edi], eax
push str.addrchng.flg
push 0
stosw word es:[edi], ax
call fcn.0045bc06
pop ecx
pop ecx
mov edx, 0x4c7368
mov ecx, eax
call fcn.0041bb64
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x444515
push 0x2135
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0049b356
call fcn.0040fd38
push edi
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004a7ca6
push edi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004a7ca6
add esp, 0x2c
mov ecx, edi
call fcn.0041bf91
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x44452f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor esi, esi
mov word [ebp - 0x14], si
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x2152
mov ebx, str..Network.c
push ebx
stosd dword es:[edi], eax
push str.addrchng.flg
push esi
stosw word es:[edi], ax
mov dword [ebp - 4], esi
call fcn.0045bc06
pop ecx
pop ecx
mov edx, 0x4c722c
mov ecx, eax
call fcn.0041bb64
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jne 0x44457e
xor eax, eax
jmp 0x4446be
push edi
push 1
lea eax, [ebp - 4]
push 4
push eax
call fcn.004a8fc5
push edi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004a8fc5
add esp, 0x20
mov ecx, edi
call fcn.0041bf91
call fcn.0040fd38
test eax, eax
jne 0x4445eb
push 0x215b
push ebx
lea esi, [ebp - 0x28]
call fcn.0049b2f2
push ecx
push ecx
mov edi, esp
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0049a0b2
push eax
call fcn.004aa7c7
add esp, 0x24
cmp eax, 0x6ddd000
jle 0x4445eb
call fcn.00444519
push 0x215f
push ebx
lea esi, [ebp - 0x28]
call fcn.0049b2f2
push ecx
push ecx
mov edi, esp
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0049a0b2
push eax
call fcn.004aa7c7
add esp, 0x24
cmp eax, 0x240c8400
jle 0x44462e
call fcn.00444519
jmp 0x444577
call fcn.0040fd38
test eax, eax
je 0x444675
push 0x2165
push ebx
lea esi, [ebp - 0x28]
call fcn.0049b2f2
push ecx
push ecx
mov edi, esp
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0049a0b2
push eax
call fcn.004aa7c7
xor ecx, ecx
add esp, 0x24
cmp eax, 0x5cb2780
setle cl
jmp 0x4446bc
cmp dword [ebp - 4], 0
je 0x444680
xor eax, eax
inc eax
jmp 0x4446be
push 0x216d
push ebx
lea esi, [ebp - 0x28]
call fcn.0049b2f2
push ecx
push ecx
mov edi, esp
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0049a0b2
push eax
call fcn.004aa7c7
xor ecx, ecx
add esp, 0x24
cmp eax, 0x4b87f00
setl cl
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4467d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push 0x31
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x3b]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x248], ebx
mov byte [ebp - 0x3c], bl
call fcn.004a8c80
add esp, 0xc
push 0xff
lea eax, [ebp - 0x13b]
push ebx
push eax
mov byte [ebp - 0x13c], bl
call fcn.004a8c80
add esp, 0xc
push 0x103
lea eax, [ebp - 0x243]
push ebx
push eax
mov byte [ebp - 0x244], bl
call fcn.004a8c80
add esp, 0xc
mov edx, esi
call fcn.00477a16
test eax, eax
je 0x446854
xor eax, eax
jmp 0x4469d2
push esi
lea edi, [ebp - 0x244]
call fcn.00442baf
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
pop ecx
push ebx
mov edi, 0x80000020
push edi
push 1
push ebx
push 7
push 6
lea eax, [ebp - 0x244]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x250], eax
jne 0x4468d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push edi
push 4
push ebx
push 7
push 6
lea eax, [ebp - 0x244]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x250], eax
jne 0x4468d6
call fcn.0049a965
sub eax, dword [0x5fcad0]
cmp eax, 0xea60
ja 0x4468c7
call fcn.0040fd38
test eax, eax
jne 0x44684d
call fcn.0049a965
mov dword [0x5fcad0], eax
jmp 0x44684d
push 0x32
lea eax, [ebp - 0x3c]
call fcn.0043df19
cmp dword [ebp + 8], ebx
pop ecx
je 0x4468f7
push 0x4c7468
push 0x32
pop eax
lea esi, [ebp - 0x3c]
call fcn.00477b18
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x13c]
push str._nLock_was_initiated_by:__s
push eax
call fcn.004a8bfe
add esp, 0xc
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a7f30
mov esi, dword [ebp - 0x250]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
push esi
call edi
test eax, eax
jne 0x446945
inc dword [0x5fcacc]
mov edx, dword [ebp - 0x24c]
call fcn.00477a16
test eax, eax
jne 0x44698e
push dword [ebp - 0x24c]
lea eax, [ebp - 0x13c]
push str._nIn_Source_File:__s
push eax
call fcn.004a8bfe
add esp, 0xc
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a7f30
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
push esi
call edi
cmp dword [ebp + 0x10], ebx
jle 0x4469ca
push dword [ebp + 0x10]
lea eax, [ebp - 0x13c]
push str._nFrom_Source_Line:__d
push eax
call fcn.004a8bfe
add esp, 0xc
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a7f30
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
push esi
call edi
call fcn.0041c426
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret