joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440100
Capabilities:
Create process on windows

Disassembly:
push 1
push 0x4c3120
push 0
push 0x4c3120
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x441000
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4c3de8
push 0x4a2
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x4c3de0]
cmp eax, 1
jne 0x44113f
call fcn.0044d940
test al, al
jne 0x4410e4
push str..onion
push 0x4c3de8
call fcn.00403a10
add esp, 8
test eax, eax
jne 0x4410d8
push str..i2p
push 0x4c3de8
call fcn.00403a10
add esp, 8
test eax, eax
jne 0x4410d8
push 0x4c3de8
mov byte [ebp - 0x88], al
mov word [ebp - 0x87], ax
mov byte [ebp - 0x85], al
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4410a1
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
jmp 0x4410a7
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, dword [0x4c310c]
mov edi, eax
lea eax, [ebp - 0x88]
push eax
push edi
call fcn.004016c0
test edi, edi
je 0x441124
cmp dword [ebp - 0x88], 0xffffffff
je 0x441124
push edi
push 0x4a3
jmp 0x44111d
push 0x4ae0f4
push 0x4a3
jmp 0x44111d
mov ecx, 0x4c3de8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4410f0
sub ecx, edx
je 0x441102
push 0x4c3de8
jmp 0x441107
push 0x4ae0f4
push 0x4a3
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x4ae0f4
push 0x4a4
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [0x4c3118]
call fcn.00403600
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x441113
call fcn.0044d940
test al, al
jne 0x441124
lea eax, [ebp - 0x84]
push eax
call fcn.00450bd0
lea ecx, [ebp - 0x84]
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x441165
sub ecx, edx
je 0x441113
lea eax, [ebp - 0x84]
push eax
jmp 0x441118
Function at 0x441270
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c25c8]
mov dword [ebp - 0x50], 0x43f580
mov dword [ebp - 0x4c], 0x43fbe0
mov dword [ebp - 0x48], 0x43f840
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x4412a9
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x4c25c4]
push 0
mov dword [ebp - 0x5c], 0x6f
mov dword [ebp - 0x58], 0x72
push dword [ebp + eax*4 - 0x50]
mov dword [ebp - 0x54], 0x70
movzx eax, word [ebp + eax*4 - 0x5c]
push esi
push eax
push dword [0x4c512c]
mov dword [0x4c25c8], 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4c25c8], eax
lea eax, [ebp - 0x6c]
push eax
push 0x3e9
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x6c]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x64]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x68]
sub eax, edx
mov ecx, dword [ebp - 0x6c]
push 0x14
push eax
mov eax, dword [ebp - 0x64]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [0x4c25c8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 8
push dword [0x4c25c8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00466b60
mov eax, dword [0x4c25c4]
inc eax
push eax
lea eax, [ebp - 0x44]
push str.WASTE_Profile_Setup_Wizard__Step__d_4_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x441860
Capabilities:
Capture microphone audio

Disassembly:
push esi
mov esi, ecx
mov ecx, 1
push 0x30000
push esi
push 0x441b90
lea eax, [esi + 8]
mov word [esi + 0xa], cx
mov word [eax], cx
mov ecx, 0x12
push eax
push 0
lea eax, [esi + 4]
mov dword [esi + 0xc], 0x1f40
push eax
mov dword [esi + 0x14], 0x80001
mov dword [esi + 0x10], 0x1f40
mov word [esi + 0x18], cx
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4418b2
mov dword [esi], 1
pop esi
ret
Function at 0x441a40
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d6ab
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 8], 0
je 0x441b5b
push 0x32
push 0x4c25e4
call fcn.004510e0
add esp, 8
test eax, eax
jne 0x441b5b
lea ecx, [ebp - 0xb0]
call fcn.004265f0
lea eax, [edi + 0x1094]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xb0]
call fcn.00426bc0
lea eax, [edi + 0x10ec]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00426b90
push dword [esi + 4]
lea ecx, [ebp - 0xb0]
push dword [esi]
call fcn.00426cb0
push 0x34
lea eax, [ebp - 0xe4]
push 0
push eax
call fcn.00466b60
add esp, 0xc
lea ecx, [ebp - 0xb0]
call fcn.00426860
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xd0], 0x30
test eax, eax
je 0x441b2a
mov ecx, eax
call fcn.004471d0
mov ecx, dword [0x4c3114]
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00425050
test dword [esi + 0x10], 1
je 0x441b50
push dword [esi + 8]
push dword [esi]
push dword [edi + 0x1020]
call dword [sym.imp.WINMM.dll_mmioWrite]
push 0x20
push esi
push dword [edi + 4]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
lea ecx, [ebp - 0xb0]
call fcn.00426850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret 4
Function at 0x441ee0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 0x154], 0
lea eax, [ecx + 0x14]
push 0x140
push 0
push eax
mov dword [ecx + 0x15c], 0
mov dword [ecx + 0x158], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
call fcn.00466b60
add esp, 0xc
ret
Function at 0x4439c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4c3118]
push 1
push str.db_save
call fcn.004038d0
test eax, eax
je 0x443a34
mov eax, dword [0x4c3104]
test eax, eax
je 0x443a34
cmp eax, dword [0x4c3108]
je 0x443a34
push 0x4c3520
lea eax, [ebp - 0x40c]
push str._s.pr2
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x4c3104]
lea eax, [ebp - 0x40c]
add esp, 0xc
push eax
call fcn.00414850
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push 0x4c3520
lea eax, [ebp - 0x40c]
push str._s.pr2
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x446670
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48da7e
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x4c3114]
test ecx, ecx
je 0x4466ac
push 1
call fcn.0041d640
mov ecx, dword [0x4c310c]
test ecx, ecx
je 0x4466bd
push 1
call fcn.0041d4f0
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x1b0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x14
call fcn.0046506d
add esp, 4
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4466fb
push 0x40
mov ecx, eax
call fcn.004015f0
jmp 0x4466fd
xor eax, eax
push 0xd0
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c310c], eax
call fcn.0046506d
add esp, 4
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x446737
push 0x20
push fcn.00442040
mov ecx, eax
call fcn.00424b80
jmp 0x446739
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c3114], eax
call fcn.00444220
call fcn.0044d940
test al, al
jne 0x446772
call fcn.004225c0
test eax, eax
je 0x446772
movzx eax, word [0x4c4e78]
push 1
push eax
call fcn.004225c0
mov ecx, eax
call fcn.00422720
mov ecx, dword [0x4c310c]
lea eax, [ebp - 0x1c]
push eax
push str.localhost
call fcn.004016c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x4467a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4c3118]
push 0x490cb9
push str.downloadpath
call fcn.00403900
cmp byte [eax], 0
jne 0x44685b
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00466b60
push 0x400
lea eax, [ebp - 0x404]
push 0x4c3120
push eax
call fcn.00401ae0
lea ecx, [ebp - 0x404]
add esp, 0x18
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x446804
mov eax, dword [0x4af2ac]
mov dword [ecx], eax
mov eax, dword [0x4af2b0]
mov dword [ecx + 4], eax
mov ax, word [0x4af2b4]
mov word [ecx + 8], ax
lea eax, [ebp - 0x404]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [0x4c3118]
lea eax, [ebp - 0x404]
push eax
push str.downloadpath
call fcn.00403700
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4c3118]
push 0x490cb9
push str.downloadpath
call fcn.00403900
push eax
lea ecx, [ebp - 0x41c]
call fcn.00411fd0
push 0
mov ecx, eax
call fcn.00412940
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x41c]
call fcn.00412060
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x4468b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4c3118]
push 0x490cb9
push str.downloadpath
call fcn.00403900
test eax, eax
je 0x4468fe
cmp byte [eax], 0
je 0x4468fe
mov ecx, dword [ebp + 8]
push 1
test ecx, ecx
je 0x4468ed
push ecx
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret
push eax
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret
Function at 0x44cf60
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dbdb
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x8c]
xor bl, bl
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d08d
lea ecx, [ebp - 0x40]
call fcn.0042c470
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0042c470
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004129b0
push str.WASTE_
lea ecx, [ebp - 0x28]
call fcn.0042e1e0
push 0x4c3d20
lea ecx, [ebp - 0x28]
call fcn.0042e1e0
push 0
lea ecx, [ebp - 0x40]
call fcn.004129b0
lea eax, [ebp - 0x88]
push eax
call fcn.00451220
push str.__profile
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
push eax
call fcn.00451710
push 0x4c3d20
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
call fcn.00451710
add esp, 0x1c
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.0042e160
lea ecx, [ebp - 0x58]
call fcn.00412060
lea ecx, [ebp - 0x70]
call fcn.00412060
lea ecx, [ebp - 0x88]
call fcn.00412060
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00412970
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
lea ecx, [ebp - 0x28]
setne bl
call fcn.00412060
lea ecx, [ebp - 0x40]
call fcn.00412060
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x44d0c0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dc39
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0xa8]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d229
lea ecx, [ebp - 0x40]
call fcn.0042c470
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0042c470
lea ecx, [ebp - 0x58]
call fcn.0042c470
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004129b0
push str.WASTE_
lea ecx, [ebp - 0x28]
call fcn.0042e1e0
push 0x4c3d20
lea ecx, [ebp - 0x28]
call fcn.0042e1e0
push 0
lea ecx, [ebp - 0x40]
call fcn.004129b0
lea eax, [ebp - 0xa0]
push eax
call fcn.00451220
push str.__profile
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 3
push eax
call fcn.00451710
push 0x4c3d20
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 4
push eax
call fcn.00451710
add esp, 0x1c
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.0042e160
lea ecx, [ebp - 0x70]
call fcn.00412060
lea ecx, [ebp - 0x88]
call fcn.00412060
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.00412060
push str.SOFTWAREMICROSOFTWINDOWSCurrentVersionRun
lea ecx, [ebp - 0x58]
call fcn.0042e1e0
push 0x104
lea ecx, [ebp - 0x40]
call fcn.00412970
push eax
push 1
push 0
lea ecx, [ebp - 0x28]
call fcn.00412970
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx ebx, byte [ebp - 0xa1]
test eax, eax
mov ecx, 1
cmove ebx, ecx
lea ecx, [ebp - 0x58]
call fcn.00412060
lea ecx, [ebp - 0x28]
call fcn.00412060
lea ecx, [ebp - 0x40]
call fcn.00412060
jmp 0x44d22f
mov bl, byte [ebp - 0xa1]
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x44d260
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dc97
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x58]
call fcn.0042c470
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0042c470
lea ecx, [ebp - 0x40]
call fcn.0042c470
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004129b0
push str.WASTE_
lea ecx, [ebp - 0x28]
call fcn.0042e1e0
push 0x4c3d20
lea ecx, [ebp - 0x28]
call fcn.0042e1e0
push 0
lea ecx, [ebp - 0x58]
call fcn.004129b0
lea eax, [ebp - 0xa0]
push eax
call fcn.00451220
push str.__profile
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 3
push eax
call fcn.00451710
push 0x4c3d20
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 4
push eax
call fcn.00451710
add esp, 0x1c
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.0042e160
lea ecx, [ebp - 0x70]
call fcn.00412060
lea ecx, [ebp - 0x88]
call fcn.00412060
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.00412060
push str.SOFTWAREMICROSOFTWINDOWSCurrentVersionRun
lea ecx, [ebp - 0x40]
call fcn.0042e1e0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.0042e160
lea eax, [ebp - 0xa4]
push eax
push 2
push 0
push str.SOFTWAREMICROSOFTWINDOWSCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d39c
lea ecx, [ebp - 0x28]
call fcn.00412970
push eax
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x40]
call fcn.00412060
lea ecx, [ebp - 0x28]
call fcn.00412060
lea ecx, [ebp - 0x58]
call fcn.00412060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x44d840
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4c63c0
call fcn.0045e550
add esp, 4
push 0x4c3920
push 0x10
push 0x4c63c4
push str.rngseedn
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
jne 0x44d8bd
push eax
push 0x4514c0
push eax
push 0xfe
push dword [0x4c512c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xorps xmm0, xmm0
mov dword [0x4c6430], 0
movups xmmword [0x4c6414], xmm0
mov dword [0x4c642c], 0
movq qword [0x4c6424], xmm0
jmp 0x44d8d1
mov dword [0x4c63e4], 0
mov dword [0x4c63c0], 0
push 0
push 0
call fcn.0044d660
push 0x4c63c0
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0
xorps xmm0, xmm0
mov dword [ebp - 0xb], 0
push 0x10
push eax
movq qword [ebp - 0x13], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.0045e6c0
add esp, 0x14
lea eax, [ebp - 0x14]
push 0x4c3920
push 0x10
push eax
push str.rngseedn
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x44d9a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa84
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x800
push 0
push eax
call fcn.00466b60
push 0x140
lea eax, [ebp - 0xa84]
push 0
push eax
call fcn.00466b60
push 0x140
lea eax, [ebp - 0x944]
push 0
push eax
call fcn.00466b60
push esi
lea eax, [ebp - 0x804]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x30
lea eax, [ebp - 0xa84]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea eax, [ebp - 0x944]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x944]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x44da4d
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x944]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [ebp - 4]
test eax, eax
pop esi
sete al
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x44e320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [0x4c63f8], ecx
push esi
mov esi, dword [ebp + 8]
sete cl
xor eax, eax
test esi, esi
sete al
cmp ecx, eax
je 0x44e3ff
cmp dword [0x4c63fc], 0
je 0x44e36e
push 0x539
push dword [0x4c5118]
call fcn.0044de40
push dword [0x4c5128]
push dword [0x4c5118]
call fcn.0044dea0
add esp, 0x10
push dword [0x4c5118]
mov dword [0x4c63f8], esi
xor esi, esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x44e398
push esi
push dword [0x4c5118]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, 1
cmp dword [0x4c63f8], 0
push 0xffffffffffffffec
push dword [0x4c5118]
je 0x44e3bb
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffbffff
or eax, 0x80
jmp 0x44e3c6
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xffffff7f
push eax
push 0xffffffffffffffec
push dword [0x4c5118]
call dword [sym.imp.USER32.dll_SetWindowLongA]
test esi, esi
je 0x44e3ff
push 8
push dword [0x4c5118]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x37
push 0
push 0
push 0
push 0
push 0
push dword [0x4c5118]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
pop ebp
ret
Function at 0x44ed60
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1320
call fcn.00465040
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0
push 2
push 2
mov dword [ebp - 0x1318], esi
mov dword [ebp - 0x131c], edi
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov dword [ebp - 0x1320], ebx
cmp ebx, 0xffffffff
jne 0x44eddf
push str.Call_to_socket___failed_with_error__
push 3
lea ecx, [ebp - 0x1305]
call fcn.00407110
push eax
call fcn.0044f120
add esp, 0xc
mov dword [edi], 0
mov dword [esi], 0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130c]
mov dword [ebp - 0x130c], 1
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0
push 0
lea eax, [ebp - 0x1310]
push eax
push 0x1300
lea eax, [ebp - 0x1304]
push eax
push 0
push 0
push 0x4004747f
push ebx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x44ee55
push str.Call_to_WSAIoctl___failed_with_error__
push 3
lea ecx, [ebp - 0x1305]
call fcn.00407110
push eax
call fcn.0044f120
add esp, 0xc
mov dword [edi], 0
mov dword [esi], 0
push ebx
jmp 0x44eedf
mov ebx, dword [ebp - 0x1310]
mov eax, 0xaf286bcb
mul ebx
xor edi, edi
sub ebx, edx
shr ebx, 1
add ebx, edx
shr ebx, 6
mov dword [ebp - 0x1310], ebx
test ebx, ebx
je 0x44eeb7
lea esi, [ebp - 0x1300]
nop dword [eax]
test byte [esi - 4], 1
je 0x44eeaf
cmp word [esi], 2
jne 0x44eeaf
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 4]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x130c], eax
mov dword [ebp - 0x1314], ecx
call fcn.0044ec20
add esp, 0xc
test al, al
jne 0x44eebd
inc edi
add esi, 0x4c
cmp edi, ebx
jb 0x44ee80
xor ecx, ecx
xor eax, eax
jmp 0x44eec9
mov eax, dword [ebp - 0x130c]
mov ecx, dword [ebp - 0x1314]
mov edx, dword [ebp - 0x1318]
push dword [ebp - 0x1320]
mov dword [edx], eax
mov eax, dword [ebp - 0x131c]
mov dword [eax], ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464e2f
mov esp, ebp
pop ebp
ret