joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d3bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d4c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x10
call fcn.00403dc4
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
sub eax, 0x2e
mov dword [esi + 8], eax
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x42d43a
push 0x410
push esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042d5e4
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042d5e4
mov eax, dword [ebp - 8]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push edi
call sub.user32.dll_DrawTextW
jmp 0x42d48c
push 0x410
push esi
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0042d5e4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0xc]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0042d5e4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push edi
call sub.user32.dll_DrawTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d4ce
lea eax, [ebp - 0x18]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x14]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x42d9a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42da78
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x14], 0
je 0x42da58
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x42da0d
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
inc edx
lea eax, [ebx + 0x50]
call sub.rtl250.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0x50]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
lea eax, [ebx + 0x50]
call sub.rtl250.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
jmp 0x42da58
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
inc edx
lea eax, [ebp - 4]
xor ecx, ecx
call sub.rtl250.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
lea eax, [ebp - 4]
xor ecx, ecx
call sub.rtl250.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
lea eax, [ebx + 0x50]
mov edx, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
mov eax, esi
mov edx, dword [ebx + 0x50]
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42da7f
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x4341c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x434265
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x434219
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call sub.rtl250.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x43424c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
mov edx, dword [ebp - 0x214]
mov eax, ebx
call sub.rtl250.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43426c
lea eax, [ebp - 0x214]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x434440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x434593
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4344e2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x434570
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x434570
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x434570
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
inc eax
push eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x18]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43459a
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x4345a8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x434693
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x43461b
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x434678
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x434678
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0xc]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x434678
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x10]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43469a
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl250.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x434d64
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040e400
test eax, eax
je 0x434e15
cmp word [eax + 0x18], 0x20b
jne 0x434da2
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x434db4
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x434e15
jmp 0x434e0f
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x434dcb
push ebp
call fcn.00434ba4
pop ecx
jmp 0x434e15
cmp dword [esi + 0x10], 0
je 0x434e0c
mov ebx, dword [esi + 0x10]
add ebx, dword [ebp - 4]
jmp 0x434e07
cmp edi, dword [ebx]
jne 0x434e04
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x434e04
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x434dd9
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x434dba
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435ff4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x436177
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x43614b
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x43614b
cmp dword [0x543470], 0
jne 0x436074
push 0x436188
push 0x4361b4
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.004035c4
mov dword [0x543470], eax
cmp dword [0x543470], 0
je 0x4360a6
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x543470]
test eax, eax
je 0x4360a6
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call sub.rtl250.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x4360dd
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4360dd
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
mov edx, dword [ebp - 0x218]
mov eax, edi
call sub.rtl250.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x436109
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.004339d8
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.00409ff4
cmp dword [edi], 0
je 0x43614b
mov eax, dword [edi]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x43614b
test bl, bl
je 0x436136
mov eax, edi
mov edx, 0x4361d8
call sub.rtl250.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x43614b
mov eax, dword [edi]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
mov eax, edi
mov ecx, 1
call sub.rtl250.bpl__System__UStrDelete_qqrr20System_UnicodeStringii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43617e
lea eax, [ebp - 0x21c]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x218]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret
Function at 0x436be4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x436bfe
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x436c5d
mov eax, edi
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x436c58
mov eax, edi
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
add eax, eax
add eax, 2
push eax
mov eax, edi
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edx, esi
pop ecx
call sub.rtl250.bpl__System_Move_qqrpxvpvi
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret
Function at 0x438f88
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x43913c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.00438ebc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43911a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x53ee88], 0
jne 0x4390ee
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.00434768
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.004089b4
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x43915c
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 0x2c]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x439062
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.004089b4
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x43915c
call sub.rtl250.bpl__System__LStrCat3_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__t2
mov eax, dword [ebp - 0x34]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x43907d
xor esi, esi
push 0
push 0x439174
push 0x439180
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4390dd
test bl, bl
je 0x4390c4
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.00403dc4
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x4390dd
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle
test esi, esi
je 0x4390ee
mov eax, esi
call fcn.00471354
mov dword [0x53ee88], esi
cmp dword [0x53ee88], 0
je 0x439104
mov eax, dword [0x53ee88]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439121
mov eax, dword [ebp - 8]
call fcn.00438f74
ret
Function at 0x444028
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x53eeb4], 0
jne 0x4440bb
xor eax, eax
call fcn.0040dba0
mov dword [0x53eeb4], eax
cmp dword [0x53eeb4], 0
je 0x4440bb
mov eax, 0x443e8c
xor ecx, ecx
xor edx, edx
call fcn.0040e0a4
mov dword [0x53eeb8], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x53eec8], eax
push 0x53eeac
push 4
push 0
push 0x443ed4
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x53eeb0], eax
cmp dword [0x53eeb0], 0
je 0x4440bb
mov edx, 0x4440c8
mov eax, dword [0x53eeac]
call fcn.0043536c
push 2
mov eax, dword [0x53eeb0]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x53eeb0]
push eax
call sub.kernel32.dll_ResumeThread
ret

Function at 0x444104
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x53eeb4], 0
je 0x4441d5
mov ebx, dword [0x53eec8]
xor eax, eax
mov dword [0x53eec8], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle
cmp dword [0x53eec4], 0
je 0x44414d
mov ebx, dword [0x53eec4]
xor eax, eax
mov dword [0x53eec4], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle
mov dword [0x53eec0], 0xffffffff
mov eax, 0x443e8c
xor ecx, ecx
xor edx, edx
call fcn.0040e2d0
push 0x1f4
mov eax, dword [0x53eeb0]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x44419a
push 0
mov eax, dword [0x53eeb0]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x53eecc], 0
je 0x44419a
mov eax, dword [0x53eecc]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x53eecc], eax
mov eax, dword [0x53eeb0]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x53eeac]
call fcn.004350e0
xor eax, eax
mov dword [0x53eeb0], eax
xor eax, eax
mov dword [0x53eeac], eax
xor eax, eax
mov dword [0x53eeb4], eax
pop ebx
ret
Function at 0x44c004
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44c030
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x44c030
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x44e4e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x53e570], 0
je 0x44e506
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x44e5c8
push 1
push 0x44e5d0
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0044e474
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.004322c8
test al, al
jne 0x44e570
cmp esi, 0x80090318
jne 0x44e578
test edi, edi
je 0x44e578
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x44e5a8
cmp dword [ebp - 0x24], 0
je 0x44e5a8
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x44e59e
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44e5bc
cmp dword [ebp - 0x18], 0
je 0x44e5bc
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44e5d8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x44e65d
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x53e584]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x44e780
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x44e780
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
push 0x44e790
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0044e474
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.0044e4e0
mov ebp, eax
sub ebp, 0x80090318
je 0x44e778
sub ebp, 0x7ff6fce8
je 0x44e6f5
sub ebp, 0x90312
je 0x44e73d
sub ebp, 0xe
je 0x44e769
jmp 0x44e780
cmp dword [esp + 0x30], 5
jne 0x44e737
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call sub.rtl250.bpl__System_Move_qqrpxvpvi
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x44e780
cmp dword [esp + 0x30], 5
jne 0x44e762
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call sub.rtl250.bpl__System_Move_qqrpxvpvi
mov esi, dword [esp + 0x2c]
jmp 0x44e5f2
xor esi, esi
jmp 0x44e5f2
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x44e5f2
or edi, 0xffffffff
jmp 0x44e5f2
movzx eax, byte [esp]
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret