joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4306d0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43090f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00430428
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405220
je 0x4308d9
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4307f3
mov eax, dword [ebp - 4]
call fcn.004050f8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4308d9
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
mov ecx, 0x430920
mov edx, dword [ebp - 4]
call fcn.00405174
mov eax, dword [ebp - 0x258]
call fcn.004050f8
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4307e0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.004050cc
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
mov edx, dword [ebp - 4]
call fcn.00405174
mov eax, dword [ebp - 0x25c]
call fcn.004050f8
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x43078e
push ebx
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.004050f8
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x4308d9
lea eax, [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00404a20
mov eax, dword [ebp - 0x264]
call fcn.00404c58
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4308d9
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 4]
call fcn.00404a20
lea eax, [ebp - 0x268]
mov edx, 0x430930
call fcn.00404a60
mov eax, dword [ebp - 0x268]
call fcn.00404c58
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4308ba
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00404a20
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x254]
add edx, 0x2c
mov ecx, 0x104
call fcn.00404a08
mov edx, dword [ebp - 0x270]
pop eax
call fcn.00404a60
mov eax, dword [ebp - 0x26c]
call fcn.00404c58
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x430858
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
call fcn.00404a20
mov eax, dword [ebp - 0x274]
call fcn.00404c58
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430916
lea eax, [ebp - 0x274]
mov edx, 5
call fcn.004047ac
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00404f5c
lea eax, [ebp - 4]
call fcn.00404f44
ret
Function at 0x430934
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4309d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x43098d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.004050cc
jmp 0x4309bb
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
call fcn.00404990
mov edx, dword [ebp - 0x214]
mov eax, ebx
call fcn.004050e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4309db
lea eax, [ebp - 0x214]
call fcn.00404788
ret
Function at 0x4309e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x430b8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f44
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x430abc
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.004050f8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x430b71
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004050f8
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x430aae
cmp dword [ebp - 0xc], 0
je 0x430aae
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x430aa8
mov eax, ebx
mov edx, esi
call fcn.0040506c
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x430b71
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404a20
mov eax, dword [ebp - 0x14]
call fcn.00404c58
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x430b71
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404a20
mov eax, dword [ebp - 0x18]
call fcn.00404c58
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x430b68
cmp dword [ebp - 0xc], 0
je 0x430b68
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x430b62
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00404990
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004050e8
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430b93
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004047ac
ret
Function at 0x430b9c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x430cd5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x430c3b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.004050f8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x430cba
mov eax, dword [ebp + 8]
call fcn.00405108
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call fcn.004050f8
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004050f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x430cba
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404a20
mov eax, dword [ebp - 0x14]
call fcn.00404c58
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x430cba
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 8]
call fcn.00404a20
mov eax, dword [ebp - 0x10]
call fcn.00404a58
inc eax
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404c58
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404a20
mov eax, dword [ebp - 0x18]
call fcn.00404c58
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430cdc
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004047ac
ret
Function at 0x430ce8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x430dc9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x430d5b
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.004050f8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x430dae
mov eax, dword [ebp - 4]
call fcn.004050f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x430dae
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00404a20
mov eax, dword [ebp - 0xc]
call fcn.00404c58
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x430dae
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404a20
mov eax, dword [ebp - 0x10]
call fcn.00404c58
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430dd0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004047ac
ret

Function at 0x431218
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040f9f0
test eax, eax
je 0x4312c9
cmp word [eax + 0x18], 0x20b
jne 0x431256
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x431268
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x4312c9
jmp 0x4312c3
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x43127f
push ebp
call fcn.00431060
pop ecx
jmp 0x4312c9
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4312c0
mov ebx, dword [ebp - 4]
add ebx, eax
jmp 0x4312bb
cmp edi, dword [ebx]
jne 0x4312b8
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4312b8
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x43128d
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x43126e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4323b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43253a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404f44
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x43250e
lea eax, [ebp - 4]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x43250e
cmp dword [0x535844], 0
jne 0x432430
push 0x432548
push 0x432560
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535844], eax
cmp dword [0x535844], 0
je 0x432462
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x535844]
test eax, eax
je 0x432462
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004050cc
jmp 0x432494
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x432494
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
call fcn.00404990
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.004050e8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov eax, dword [edi]
xor edx, edx
call fcn.00405220
jne 0x4324c6
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.00430190
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040c11c
mov eax, dword [edi]
xor edx, edx
call fcn.00405220
je 0x43250e
mov eax, dword [edi]
call fcn.00405108
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x43250e
test bl, bl
je 0x4324f9
mov eax, edi
mov edx, 0x432570
call fcn.00405114
jmp 0x43250e
mov eax, dword [edi]
call fcn.00405108
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.004052f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432541
lea eax, [ebp - 0x21c]
call fcn.00404f44
lea eax, [ebp - 0x218]
call fcn.00404788
lea eax, [ebp - 8]
call fcn.00406870
ret

Function at 0x432e5c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x432e76
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x432ed5
mov eax, edi
call fcn.00405108
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x432ed0
mov eax, edi
call fcn.00405108
add eax, eax
add eax, 2
push eax
mov eax, edi
call fcn.004050f8
mov edx, esi
pop ecx
call fcn.00402978
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret
Function at 0x434264
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x434418
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.0043419c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4343f6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x530728], 0
jne 0x4343ca
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.00430e20
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040ab60
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x434434
call fcn.00404aa4
mov eax, dword [ebp - 0x2c]
call fcn.00404c58
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x43433e
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040ab60
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x434434
call fcn.00404aa4
mov eax, dword [ebp - 0x34]
call fcn.00404c58
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x434359
xor esi, esi
push 0
push 0x43444c
push 0x434458
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x4343b9
test bl, bl
je 0x4343a0
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.00408314
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection_1
jmp 0x4343b9
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x4343ca
mov eax, esi
call fcn.0045fab4
mov dword [0x530728], esi
cmp dword [0x530728], 0
je 0x4343e0
mov eax, dword [0x530728]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4343fd
mov eax, dword [ebp - 8]
call fcn.00434250
ret

Function at 0x4383b4
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x530754], 0
jne 0x438447
xor eax, eax
call fcn.0040f214
mov dword [0x530754], eax
cmp dword [0x530754], 0
je 0x438447
mov eax, 0x438218
xor ecx, ecx
xor edx, edx
call fcn.0040f6bc
mov dword [0x530758], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x530768], eax
push 0x53074c
push 4
push 0
push 0x438260
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x530750], eax
cmp dword [0x530750], 0
je 0x438447
mov edx, 0x43844c
mov eax, dword [0x53074c]
call fcn.00431814
push 2
mov eax, dword [0x530750]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x530750]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x438488
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x530754], 0
je 0x438559
mov ebx, dword [0x530768]
xor eax, eax
mov dword [0x530768], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x530764], 0
je 0x4384d1
mov ebx, dword [0x530764]
xor eax, eax
mov dword [0x530764], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x530760], 0xffffffff
mov eax, 0x438218
xor ecx, ecx
xor edx, edx
call fcn.0040f8c4
push 0x1f4
mov eax, dword [0x530750]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43851e
push 0
mov eax, dword [0x530750]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x53076c], 0
je 0x43851e
mov eax, dword [0x53076c]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
mov dword [0x53076c], eax
mov eax, dword [0x530750]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x53074c]
call fcn.00431580
xor eax, eax
mov dword [0x530750], eax
xor eax, eax
mov dword [0x53074c], eax
xor eax, eax
mov dword [0x530754], eax
pop ebx
ret
Function at 0x43fd18
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00404c58
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43fd44
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x43fd44
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4417cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x52fe4c], 0
je 0x4417f2
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00441764
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.0042f2f0
test al, al
jne 0x441872
cmp esi, 0x80090318
jne 0x44187a
test edi, edi
je 0x44187a
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4418aa
cmp dword [ebp - 0x24], 0
je 0x4418aa
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4418a0
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4418be
cmp dword [ebp - 0x18], 0
je 0x4418be
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4418cc
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor ebp, ebp
test edi, edi
je 0x441942
mov dword [esp + 0x30], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x34], eax
mov eax, dword [0x52fe68]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x3c]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x441a6e
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x441a6e
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x138], eax
xor eax, eax
mov dword [esp + 0x13c], eax
lea eax, [esp + 0x138]
push eax
push 1
mov dword [esp + 0x148], esi
xor eax, eax
mov dword [esp + 0x14c], eax
lea eax, [esp + 0x148]
push eax
push 1
mov dword [esp + 0x158], 2
xor eax, eax
mov dword [esp + 0x15c], eax
lea eax, [esp + 0x158]
push eax
push 1
lea ecx, [esp + 0x34]
lea edx, [esp + 0x28]
mov eax, ebx
call fcn.00441764
push 0
push ebp
lea eax, [esp + 0x14]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.004417cc
sub eax, 0x80090318
je 0x441a66
sub eax, 0x7ff6fce8
je 0x4419e8
sub eax, 0x90312
je 0x441a2d
sub eax, 0xe
je 0x441a59
jmp 0x441a6e
cmp dword [esp + 0x28], 5
jne 0x441a27
mov eax, dword [esp + 0x24]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov edi, eax
mov dword [ebx + 0x84], edi
mov edx, edi
add esi, dword [ebx + 0x78]
mov eax, dword [esp + 0x24]
sub esi, eax
mov ecx, esi
xchg ecx, eax
call fcn.00402978
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x441a6e
cmp dword [esp + 0x28], 5
jne 0x441a52
mov eax, dword [ebx + 0x78]
add esi, eax
mov edx, dword [esp + 0x24]
sub esi, edx
mov ecx, esi
xchg ecx, eax
xchg edx, ecx
call fcn.00402978
mov esi, dword [esp + 0x24]
jmp 0x4418e2
xor esi, esi
jmp 0x4418e2
or ebp, 0x80
xor edi, edi
jmp 0x4418e2
or edi, 0xffffffff
jmp 0x4418e2
mov al, byte [esp]
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret