joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435a50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552c1b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edx, ecx
lea ecx, [ebp - 0x98]
push 0x5a491c
call fcn.00433b00
push esi
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00436ab0
mov eax, dword [ebp - 0x84]
add esp, 8
cmp eax, 0x10
jb 0x435ac3
inc eax
lea ecx, [ebp - 0x98]
push eax
push dword [ebp - 0x98]
call fcn.00427a30
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x5a480c
push str.installDotNetFx40
call fcn.004266c0
push 0x40
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], 0x44
push 0
push eax
call fcn.0052dac0
add esp, 0x18
lea ecx, [ebp - 0x80]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x435b2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x435b48
push 0xffffffffffffffff
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7c]
call esi
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x435b5d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00427a30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
Function at 0x435b80
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552c7d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xf8
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [esi + 0x14], 0x10
jb 0x435bcf
mov eax, dword [esi]
jmp 0x435bd1
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x435be6
mov eax, 0x3ea
jmp 0x435d42
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x3c], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0x10
jb 0x435c1d
mov esi, dword [esi]
lea ecx, [ebp - 0x40]
call fcn.004290f0
push esi
call fcn.00420f70
add esp, 4
mov dword [ebp - 0x40], eax
test eax, eax
je 0x435c3d
lea ecx, [ebp - 0x40]
call fcn.004291b0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
push eax
movq qword [ebp - 0x20], xmm0
call fcn.00436580
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x20]
cmp esi, dword [ebp - 0x1c]
je 0x435cfb
push 0xc0
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.0052dac0
add esp, 0xc
cmp dword [edi + 0x14], 0x10
jb 0x435c86
mov edi, dword [edi]
sub esp, 0xc
lea ecx, [ebp - 0x100]
push edi
call fcn.00436750
mov byte [ebp - 4], 2
cmp dword [esi + 0x14], 0x10
jb 0x435ca3
mov eax, dword [esi]
jmp 0x435ca5
mov eax, esi
push eax
lea ecx, [ebp - 0x40]
call fcn.00429160
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x40]
call fcn.004293d0
lea ecx, [ebp - 0xf0]
call fcn.00429540
lea ecx, [ebp - 0x100]
call fcn.00436660
lea ecx, [ebp - 0x88]
call fcn.004366d0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x88], vtable.std::ios_base.0
call fcn.0052690b
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.004290f0
test esi, esi
je 0x435d38
push dword [ebp - 0x104]
mov edx, dword [ebp - 0x1c]
push ecx
mov ecx, esi
call fcn.00428190
mov ecx, dword [ebp - 0x18]
mov eax, 0x2aaaaaab
sub ecx, esi
add esp, 8
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.00427930
lea ecx, [ebp - 0x40]
call fcn.00429040
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x435dc0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0052dac0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x108]
mov esi, 0xcc
xor ecx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x435e10
sub edx, edi
je 0x435e2f
nop dword [eax + eax]
movsx eax, byte [ebp + ecx - 0x108]
inc ecx
add esi, eax
cmp ecx, edx
jb 0x435e20
push 0xa
lea eax, [ebp - 0x106]
mov word [ebp - 0x108], 0x4343
push eax
push esi
call fcn.0053863a
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
cmp eax, 0xb7
je 0x435e7a
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
push 0
call fcn.00538309
int3
Function at 0x438550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x58]
call fcn.0042b4f0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
push str.flag.txt
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x5c], 0
call fcn.00433b00
add esp, 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
push 0x5a4388
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00531342
add esp, 0xc
cmp dword [ebp - 0x5c], 0
je 0x438629
push 3
push 0x5a4534
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00427720
push dword [ebp - 0x5c]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 1
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0053112f
push dword [ebp - 0x5c]
call fcn.00530e77
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov dword [ebp - 0x5c], 0
cmp eax, 0x10
jb 0x438629
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00427a30
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x43863e
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00427a30
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp eax, 0x10
jb 0x438665
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00427a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
Function at 0x438680
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552f26
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [ebp - 0x410], 0
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
jne 0x4386e6
xor ecx, ecx
jmp 0x4386f9
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4386f0
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.00427720
push 0x18
push str.Microsoft.NETFramework
lea ecx, [ebp - 0x428]
mov dword [ebp - 4], 0
call fcn.00428790
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x428]
mov dword [ebp - 0x42c], 0xf
push eax
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
call fcn.004277e0
cmp dword [ebp - 0x42c], 0x10
lea eax, [ebp - 0x440]
cmovae eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x438781
test al, 0x10
je 0x438781
mov esi, 1
jmp 0x438783
xor esi, esi
mov eax, dword [ebp - 0x42c]
cmp eax, 0x10
jb 0x4387a1
inc eax
lea ecx, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
call fcn.00427a30
test esi, esi
je 0x43882a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x444], esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4387cc
mov eax, dword [ecx]
jmp 0x4387ce
mov eax, ecx
push 4
push str.v4.0
mov byte [eax], 0
call fcn.00427720
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4387fe
mov eax, dword [ecx]
jmp 0x438800
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.004277e0
mov byte [ebp - 4], 0
call fcn.0042e7a0
add esp, 0x30
test eax, eax
je 0x43882a
mov esi, 1
jmp 0x43882c
xor esi, esi
mov ecx, dword [ebp - 0x414]
cmp ecx, 0x10
jb 0x43884a
inc ecx
push ecx
push dword [ebp - 0x428]
lea ecx, [ebp - 0x428]
call fcn.00427a30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
Function at 0x439100
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553038
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push 0
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004277e0
push 2
push 0x5a4cc4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00428790
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x180]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43929c
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word [eax + eax]
mov ecx, 0x5a4490
lea eax, [ebp - 0x154]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4391d0
test dl, dl
je 0x4391cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4391d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4391b0
xor eax, eax
jmp 0x4391d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x439283
mov eax, 0x5a4494
lea ecx, [ebp - 0x154]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x439208
test dl, dl
je 0x439204
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x439208
add ecx, 2
add eax, 2
test dl, dl
jne 0x4391e8
xor eax, eax
jmp 0x43920d
sbb eax, eax
or eax, 1
test eax, eax
je 0x439283
test byte [ebp - 0x180], 0x10
je 0x439283
cmp byte [ebp - 0x154], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x439239
xor ecx, ecx
jmp 0x43924b
lea ecx, [ebp - 0x154]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439242
sub ecx, edx
push ecx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x40]
call fcn.00427720
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.00427110
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x439283
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00427a30
lea eax, [ebp - 0x180]
push eax
push esi
call edi
test eax, eax
jne 0x4391a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4392b1
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00427a30
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
cmp eax, 0x10
jb 0x4392d8
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00427a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
Function at 0x439300
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553080
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0xffffffffffffffff
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
push 0
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004277e0
push 1
push 0x5a4488
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00428790
push 0xffffffffffffffff
push 0
lea ecx, [ebp + 0x20]
push ecx
mov ecx, eax
call fcn.00428880
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x180]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4394ac
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word [eax + eax]
mov ecx, 0x5a4490
lea eax, [ebp - 0x154]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4393e0
test dl, dl
je 0x4393dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4393e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4393c0
xor eax, eax
jmp 0x4393e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x439493
mov eax, 0x5a4494
lea ecx, [ebp - 0x154]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x439418
test dl, dl
je 0x439414
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x439418
add ecx, 2
add eax, 2
test dl, dl
jne 0x4393f8
xor eax, eax
jmp 0x43941d
sbb eax, eax
or eax, 1
test eax, eax
je 0x439493
test byte [ebp - 0x180], 0x10
jne 0x439493
cmp byte [ebp - 0x154], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x439449
xor ecx, ecx
jmp 0x43945b
lea ecx, [ebp - 0x154]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439452
sub ecx, edx
push ecx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x40]
call fcn.00427720
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.00427110
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x439493
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00427a30
lea eax, [ebp - 0x180]
push eax
push esi
call edi
test eax, eax
jne 0x4393b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4394c1
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00427a30
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
cmp eax, 0x10
jb 0x4394e8
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00427a30
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
cmp eax, 0x10
jb 0x43950f
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.00427a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
Function at 0x4396f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553108
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push 0x5a44e8
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call fcn.00531342
push 2
push 0
push dword [ebp - 0x14]
call fcn.00533aaa
push dword [ebp - 0x14]
call fcn.005337ca
mov edi, eax
lea esi, [edi + 1]
push esi
call fcn.0052ae6f
push esi
mov esi, eax
push 0
push esi
call fcn.0052dac0
push 0
push 0
push dword [ebp - 0x14]
call fcn.00533aaa
push dword [ebp - 0x14]
push edi
push 1
push esi
call fcn.00533c91
add esp, 0x48
push dword [ebp - 0x14]
call fcn.00530e77
mov eax, esi
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4397a4
sub eax, edx
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
push eax
mov byte [ebx], cl
mov ecx, ebx
push esi
call fcn.00427720
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x4397db
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00427a30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
Function at 0x448560
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5545c3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x400
lea eax, [ebp - 0x414]
mov dword [ebp - 4], 2
push 0
push eax
call fcn.0052dac0
add esp, 0xc
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0x20], 0x10
lea edx, [ebp + 0x3c]
lea eax, [ebp + 0x24]
cmovae ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x50], 0x10
push ecx
cmovae edx, dword [ebp + 0x3c]
lea ecx, [ebp - 0x414]
cmp dword [ebp + 0x38], 0x10
push 0x400
cmovae eax, dword [ebp + 0x24]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x414]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4485f0
sub ecx, edx
mov byte [ebp - 0x42c], al
push ecx
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], 0xf
push eax
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x41c], 0
call fcn.00427720
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 3
cmp esi, eax
je 0x448640
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004277e0
mov eax, dword [ebp - 0x418]
cmp eax, 0x10
jb 0x44865e
inc eax
lea ecx, [ebp - 0x42c]
push eax
push dword [ebp - 0x42c]
call fcn.00427a30
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x42c], 0
cmp eax, 0x10
jb 0x44868e
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.00427a30
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], 0
mov byte [ebp + 0xc], 0
cmp eax, 0x10
jb 0x4486b5
inc eax
lea ecx, [ebp + 0x24]
push eax
push dword [ebp + 0x24]
call fcn.00427a30
mov eax, dword [ebp + 0x50]
mov dword [ebp + 0x38], 0xf
mov dword [ebp + 0x34], 0
mov byte [ebp + 0x24], 0
cmp eax, 0x10
jb 0x4486dc
inc eax
lea ecx, [ebp + 0x3c]
push eax
push dword [ebp + 0x3c]
call fcn.00427a30
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret 0x4c

Function at 0x448b00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x448b70
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], 0x1003f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x448b67
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x218], 0x448af0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x448b70
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052a949
mov esp, ebp
pop ebp
ret
Function at 0x448fe0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5b4b3c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x449030
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x44902a
shr eax, 8
cmp al, 2
jne 0x44902a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0052a949
mov esp, ebp
pop ebp
ret

Function at 0x44e7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44e7ce
cmp dword [esi + 0x6c], 0
je 0x44e7ce
push 2
push 3
push esi
call fcn.00466480
add esp, 0xc
push dword [ebp + 0xc]
call fcn.0045ca20
add esp, 4
test esi, esi
je 0x44e7ee
cmp dword [esi + 0x6c], 0
je 0x44e7ee
push 3
push esi
call fcn.004664c0
add esp, 8
pop esi
pop ebp
ret
Function at 0x4594c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x1a8]
call fcn.00459840
add esp, 8
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x459544
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x45951c
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0x51
xor eax, eax
pop ebp
ret
push esi
push edi
call fcn.00449130
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.00459120
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x48ac], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x459840
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
shl eax, 4
push edi
mov edx, dword [ebx + ecx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x2b8]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x4598fd
cmp dword [ebx + ecx*4 + 0x1bc], 0x459410
jne 0x4598fd
cmp dword [esi], 0
je 0x45988f
test edi, edi
je 0x4598fd
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.00458a70
add esp, 0x14
cmp eax, 0xffffffff
je 0x4598fd
test al, 1
je 0x4598fd
cmp dword [esi], 0
jne 0x4598e4
mov eax, dword [ebx]
mov eax, dword [eax + 0x4b8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x4598e4
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4598fd
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x459910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1d0]
test eax, eax
je 0x459939
push dword [esi + 0x15c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x45996f
push dword [esi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x557780
push 2
push eax
call fcn.0053112f
push dword [esi + 0x158]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0053112f
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret