joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4480c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x44816e
push ebx
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], edi
call dword [0x47103c]
test eax, eax
jne 0x448131
lea ecx, [esp + 0xc]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x28]
push str.SystemRoot
push eax
call dword [0x471038]
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x471040]
mov ebx, dword [0x471314]
push esi
call ebx
test eax, eax
jne 0x448150
push edi
push esi
call dword [0x47116c]
push esi
call ebx
pop edi
pop ebx
pop esi
add esp, 8
ret
cmp edi, 0x7fffffff
ja 0x448164
push str._system32
push edi
push esi
call fcn.00408c90
push esi
call ebx
pop edi
pop ebx
pop esi
add esp, 8
ret
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x448180
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push esi
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
call dword [0x47103c]
test eax, eax
mov esi, dword [esp + 0x10]
jne 0x4481e8
mov ecx, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.CommonFilesDir
push ecx
call dword [0x471038]
mov edx, dword [esp + 4]
push edx
call dword [0x471040]
push esi
call dword [0x471314]
xor eax, eax
pop esi
add esp, 8
ret 8

Function at 0x448200
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov byte [esi], 0
mov dword [esp + 0x24], 0
call dword [0x47103c]
test eax, eax
mov ebp, dword [esp + 0x14]
jne 0x448286
mov eax, dword [esp + 0x10]
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push 0
push str.ProgramFilesDir
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], ebp
call dword [0x471038]
mov ecx, dword [esp + 0x14]
push ecx
mov edi, eax
call dword [0x471040]
test edi, edi
pop edi
jne 0x448286
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448277
sub eax, edx
mov dword [esp + 0x14], eax
jne 0x4482a6
push ebp
push esi
call dword [0x47112c]
cmp ebp, 0x7fffffff
mov byte [esi + 2], 0
ja 0x4482a6
push str.Program_Files
push ebp
push esi
call fcn.00408c90
pop esi
xor eax, eax
pop ebp
pop ecx
ret 8

Function at 0x449820
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x44a480
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x481630]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, ebp
mov dword [esp + 0x124], eax
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x41
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [0x47103c]
mov esi, eax
test esi, esi
jne 0x44a511
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
push str.AppData
push ecx
call dword [0x471038]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [0x471040]
lea eax, [esp + 0x18]
push eax
call dword [0x471314]
xor ecx, ecx
test eax, eax
setg cl
dec ecx
test esi, ecx
mov esi, dword [ebp + 0xc]
je 0x44a56d
push esi
lea edx, [esp + 0x1c]
push edx
call dword [0x47112c]
mov ecx, 0x105
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x44a54b
inc eax
dec ecx
jne 0x44a540
jmp 0x44a56d
test ecx, ecx
je 0x44a56d
mov eax, 0x105
sub eax, ecx
push str.Application_Data
mov ecx, 0x105
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x20]
push edx
call fcn.00408800
mov ecx, 0x105
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x44a581
inc eax
dec ecx
jne 0x44a576
jmp 0x44a5a3
test ecx, ecx
je 0x44a5a3
mov eax, 0x105
sub eax, ecx
push str.MicrosoftInternet_ExplorerQuick_Launch
mov ecx, 0x105
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x20]
push edx
call fcn.00408800
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [0x4712f0]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret

Function at 0x44a5d0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [0x47103c]
test eax, eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
jne 0x44a636
mov eax, dword [esp + 8]
push edi
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
push 0
push str.Common_Programs
push eax
mov dword [esp + 0x28], ebx
call dword [0x471038]
mov ecx, dword [esp + 0xc]
push ecx
mov edi, eax
call dword [0x471040]
test edi, edi
pop edi
jne 0x44a636
cmp byte [esi], 0
jne 0x44a65c
push ebx
push esi
call dword [0x47112c]
test eax, eax
jne 0x44a648
pop esi
pop ebx
add esp, 0xc
ret
cmp ebx, 0x7fffffff
ja 0x44a65c
push str.ProfilesAll_UsersStart_MenuPrograms
push ebx
push esi
call fcn.00408c90
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x44a670
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], eax
call dword [0x47103c]
test eax, eax
mov esi, dword [esp + 0x10]
jne 0x44a6d0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.Common_Programs
push ecx
call dword [0x471038]
mov edx, dword [esp + 0x14]
push edx
call dword [0x471040]
push esi
call dword [0x471314]
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x44a6f0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xa0
mov eax, dword [0x481630]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
mov esi, dword [esp + 0xa8]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x94
call dword [0x471344]
cmp dword [esp + 0x1c], 2
jne 0x44a755
mov ecx, dword [esp + 0xac]
push ecx
push esi
call fcn.0044a670
add esp, 8
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0045856e
add esp, 0xa0
ret
lea edx, [esp + 4]
push edx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47103c]
test eax, eax
jne 0x44a7a0
mov edx, dword [esp + 4]
lea eax, [esp + 0xac]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0
push str.Programs
push edx
call dword [0x471038]
mov eax, dword [esp + 4]
push eax
call dword [0x471040]
push esi
call dword [0x471314]
test eax, eax
jne 0x44a7d4
mov ecx, dword [esp + 0xac]
push ecx
push esi
call dword [0x47112c]
mov eax, dword [esp + 0xac]
cmp eax, 0x7fffffff
ja 0x44a7d4
push str.Start_MenuPrograms
push eax
push esi
call fcn.00408c90
mov ecx, dword [esp + 0xa0]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0045856e
add esp, 0xa0
ret
Function at 0x44a7f0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c4
mov eax, dword [0x481630]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x2cc], eax
xor eax, eax
mov byte [esp + 0xb8], 0
mov ecx, 0x41
lea edi, [esp + 0xb9]
rep stosd dword es:[edi], eax
mov byte [esp + 0x1c0], al
mov ecx, 0x41
lea edi, [esp + 0x1c1]
push str.Shell32.dll
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
call dword [0x471334]
mov esi, eax
test esi, esi
je 0x44a90b
mov ebx, dword [0x471338]
push str.SHGetFolderPathA
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov edi, eax
call ebx
test edi, edi
mov dword [esp + 0x10], eax
jne 0x44a8b0
test eax, eax
jne 0x44a8ac
push esi
call dword [0x471330]
push str.SHFolder.dll
call dword [0x471334]
mov esi, eax
test esi, esi
je 0x44a8a8
push str.SHGetFolderPathA
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov edi, eax
call ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test edi, edi
je 0x44a8d6
lea eax, [esp + 0xb8]
push eax
push 0
push 0
push 0x19
push 0
call edi
lea ecx, [esp + 0x1c0]
push ecx
push 0
push 0
push 0x10
push 0
call edi
jmp 0x44a8fc
test eax, eax
je 0x44a8fc
push 0
push 0x19
lea edx, [esp + 0xc0]
push edx
push 0
call eax
push 0
push 0x10
lea eax, [esp + 0x1c8]
push eax
push 0
call dword [esp + 0x20]
test esi, esi
je 0x44a907
push esi
call dword [0x471330]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x94
call dword [0x471344]
cmp dword [esp + 0x30], 2
jne 0x44a96a
mov al, byte [esp + 0xb8]
test al, al
je 0x44a948
mov edx, dword [ebp + 0xc]
push edx
lea eax, [esp + 0xbc]
push eax
push ebx
call dword [0x4712f0]
jmp 0x44aa27
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.0044a5d0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
mov al, byte [esp + 0x1c0]
test al, al
je 0x44a98d
mov edx, dword [ebp + 0xc]
push edx
lea eax, [esp + 0x1c4]
push eax
push ebx
call dword [0x4712f0]
jmp 0x44aa27
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 1
call dword [0x47103c]
test eax, eax
jne 0x44aa06
mov ecx, dword [esp + 0x14]
lea edx, [ebp + 0xc]
push edx
push ebx
lea eax, [esp + 0x24]
push eax
push 0
push str.Desktop
push ecx
call dword [0x471038]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [0x471040]
test esi, esi
jne 0x44aa06
cmp byte [ebx], 0
je 0x44aa06
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push ebx
call dword [0x47112c]
mov eax, dword [ebp + 0xc]
cmp eax, 0x7fffffff
ja 0x44aa27
push 0x475f38
push eax
push ebx
call fcn.00408c90
mov ecx, dword [esp + 0x2cc]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret
Function at 0x44aa90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x481630]
xor eax, ebp
mov dword [esp + 0x11c], eax
push ebx
xor eax, eax
cmp edx, eax
push edi
mov ebx, ecx
je 0x44ab9d
cmp esi, eax
je 0x44ab9d
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push str.SOFTWARERising_s
push eax
mov dword [esp + 0x1c], 1
call dword [0x4713e8]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [0x47103c]
test eax, eax
jne 0x44ab7a
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.datapath
push edx
mov dword [esp + 0x24], ebx
call dword [0x471038]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ab40
sub eax, edx
mov dword [esp + 0x14], eax
je 0x44ab6f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ab54
sub eax, edx
sub ebx, eax
dec ebx
push ebx
push 0x4718c4
push esi
call fcn.0045914f
add esp, 0xc
mov eax, dword [esp + 8]
push eax
call dword [0x471040]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ab80
sub eax, edx
pop edi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret
Function at 0x44bbd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x481630]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x114], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, esi
mov dword [esp + 0xc], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44bc11
sub eax, edx
cmp eax, 0x103
jbe 0x44bc28
push 0x6f
jmp 0x44bcf0
push 0x103
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0045921f
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.004592b2
add esp, 0x14
test eax, eax
je 0x44bcee
lea edx, [esp + 0x10]
push edx
mov byte [eax], 0
call dword [0x471314]
cmp eax, 3
jge 0x44bc72
push 0x4718c4
lea eax, [esp + 0x14]
push eax
call dword [0x471128]
mov edi, dword [0x4713b8]
push ebx
call edi
test eax, eax
jne 0x44bc83
push 2
jmp 0x44bcf0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x44bca1
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0044b5d0
add esp, 8
test eax, eax
jne 0x44bca1
push 0x52
jmp 0x44bcf0
push esi
call edi
test eax, eax
mov ebx, dword [0x4712d4]
je 0x44bcb6
push 0x80
push esi
call ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push esi
push eax
call dword [0x471248]
mov edi, eax
test edi, edi
je 0x44bcd7
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x44bcd7
push eax
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
push 0x57
call dword [0x471260]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret
Function at 0x453010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x481630]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xb4], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [esp + 0x1c], eax
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x94
call dword [0x471344]
test eax, eax
je 0x453128
mov eax, dword [esp + 0x30]
xor edi, edi
cmp eax, edi
je 0x453128
cmp eax, 1
mov eax, str.SystemCurrentControlSetServicesVxDMSTCP
je 0x45307c
mov eax, str.SYSTEMCurrentControlSetServicesTcpipParameters
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
push eax
push 0x80000002
mov dword [esp + 0x28], edi
call dword [0x47103c]
test eax, eax
jne 0x453128
mov edx, dword [esp + 0x14]
mov esi, dword [0x471038]
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push edi
push str.NameServer
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x45311d
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
inc eax
cmp ecx, eax
mov dword [esp + 0x10], eax
jae 0x453105
mov ecx, dword [esp + 0x1c]
push edx
mov dword [ecx], eax
call dword [0x471040]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
push edi
push str.NameServer
push edx
call esi
test eax, eax
je 0x45313f
mov eax, dword [esp + 0x14]
push eax
call dword [0x471040]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
mov cl, byte [ebx]
inc edx
test cl, cl
mov dword [esp + 0x10], edx
mov eax, ebx
je 0x453160
cmp byte [eax], 0x20
jne 0x453158
mov byte [eax], 0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x453150
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov byte [eax + 1], 0
mov eax, dword [esp + 0x14]
push eax
mov dword [ecx], edx
call dword [0x471040]
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret
Function at 0x453a30
Capabilities:
Connect socket
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x128
mov eax, dword [0x481630]
xor eax, esp
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
push 2
mov dword [esp + 0x13c], eax
mov edi, ecx
mov byte [esp + 0x1b], bl
call fcn.0046c93c
mov esi, eax
cmp esi, 0xffffffff
jne 0x453a8d
call fcn.0046c936
push eax
push str.socket___failed___d_n
call fcn.00459e62
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0045856e
add esp, 0x128
ret
push 0x35
mov word [esp + 0x124], 2
call fcn.0046c912
mov word [esp + 0x122], ax
lea eax, [edi + 6]
push eax
call fcn.0046c900
push 0x10
lea ecx, [esp + 0x124]
push ecx
push esi
mov dword [esp + 0x130], eax
call fcn.0046c930
cmp eax, 0xffffffff
jne 0x453aeb
push esi
call fcn.0046c92a
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0045856e
add esp, 0x128
ret
mov dword [esp + 0x10], ebx
nop
mov edx, dword [edi + 0x1c]
mov eax, dword [edi + 0x20]
push ebx
push edx
push eax
push esi
call fcn.0046c924
cmp eax, 0xffffffff
je 0x453b63
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
push ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], ebx
call fcn.0046c91e
cmp eax, 0xffffffff
je 0x453b4b
cmp eax, ebx
je 0x453b4b
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
push ebx
push eax
push ecx
push esi
call fcn.0046c918
cmp eax, 0xffffffff
jne 0x453b5b
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x453af0
jmp 0x453b63
mov dword [edi + 0x24], eax
mov byte [esp + 0xf], 1
push esi
call fcn.0046c92a
mov ecx, dword [esp + 0x130]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045856e
add esp, 0x128
ret

Function at 0x453db0
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
push edi
mov edi, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453dc0
sub eax, edx
cmp eax, 0xf
ja 0x453dd9
push esi
call fcn.0046c900
cmp eax, 0xffffffff
jne 0x453de0
pop edi
xor al, al
pop esi
ret 4
push 0xf
push esi
add edi, 6
push edi
call fcn.00458e00
add esp, 0xc
pop edi
mov al, 1
pop esi
ret 4

Function at 0x453e00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x481630]
xor eax, esp
push esi
mov dword [esp + 0x194], eax
lea eax, [esp + 4]
push eax
push 0x101
mov esi, ecx
call fcn.0046c906
test eax, eax
je 0x453e48
mov dword [esi], 2
xor al, al
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0045856e
add esp, 0x194
ret
xor ecx, ecx
lea edx, [esi + 0x18]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
xor eax, eax
lea ecx, [esi + 0x24]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov ecx, esi
call fcn.00453700
mov ecx, dword [esp + 0x194]
mov dword [esi], 0
pop esi
xor ecx, esp
mov al, 1
call fcn.0045856e
add esp, 0x194
ret
Function at 0x454390
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x481630]
xor eax, ebp
push ebx
mov dword [esp + 0x124], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x1c], eax
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x20], bl
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.WININET.DLL
stosb byte es:[edi], al
call dword [0x4712b0]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x454451
push 0x104
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [0x4712cc]
test eax, eax
jbe 0x454451
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004668e6
mov edi, eax
cmp edi, ebx
jbe 0x454451
push edi
call fcn.004578e2
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push edi
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004668e0
test eax, eax
je 0x454448
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x4718c4
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.004668da
test eax, eax
jne 0x454468
push esi
call fcn.00458775
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push str.MSIE__d._d
push ecx
call dword [0x4713e8]
push esi
call fcn.00458775
mov ecx, dword [esp + 0x140]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret