joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444090
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x27c], ecx
mov word [ebp - 0x278], 0
push 0x206
push 0
lea eax, [ebp - 0x276]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x68]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], 0x44
push 0x10
push 0
lea edx, [ebp - 0x18]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 2
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
call fcn.0044d7e0
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x444123
jmp 0x44428c
push 0x104
lea ecx, [ebp - 0x278]
push ecx
call fcn.0044fa90
add esp, 8
test eax, eax
je 0x444155
push str.MakeDisc.exe
push 0x104
lea edx, [ebp - 0x278]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
mov dword [ebp - 4], 3
lea eax, [ebp - 0x278]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
jne 0x44419e
push 0x7a7
push 0x4711cc
call fcn.00443640
add esp, 8
push eax
push 0x4711e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44428c
lea ecx, [ebp - 0x278]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x4441ed
push 0x7a8
push 0x4711ec
call fcn.00443640
add esp, 8
push eax
push 0x471200
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44428c
push str._createiso
push 0x104
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x278]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x44425e
push 0x7b5
push 0x47124c
call fcn.00443640
add esp, 8
push eax
push 0x471260
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44428c
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x6c]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x447080
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x238], ecx
mov word [ebp - 0x230], 0
push 0x206
push 0
lea eax, [ebp - 0x22e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x238]
add ecx, 0xc
push ecx
push 0x208
lea edx, [ebp - 0x230]
push edx
push 0x4727b0
push 0x4727b4
push 0x4727c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [ebp + 0xc], 0
je 0x4470fd
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy]
add esp, 8
mov word [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1e], edx
mov dword [ebp - 0x1a], edx
mov dword [ebp - 0x16], edx
mov dword [ebp - 0x12], edx
mov dword [ebp - 0xe], edx
mov word [ebp - 0xa], dx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x234], 0
jmp 0x44714d
mov ecx, dword [ebp - 0x234]
add ecx, 1
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x234]
cmp edx, dword [ebp - 0x24]
jge 0x44719f
mov eax, dword [ebp - 0x234]
movzx ecx, word [ebp + eax*2 - 0x230]
cmp ecx, 0x30
jl 0x44719d
mov edx, dword [ebp - 0x234]
movzx eax, word [ebp + edx*2 - 0x230]
cmp eax, 0x39
jg 0x44719d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x234]
mov ax, word [ebp + edx*2 - 0x230]
mov word [ebp + ecx*2 - 0x20], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x44713e
push 0x4727d8
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4471c7
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 8

Function at 0x4471e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x214]
add ecx, 0xc
push ecx
push 0x208
lea edx, [ebp - 0x210]
push edx
push 0x47277c
push 0x472780
push 0x472798
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4727ac
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x447271
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR80.dll__wtoi]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 4
Function at 0x447290
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp + 8], 0
je 0x44730f
push 0x4726bc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x44730f
mov word [ebp - 0x48], 0
push 0x3e
push 0
lea ecx, [ebp - 0x46]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x50]
add edx, 0xc
push edx
push 0x40
lea eax, [ebp - 0x48]
push eax
push 0x4726c0
push 0x4726c4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x44730f
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.MSVCR80.dll__wtoi]
add esp, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x447311
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 4

Function at 0x447330
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
cmp dword [ebp + 8], 0
je 0x4473db
push 0x4724a0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4473db
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x114]
add edx, 0xc
push edx
push 0x80
lea eax, [ebp - 0x110]
push eax
push 0x4724a4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
test eax, eax
jle 0x4473db
push 0x80
lea edx, [ebp - 0x110]
push edx
call sub.NTHelp.dll_void___cdecl_Help32::Decrypto_unsigned_char___unsigned_long_int_
add esp, 8
push 0x80
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x110]
push ecx
call sub.NTHelp.dll_void___cdecl_Help32::Chartowchar_char_const___wchar_t___int_
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 8

Function at 0x4473f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
cmp dword [ebp + 8], 0
je 0x44748c
push 0x472494
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x44748c
cmp dword [ebp + 0xc], 0
je 0x44748c
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x214]
add edx, 0xc
push edx
push 0x208
lea eax, [ebp - 0x210]
push eax
push 0x472498
push 0x47249c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x44748c
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy]
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 8
Function at 0x447900
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004646d0
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x200c], ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0x4724b4
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy]
add esp, 8
mov word [ebp - 0x2008], 0
push 0x1ffe
push 0
lea edx, [ebp - 0x2006]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x200c]
add eax, 0xc
push eax
push 0x2000
lea ecx, [ebp - 0x2008]
push ecx
push 0x4724b8
push str.ErrorCode
push 0x4724d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x4479dc
lea edx, [ebp - 0x2008]
push edx
call dword [sym.imp.MSVCR80.dll__wtoi]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x4479dc
push 0x2000
lea eax, [ebp - 0x2008]
push eax
push 0x4724e4
push 0x4724f8
mov ecx, dword [ebp - 0x200c]
call fcn.00447670
test eax, eax
je 0x4479dc
lea ecx, [ebp - 0x2008]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy]
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 8

Function at 0x447bd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x410], ecx
mov word [ebp - 0x408], 0
push 0x3fe
push 0
lea eax, [ebp - 0x406]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.12744288c7a5111ebdc24eb8b8e7caea
mov ecx, dword [ebp + 8]
push ecx
push 0x473b24
push 0x400
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 0x410]
push eax
call fcn.00447b60
add esp, 0x18
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0xffffffff
jne 0x447c60
xor eax, eax
jmp 0x447c7f
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 4
Function at 0x448e60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x664], ecx
mov word [ebp - 0x618], 0
push 0x3fe
push 0
lea eax, [ebp - 0x616]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x660], 0
push 0x40
push 0
lea ecx, [ebp - 0x65c]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x660]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x634], 0x101
mov word [ebp - 0x630], 0
mov dword [ebp - 0x214], 0
push 0x14
mov ecx, dword [ebp - 0x664]
call fcn.00447af0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x200
lea ecx, [ebp - 0x210]
push ecx
push 0
call fcn.0044ecf0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x664]
add eax, 0x1334
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0x473b8c
push 0x400
lea edx, [ebp - 0x618]
push edx
mov eax, dword [ebp - 0x664]
push eax
call fcn.00447b60
add esp, 0x1c
lea ecx, [ebp - 0x618]
push ecx
push 0x473bc8
call fcn.00448130
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x660]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x448fb2
xor eax, eax
jmp 0x448fb7
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 8
Function at 0x44b0e0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 6
push 1
push 2
call sub.WS2_32.dll_socket
pop ebp
ret

Function at 0x44b2a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x19c], 1
mov word [ebp - 0x198], 0
push 0x18e
push 0
lea eax, [ebp - 0x196]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x198]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x19c], eax
jne 0x44b320
push 0xd
push 0x4744a8
call fcn.0044b0f0
add esp, 8
push eax
push 0x4744d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x44bd70
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464d41
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x120], 0
mov eax, dword [0x14a32f4]
and eax, 1
jne 0x44bde9
mov ecx, dword [0x14a32f4]
or ecx, 1
mov dword [0x14a32f4], ecx
mov dword [ebp - 4], 0
push 0x468ebf
mov ecx, 0x14a32d8
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push 0x467f40
call fcn.0043adec
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x14a32d8
call dword [sym.imp.MSVCP80.dll_public:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::empty_void_const]
movzx edx, al
test edx, edx
je 0x44bea7
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x477198
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44be73
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44be73
push 0
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x44be73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_CreateDirectory_by_GetPAAnalyticsPath_____d
call dword [sym.imp.MSVCR80.dll_printf]
add esp, 8
push 0x4771dc
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.MSVCR80.dll_strcat_s]
add esp, 0xc
lea edx, [ebp - 0x11c]
push edx
mov ecx, 0x14a32d8
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
xor eax, eax
jne 0x44bdff
mov ecx, 0x14a32d8
call dword [sym.imp.MSVCP80.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [ebp - 0x120]
or ecx, 1
mov dword [ebp - 0x120], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x44d690
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x1b4], 2
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x1b4]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44d6cc
xor al, al
jmp 0x44d7c9
mov edx, dword [str.www.aomeitech.com]
mov dword [ebp - 0x2c0], edx
mov eax, dword [0x4761a8]
mov dword [ebp - 0x2bc], eax
mov ecx, dword [0x4761ac]
mov dword [ebp - 0x2b8], ecx
mov edx, dword [0x4761b0]
mov dword [ebp - 0x2b4], edx
mov ax, word [0x4761b4]
mov word [ebp - 0x2b0], ax
push 0xf2
push 0
lea ecx, [ebp - 0x2ae]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x2c0]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jne 0x44d741
xor al, al
jmp 0x44d7c9
push 0x10
push 0
lea eax, [ebp - 0x1b0]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x1b0], 2
mov ecx, dword [ebp - 0x1a0]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 0x1ac], ecx
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1ae], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xffffffff
jne 0x44d79e
xor al, al
jmp 0x44d7c9
push 0x10
lea edx, [ebp - 0x1b0]
push edx
mov eax, dword [ebp - 0x19c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
je 0x44d7c7
xor al, al
jmp 0x44d7c9
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret

Function at 0x44d8d0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
pop ebp
ret

Function at 0x44d8f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x198], 0
push 0x18e
push 0
lea eax, [ebp - 0x196]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x198]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44d93c
xor eax, eax
jmp 0x44d941
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x44db40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
call sub.Comn.dll_GetObjectSys
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x40c]
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x44db81
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x44db81
mov byte [ebp + 0xc], 0
mov word [ebp - 0x408], 0
push 0x3fe
push 0
lea edx, [ebp - 0x406]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44dc3e
mov ecx, dword [0x476e68]
mov dword [ebp - 0x434], ecx
mov edx, dword [0x476e6c]
mov dword [ebp - 0x430], edx
mov eax, dword [0x476e70]
mov dword [ebp - 0x42c], eax
mov ecx, dword [0x476e74]
mov dword [ebp - 0x428], ecx
mov dx, word [0x476e78]
mov word [ebp - 0x424], dx
xor eax, eax
mov dword [ebp - 0x422], eax
mov dword [ebp - 0x41e], eax
mov dword [ebp - 0x41a], eax
mov dword [ebp - 0x416], eax
mov dword [ebp - 0x412], eax
mov word [ebp - 0x40e], ax
lea ecx, [ebp - 0x408]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat]
add esp, 8
jmp 0x44dc74
push 0x400
lea ecx, [ebp - 0x408]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x408]
push edx
call fcn.004076b0
add esp, 8
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov word [eax], 0
lea ecx, [ebp - 0x408]
push ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x44e090
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x114], 0xb
mov dword [ebp - 8], 1
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.0044dae0
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0
setne cl
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x44e116
push 0xd12
push 0x476f98
call fcn.0044dfd0
add esp, 8
push eax
push str.pConfigPath_NULL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44e145
mov edx, dword [ebp - 4]
push edx
push 0xb
push 0x476fbc
push 0x476fc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xb
jne 0x44e145
mov dword [ebp - 0x114], 3
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret

Function at 0x44ef60
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x424], 0
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x420]
push edx
push 0
call fcn.0044ecf0
add esp, 0xc
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x44f01b
push 0x4fe
push 0x476298
call fcn.0044dfd0
add esp, 8
push eax
push str.GetModuleDir_NULL__szwDir__MAX_PATH_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44f0a4
lea eax, [ebp - 0x420]
push eax
push str._sVersion.ini
lea ecx, [ebp - 0x210]
push ecx
call fcn.00407740
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x214], ecx
cmp dword [ebp - 0x214], 0
jne 0x44f085
push 0x500
push 0x4762f0
call fcn.0044dfd0
add esp, 8
push eax
push str.GetFileAttributes_szwDoc__INVALID_FILE_ATTRIBUTES
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44f0a4
lea edx, [ebp - 0x210]
push edx
push 0
push 0x476334
push 0x47634c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret