joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426a60
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push str.IsAlreadyRun2___In_n
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0xc
push str.Global_mYaOffer
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.IsAlreadyRun2___Out_:_dwErr___d__hMutex__0x_x_n
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x14
cmp dword [ebp - 0xc], 2
je 0x426ae9
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
je 0x426ae9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push eax
push str.IsAlreadyRun2___Out_:_ret__BOOL____d_n
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427170
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484c88
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4a2120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x34]
call fcn.00402e80
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 0
push str.GetUtileCmdLine___In
push 0x80
push 0x4a4ae8
call fcn.00401600
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00403190
mov eax, dword [ebp - 0x14]
push eax
push str.GetUtileCmdLine___:_GetCommandLine_____s
push 0x80
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x42726c
mov eax, dword [ebp - 0x14]
push eax
call fcn.00430fc7
add esp, 4
test eax, eax
je 0x42726c
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
cmp ecx, 0x22
jne 0x427225
mov dword [ebp - 0x7c], 0x489f84
jmp 0x42722c
mov dword [ebp - 0x7c], 0x496fc8
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040e6d0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42726c
mov eax, dword [ebp - 0x38]
push eax
call fcn.00430fc7
add esp, 4
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.004030c0
mov ecx, dword [ebp + 8]
call fcn.00404170
push eax
push str.GetUtileCmdLine___Out__res___s_n
push 0x80
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402f10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043094a
mov esp, ebp
pop ebp
ret
Function at 0x4272c0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x4a2120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
call fcn.00403330
test eax, eax
je 0x427398
mov ecx, dword [ebp + 8]
call fcn.00404170
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427308
mov ecx, dword [ebp + 8]
call fcn.00404170
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004308d0
add esp, 0xc
push 6
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.004308d0
add esp, 0xc
push 0x200
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004308d0
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404170
push eax
call fcn.00431c8a
add esp, 0x14
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00431a4f
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043094a
mov esp, ebp
pop ebp
ret
Function at 0x427970
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c4
mov eax, dword [0x4a2120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push str.RunSetup___In
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.004308d0
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.004308d0
add esp, 0xc
mov dword [ebp - 0x50], 0x44
mov eax, dword [ebp - 0x24]
or eax, 0x100
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 8]
call fcn.00403330
mov esi, eax
mov ecx, dword [ebp + 0xc]
call fcn.00403330
lea eax, [esi + eax + 2]
mov dword [ebp - 0x64], eax
push 8
push 0
lea eax, [ebp - 0x884]
push eax
call fcn.004308d0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
call fcn.00404170
push eax
mov ecx, dword [ebp + 8]
call fcn.00404170
push eax
push str.__s___s
lea eax, [ebp - 0x884]
push eax
call fcn.00426b10
add esp, 0x10
lea eax, [ebp - 0x884]
push eax
push str.RunSetup___:_lpszRunCmd___s
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x884]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404170
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x427a9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push str.RunSetup___:_CreateProcess___err___d
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
jmp 0x427ab1
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
push eax
push str.RunSetup___Out__ret__BOOL____d
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043094a
mov esp, ebp
pop ebp
ret
Function at 0x427f00
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484d68
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4a2120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.00402e80
mov dword [ebp - 4], 0
push str.ProcessSetup___In
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00404170
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x427f73
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00427ae0
add esp, 8
jmp 0x427f7f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402f40
lea ecx, [ebp - 0x2c]
call fcn.00404170
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42804c
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 0xc]
call fcn.00404170
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404170
push eax
push str.ProcessSetup___:_execute__s_with__s
push 0x80
push 0x4a4ae8
call fcn.00401600
add esp, 0x14
push str..msi
lea ecx, [ebp - 0x2c]
call fcn.00404170
push eax
call fcn.0043083d
add esp, 8
test eax, eax
jne 0x42800d
push 5
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00404170
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404170
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov dword [ebp - 0x30], ecx
jmp 0x428020
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00427970
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x42804c
mov ecx, dword [ebp + 0xc]
call fcn.00404170
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404170
push eax
push str.ProcessSetup___:_failed_to_execute__s_with__s
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x14
push str.ProcessSetup___Out
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402f10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043094a
mov esp, ebp
pop ebp
ret
Function at 0x429790
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4851c3
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x4a2120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0
push str.GetPathForADownloadedFile___In
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004308d0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x424]
push eax
call fcn.004308d0
add esp, 0xc
mov ecx, dword [ebp + 0x24]
call fcn.00403190
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
push str.GetPathForADownloadedFile___:_GetTempPath_____s
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
movzx eax, word [ebp - 0x218]
test eax, eax
je 0x42997a
lea eax, [ebp - 0x424]
push eax
push 0
push str.YAOFF
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x424]
push eax
push 0
push 0
lea ecx, [ebp - 0x424]
push ecx
call fcn.00431c8a
add esp, 0x14
push 0x49746c
lea eax, [ebp - 0x218]
push eax
call fcn.0042c120
add esp, 8
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0042c120
add esp, 8
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xb7
je 0x4298f5
cmp dword [ebp - 0x21c], 0
jne 0x42997a
mov eax, dword [0x497058]
push eax
push 0x497054
lea ecx, [ebp + 8]
call fcn.00427420
mov dword [ebp - 0x428], eax
mov eax, dword [0x497058]
push eax
mov ecx, dword [ebp - 0x428]
add ecx, 1
push ecx
lea edx, [ebp - 0x484]
push edx
lea ecx, [ebp + 8]
call fcn.004033b0
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x48c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48c]
call fcn.00404170
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x484]
call fcn.00402f10
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x24]
call fcn.004030c0
mov ecx, dword [ebp + 0x24]
call fcn.00404170
push eax
push str.GetPathForADownloadedFile___Out_:_tszPath___s
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402f10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043094a
mov esp, ebp
pop ebp
ret
Function at 0x42a030
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
push str.File_Check___In
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x42a06d
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call fcn.00403330
test eax, eax
jne 0x42a074
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x42a0c7
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call fcn.00404170
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42a09d
mov dword [ebp - 0x4c], str.exists
jmp 0x42a0a4
mov dword [ebp - 0x4c], str.does_not_exist
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call fcn.00404170
push eax
push str.File_Check___:__s__s
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x14
cmp dword [ebp - 8], 0
je 0x42a155
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x42a155
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x1c
call fcn.00403330
test eax, eax
jbe 0x42a155
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x1c
call fcn.00404170
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call fcn.00404170
push eax
call fcn.004261a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42a11d
mov dword [ebp - 0x4c], str.is_higher_or_same
jmp 0x42a124
mov dword [ebp - 0x4c], str.is_older
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x1c
call fcn.00404170
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
call fcn.00404170
push eax
push str.File_Check___:__s_version__s_than__s
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x18
cmp dword [ebp - 8], 0
je 0x42a164
mov dword [ebp - 0x4c], str.exists
jmp 0x42a16b
mov dword [ebp - 0x4c], str.does_not_exist
mov eax, dword [ebp - 0x4c]
push eax
push str.File_Check___Out:_ret___s
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bd90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48583c
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x4a2120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00402e80
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00402e80
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00402e80
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.0041add0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.0041aea0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00403190
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00403190
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00403190
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x88], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42be80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48583c
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x4a2120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x42bec8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.0041aea0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00403190
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00403190
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00403190
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.00416a00
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00402f10
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00402f10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00402f10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ebda
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4a4e44], 0
push esi
jne 0x42eb4d
call fcn.0042ea73
test eax, eax
je 0x42eb90
mov eax, dword [0x4a4e44]
cmp eax, 1
jne 0x42eb6e
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42eb90
pop esi
ret
push eax
call dword [0x4a4e4c]
test eax, eax
jne 0x42ebd8
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42eb94
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4a4e44]
call dword [0x4a4e4c]
mov edi, eax
test edi, edi
je 0x42ebb9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x42ebd5
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4a4e44]
call dword [0x4a4e48]
add edi, 0x10
cmp edi, esi
jb 0x42ebc1
mov eax, edi
pop edi
pop esi
ret
jmp 0x42eb3a

Function at 0x43094a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a2120]
jne 0x430954
repz ret
jmp fcn.0043a726

Function at 0x43118f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4311c0
call fcn.00433a30
mov dword [eax], esi
call fcn.00433a1d
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00432139
add esp, 0x14
push 0x16
pop eax
jmp 0x431215
test dword [ebp + 0xc], 0xfffffff9
jne 0x43119c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4311ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00433a43
pop ecx
call fcn.00433a1d
mov eax, dword [eax]
jmp 0x431215
test al, 0x10
jne 0x431213
test al, 1
je 0x431213
test byte [ebp + 0xc], 2
je 0x431213
call fcn.00433a30
mov dword [eax], 5
call fcn.00433a1d
mov dword [eax], 0xd
jmp 0x4311e4
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44ae23
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00439fab
and dword [ebp - 4], 0
cmp dword [0x4a5a28], 0
mov ebx, eax
jne 0x44aed4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44af85
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x44af85
push eax
call fcn.00439f39
mov dword [esp], 0x48ded0
push edi
mov dword [0x4a5a28], eax
call esi
push eax
call fcn.00439f39
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a5a2c], eax
call esi
push eax
call fcn.00439f39
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a5a30], eax
call esi
push eax
call fcn.00439f39
pop ecx
mov dword [0x4a5a38], eax
test eax, eax
je 0x44aed4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00439f39
pop ecx
mov dword [0x4a5a34], eax
mov eax, dword [0x4a5a34]
cmp eax, ebx
je 0x44af2c
cmp dword [0x4a5a38], ebx
je 0x44af2c
push eax
call fcn.00439fb4
push dword [0x4a5a38]
mov esi, eax
call fcn.00439fb4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44af2c
test edi, edi
je 0x44af2c
call esi
test eax, eax
je 0x44af23
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44af23
test byte [ebp - 0xc], 1
jne 0x44af2c
or dword [ebp + 0x10], 0x200000
jmp 0x44af65
mov eax, dword [0x4a5a2c]
cmp eax, ebx
je 0x44af65
push eax
call fcn.00439fb4
pop ecx
test eax, eax
je 0x44af65
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44af65
mov eax, dword [0x4a5a30]
cmp eax, ebx
je 0x44af65
push eax
call fcn.00439fb4
pop ecx
test eax, eax
je 0x44af65
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a5a28]
call fcn.00439fb4
pop ecx
test eax, eax
je 0x44af85
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44af87
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44eaf0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4a2120]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x44eb45
mov eax, dword [esp]
cmp al, 2
jne 0x44eb3f
shr eax, 8
cmp al, 2
jne 0x44eb3f
call fcn.0044ff60
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0043094a
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.0043094a
add esp, 0x194
ret
Function at 0x45a6a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x45a6d2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x45a810
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x45a82b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x45a85f
cmp eax, 2
jg 0x45a85f
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x490050]
push 2
push edx
call fcn.0043139d
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.0043139d
add esp, 0x20
xor eax, eax
ret

Function at 0x45ab70
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x154]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x45abed
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x45abc4
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.0044f800
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.0045a9f0
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x85fc], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45c400
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x464], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x45c43e
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0045a960
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x468]
push edx
mov dword [esp + 0xc], 1
call fcn.0045ea10
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x46c]
push eax
call fcn.0045ea10
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x45c4b7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0045a960
add esp, 0x10
add esp, 0x14
ret