joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4501f1
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x450213
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x45020b
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x450230
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x4502a5
inc eax
dec ecx
je 0x450268
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x4502a5
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x45024b
je 0x450268
jb 0x4502a5
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x4502a5
test byte [ebx + 4], 1
je 0x45027b
mov dword [ebx + 0xc], eax
jmp 0x450298
push eax
call fcn.0044fae7
pop ecx
jb 0x4502a7
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.0044fb36
Function at 0x45031b
Capabilities:
Terminate process

Disassembly:
test byte [ebx + 4], 4
jne 0x450326
jmp fcn.004501f1
mov dword ds:[ebp - 0x68], esi
mov dword ds:[ebp - 0x64], edi
pop dword ds:[ebp - 0x6c]
pop eax
pop ax
xor ah, ah
pop cx
cmp cl, byte [ebx + 6]
call fcn.00450442
pop edx
cmp edx, dword [ebx + 0x14]
call fcn.00450442
movzx ecx, ch
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
lea edi, [ebx + esi + 0x10]
pop dword ds:[ebp - 0x60]
push dword [edi]
pop edx
cmp edx, dword [ebx + esi + 0x10]
call fcn.00450442
pop edx
cmp edx, dword [ebx + esi + 0xc]
call fcn.00450442
sub esi, 0xc
jne 0x450360
or ah, ah
jne 0x45042f
cmp cl, byte [ebx + 7]
jne 0x45042f
mov edx, dword ds:[ebp - 0x60]
cmp edx, dword [edi - 4]
jl 0x45042f
mov byte [ebx + 4], al
mov ecx, dword [edi]
sub ecx, edx
jle 0x4503c5
cmp byte [ebx + 7], 1
je 0x4503aa
imul ecx, dword [edi - 8]
push edi
mov al, byte [ebx + 6]
mov esi, ecx
mov edi, dword [ebx]
push dword [ebx + 8]
sub dword [esp], ecx
pop ecx
imul ecx, dword [ebx + 0x14]
add edi, ecx
call fcn.004505ad
pop edi
push dword [ebx + 8]
push dword [ebx + 0xc]
movzx ecx, byte [ebx + 7]
xor esi, esi
mov dword [edi], edx
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
dec ecx
je 0x4503f8
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x4503df
jb 0x450425
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x450425
mov ecx, eax
xchg dword [ebx + 0xc], eax
mov edx, eax
mov eax, dword [ebx]
call fcn.00450447
jb 0x450427
add esp, 8
mov dword [ebx], eax
or byte [ebx + 4], 4
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
notrack jmp dword ds:[ebp - 0x6c]
mov al, 9
pop dword [ebx + 0xc]
pop dword [ebx + 8]
mov dx, 0x9b0
mov al, 9
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
push dword ds:[ebp - 0x6c]
jmp fcn.0044fb36

Function at 0x4504bb
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
call fcn.00457404
jb 0x4504f8
mov al, byte [esi + 0xc]
test al, 0xa
jne 0x4504ec
test al, 1
jne 0x4504d9
test word [esi + 0x2c], 2
jne 0x4504f0
jmp 0x4504ec
push ecx
call fcn.00450e6c
mov ebx, ecx
pop ecx
jb 0x4504fd
or ebx, ebx
je 0x4504f0
cmp al, 0x1a
je 0x4504f0
xor eax, eax
jmp 0x4504f5
mov eax, 0xffffffff
pop ebx
pop esi
ret
mov eax, 0x35
mov edx, eax
pop ebx
pop esi
mov eax, 0xffffffff
jmp fcn.0044fb2b

Function at 0x450535
Capabilities:
Terminate process

Disassembly:
call fcn.00450542
jb 0x45053d
ret
jmp fcn.0044fb36
Function at 0x4506db
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x258
mov edi, eax
call fcn.0044fbfe
mov ebx, eax
lea edx, [ebp - 0x114]
push ebp
mov ebp, dword [ebp]
call fcn.0045c528
pop ebp
or eax, eax
je 0x45080e
xor ecx, ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x450721
push eax
push edx
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0045d694
pop edx
pop eax
mov esi, edx
add esi, eax
mov al, byte [esi - 1]
and edi, 0x9e
test edi, 0x80
je 0x450744
test edi, 0x16
jne 0x450744
xor edi, 0x80
mov dword [ebx + 0x10], edi
test edi, 8
jne 0x450788
cmp al, 0x3a
je 0x450757
cmp al, 0x5c
jne 0x450762
mov word [esi], 0x2e2a
mov word [esi + 2], 0x2a
lea eax, [ebp - 0x258]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
call fcn.0045d694
cmp eax, 0xffffffff
stc
je 0x45083f
mov dword [ebx + 0xc], eax
cmc
jmp 0x45083f
push eax
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
pop eax
cmp word [edx], 0x5c5c
jne 0x4507ac
cmp al, 0x5c
je 0x4507b6
mov word [esi], 0x5c
jmp 0x4507b6
mov byte [edx + 1], 0x3a
mov word [edx + 2], 0x5c
push 0
push 0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
call fcn.0045d694
xor ecx, ecx
xor esi, esi
test eax, eax
je 0x45090b
lea esi, [ebp - 0x22c]
jmp 0x4508de
xor ecx, ecx
test dword [ebx + 0xc], 0xffffffff
je 0x45090b
test dword [ebx + 0x10], 8
jne 0x45090b
lea edx, [ebp - 0x258]
push edx
push dword [ebx + 0xc]
mov edx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
call fcn.0045d694
mov word [ebp - 0x90], 0
lea esi, [ebp - 0x22c]
jae 0x45087a
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
xor ecx, ecx
mov byte [esi], cl
mov dword [ebx + 0x10], ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x450878
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0045d694
jmp 0x4508de
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebx + 0x10]
test ecx, 8
je 0x450894
test eax, 8
je 0x45082a
jmp 0x4508de
and eax, 0x16
je 0x4508ce
test eax, 2
je 0x4508a8
test ecx, 2
je 0x45082a
test eax, 4
je 0x4508bb
test ecx, 4
je 0x45082a
test eax, 0x10
je 0x4508ce
test ecx, 0x10
je 0x45082a
test ecx, 0x80
je 0x4508de
test ecx, eax
je 0x45082a
cld
xor al, al
mov ecx, 0x103
mov edi, esi
repne scasb al, byte es:[edi]
lea ecx, [edi - 1]
sub ecx, esi
mov ax, word [esi]
cmp ax, 0x2e
je 0x45082a
cmp ax, 0x2e2e
jne 0x45090b
cmp ecx, 2
je 0x45082a
push ecx
push esi
cld
mov ecx, 0x140
lea esi, [ebp - 0x258]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x450922
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
push ebp
mov ebp, dword [ebp]
call fcn.0045d17e
pop ebp
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
pop ebx
jb 0x450939
pop eax
ret
mov edx, eax
pop eax
jmp fcn.0044fb2b
Function at 0x450a7d
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov ax, word [ebp - 0x46]
call fcn.00457404
jb 0x450af8
mov al, byte [esi + 0xc]
test al, 0x20
je 0x450af4
mov ecx, edi
call fcn.00457330
jb 0x450afe
push ecx
push edx
push 0
lea edx, [esi + 0x3c]
push edx
push ecx
push edi
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_ReadFile]
call fcn.0045d694
mov al, dl
pop edx
pop ecx
jb 0x450ae7
and word [esi + 0x2c], 0xfffd
mov eax, dword [esi + 0x3c]
cmp eax, ecx
je 0x450ad8
or word [esi + 0x2c], 2
push esi
mov ecx, eax
mov esi, edx
call fcn.004573b2
pop esi
jb 0x450afe
add dword [esi + 0x14], eax
adc dword [esi + 0x18], 0
call fcn.0045d137
pop edi
pop esi
ret
mov esi, edx
call fcn.00457364
jmp 0x450afe
mov al, 0x36
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x3fb0
call fcn.0045d135
pop edi
pop esi
jmp fcn.0044fb36
Function at 0x4516f9
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.00457404
jb 0x451710
call fcn.0045cdae
jb 0x451710
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x4517aa
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0044fbfe
jb 0x4517ba
ret
jmp fcn.0044fb36

Function at 0x4517bf
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call fcn.0044fc37
jb 0x4517ba
ret

Function at 0x451819
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
or ecx, ecx
je 0x4518ef
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x451850
inc ebx
dec ecx
je 0x45186d
cmp byte [ebx], 0x22
jne 0x451842
inc ebx
loop 0x45183c
jmp 0x45186d
cmp al, 0x5c
jne 0x45185d
inc ebx
dec ecx
je 0x45186d
inc ebx
loop 0x45183c
jmp 0x45186d
cmp al, 0x3b
je 0x451866
inc ebx
loop 0x45183c
jmp 0x45186d
push ebx
dec edx
je 0x451871
inc ebx
loop 0x45183c
push ebx
dec edx
jne 0x45186d
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x451891
jne 0x45188d
cmp ecx, edx
je 0x45188d
inc ecx
cmp ecx, edx
je 0x45188d
mov eax, edx
mov esi, ecx
jmp 0x4518a0
mov eax, ebx
jmp 0x4518a0
cmp ebx, ecx
je 0x45188d
inc ebx
cmp ebx, edx
je 0x45188d
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x4518ef
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x4518a9
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.00451917
call fcn.0045d67b
pop ecx
mov esi, esp
push ecx
call fcn.0045d17e
jb 0x4518dd
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0044fb2b
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x4518f4
mov esi, esp
call fcn.0045d367
call fcn.0045d67b
dec edx
cmp byte [esi], 0x20
jne 0x451913
dec edx
inc esi
mov ecx, edx
jmp 0x4518ca

Function at 0x452fc5
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0045738c
jecxz 0x453007
call fcn.00457330
jb 0x453053
cld
test eax, eax
je 0x452ff2
lodsb al, byte [esi]
call fcn.0045311e
stosb byte es:[edi], al
loop 0x452fe5
mov esi, edx
jmp 0x452fff
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00457364
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.0044fb2b
Function at 0x45300c
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0045738c
jecxz 0x45304e
call fcn.00457330
jb 0x453053
cld
test eax, eax
je 0x453039
lodsb al, byte [esi]
call fcn.0045315a
stosb byte es:[edi], al
loop 0x45302c
mov esi, edx
jmp 0x453046
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00457364
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x45305e
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
push ebx
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0045738c
test ecx, ecx
je 0x453112
call fcn.00457330
jb 0x453118
cld
test eax, eax
je 0x4530a8
mov ah, 0xff
lodsb al, byte [esi]
test ah, ah
jne 0x453097
call fcn.0045311e
jmp 0x45309c
call fcn.0045315a
stosb byte es:[edi], al
call fcn.00453196
loop 0x45308b
mov esi, edx
jmp 0x45310a
push edi
push ecx
push edi
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
mov edi, 0xffffffff
test byte [esi], 0xff
mov ebx, 1
je 0x4530cd
push eax
push ecx
push esi
call dword [sym.imp.USER32.DLL_CharNextA]
mov ebx, eax
sub ebx, esi
pop ecx
pop eax
test edi, edi
jne 0x4530dd
push ecx
push ebx
push esi
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop ecx
jmp 0x4530e7
push ecx
push ebx
push esi
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop ecx
push ecx
push 0
push esp
push ebx
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_GetStringTypeA]
pop eax
pop ecx
xor edi, edi
test eax, 0x100
jne 0x453103
dec edi
add esi, ebx
sub ecx, ebx
jg 0x4530b4
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00457364
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
pop ebx
jmp 0x453053
Function at 0x453435
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
call fcn.00457442
jb 0x4534e1
test byte [edi + 0xc], 0x40
je 0x4534e5
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x453475
push 0x40
mov edx, esp
mov eax, dword [edi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x4534d2
test eax, eax
je 0x4534f1
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, 0xffffffff
je 0x4534d2
add esi, eax
sub ebx, eax
jg 0x45347a
and word [edi + 0x2c], 0xfffd
call fcn.0045d67b
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x4534e9
jmp 0x4534ed
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0045d67b
add esp, 0x104
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x453837
Capabilities:
Get hostname

Disassembly:
push esi
push edi
sub esp, 0x100
push 0x100
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.DLL_gethostname]
test eax, eax
je 0x453857
mov byte [esp], 0
lea ecx, [esp - 1]
mov esi, esp
inc ecx
test byte [ecx], 0xff
jne 0x45385d
sub ecx, esi
cmp ecx, 0x100
jb 0x453872
mov ecx, 0x100
call fcn.0045d17e
add esp, 0x100
pop edi
pop esi
ret

Function at 0x4539e5
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push esi
push edi
mov ebx, eax
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WS2_32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x453a3b
cmp cl, 2
jne 0x453a3b
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
push esi
call dword [sym.imp.WS2_32.DLL_gethostbyname]
test eax, eax
je 0x453a3b
mov ecx, dword [eax + 0xc]
jecxz 0x453a3b
mov eax, dword [ecx]
test eax, eax
je 0x453a3b
dec ebx
je 0x453a37
add ecx, 4
jmp 0x453a29
mov eax, dword [eax]
jmp 0x453a3d
xor eax, eax
push eax
call dword [sym.imp.WS2_32.DLL_WSACleanup]
call fcn.0045d67b
pop eax
pop edi
pop esi
ret
Function at 0x453aaf
Capabilities:
Create udp socket
Get hostname
Initialize winsock library
Set socket configuration
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x228
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], 0
xchg ch, cl
mov ebx, ecx
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WS2_32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x453c3d
cmp cl, 2
jne 0x453c3d
mov ax, word [ebp - 0x46]
test ax, ax
js 0x453c39
call fcn.00457442
jae 0x453c35
mov ecx, 0x10044
call fcn.00457330
jb 0x453c3f
mov dword [ebp - 0x64], edx
call fcn.00457480
jb 0x453c3f
cld
xor eax, eax
mov ecx, 0x20
push edi
add edi, 4
rep stosw word es:[edi], ax
pop edi
mov ax, word [ebp - 0x46]
mov ecx, dword [ebp - 0x6c]
mov word [edi + 4], ax
mov word [edi + 0xa], 2
mov word [edi + 0xc], pe_nt_image_headers32
mov word [edi + 0xe], 0xc0
mov dword [edi + 0x1c], 0x10000
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ecx
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.DLL_socket]
cmp eax, 0xffffffff
je 0x453c19
mov dword [edi + 6], eax
push 0x100
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.DLL_gethostname]
test eax, eax
jne 0x453c19
lea eax, [esp + 3]
lea edx, [eax + 1]
inc eax
test byte [eax], 0xff
jne 0x453b95
sub eax, edx
cmp eax, 0x100
jb 0x453ba9
mov eax, 0x100
mov dword [esp], eax
cmp dword [edi + 0x30], 0xffffffff
je 0x453bd4
push 0
push 0
push 0
push word [edi + 0x30]
push 2
mov eax, esp
push 0x10
push eax
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_bind]
add esp, 0x10
test eax, eax
jne 0x453c19
mov ebx, edi
mov ecx, dword [esp]
call fcn.00457330
jb 0x453c3f
mov dword [ebx + 0x10], edx
cld
lea esi, [esp + 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
mov edx, esp
push 4
push edx
push 0x20
push 0xffff
push dword [ebx + 6]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
pop edx
test eax, eax
jne 0x453c19
add esp, 0x228
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
jne 0x453c2a
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
push eax
call fcn.00453688
pop eax
mov dx, 0x37b0
mov al, 0x37
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x44b0
mov al, 0x44
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x453c54
push eax
mov esi, edx
call fcn.004574cb
call fcn.00457364
pop eax
add esp, 0x228
pop edi
pop esi
jmp fcn.0044fb36
Function at 0x453c61
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ax, word [ebp - 0x46]
call fcn.00457404
jb 0x453d5a
test byte [esi + 0xc], 0x80
je 0x453d5e
and word [esi + 0x2c], 0xfffd
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x453c9c
push 0x40
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x453d4b
test eax, eax
je 0x453d6a
lea ecx, [esi + 0x34]
lea edx, [esi + 0x44]
push 0
push 0
push dword [esi + 0x34]
push word [esi + 0x30]
push 2
mov ecx, esp
lea edx, [esi + 0x44]
push 0x10
push esp
push ecx
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
add esp, 4
mov ebx, dword [esp + 4]
movzx ecx, word [esp + 2]
add esp, 0x10
cmp eax, 0xffffffff
je 0x453d4b
test eax, eax
jne 0x453d21
or word [esi + 0x2c], 2
xchg ecx, eax
call fcn.00457330
jb 0x453d6c
add esi, 0x44
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045d137
mov ecx, ebx
xchg ah, al
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x453d62
jmp 0x453d66
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0045d135
add esp, 0x104
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x453d7e
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ebx, ecx
push eax
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
call fcn.00457442
pop eax
jb 0x453e37
test byte [edi + 0xc], 0x80
je 0x453e3b
xchg ah, al
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebx
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x453dca
push 0x40
mov edx, esp
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
cmp eax, 0xffffffff
je 0x453e28
test eax, eax
je 0x453e47
push 0
push 0
push dword [edi + 0x34]
push word [edi + 0x30]
push 2
mov ecx, esp
push 0x10
push ecx
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_sendto]
add esp, 0x10
cmp eax, 0xffffffff
je 0x453e28
cmp eax, ebx
jb 0x453e43
and word [edi + 0x2c], 0xfffd
call fcn.0045d67b
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x453e3f
jmp 0x453e43
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0045d67b
add esp, 0x104
pop edi
pop esi
jmp fcn.0044fb36
Function at 0x453edb
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00457404
jb 0x453f1c
cmp word [esi + 0xa], 1
jne 0x453f18
mov ax, word [esi + 0xc]
fild qword [esi + 0x14]
test al, 1
je 0x453ef8
fiadd dword [esi + 0x24]
fiadd word [esi + 0x2e]
test al, 0xb
je 0x453f16
push pe_nt_image_headers32
fidiv dword [esp]
fldcw word [0x44f856]
frndint
fldcw word [0x44f84e]
pop eax
pop esi
ret
fldz
pop esi
ret
fldz
pop esi
jmp fcn.0044fb36

Function at 0x453f24
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00457404
jb 0x453f58
cmp word [esi + 0xa], 2
je 0x453f54
push ecx
lea eax, [esi + 0x3c]
push eax
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_GetFileSize]
call fcn.0045d694
pop ecx
jb 0x453f5a
push dword [esi + 0x3c]
push eax
fild qword [esp]
pop edx
pop edx
pop esi
ret
pop esi
fldz
ret
mov edx, eax
pop esi
fldz
jmp fcn.0044fb2b

Function at 0x454232
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
test eax, eax
jns 0x45424b
add eax, ecx
test edx, edx
je 0x45428b
jns 0x454256
add edx, ecx
js 0x45428b
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x45425f
xor ecx, ecx
cmp ecx, eax
jb 0x454265
mov ecx, eax
call fcn.00457330
jb 0x45428f
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00457d76
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x454279
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x454296
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
test eax, eax
jns 0x4542ae
add eax, ecx
cmp eax, ecx
jae 0x4542da
xchg ecx, eax
call fcn.00457330
jb 0x4542de
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00457d76
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.0044fb36

Function at 0x454300
Capabilities:
Terminate process

Disassembly:
call fcn.0045438a
push 0
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
call fcn.0045d694
jb 0x45431c
add esp, 0x114
ret
add esp, 0x114
jmp fcn.0044fb2b

Function at 0x45438a
Capabilities:
Terminate process

Disassembly:
pop ecx
sub esp, 0x114
mov edx, esp
call fcn.00453e90
test ah, ah
jne 0x45439e
jmp ecx
add esp, 0x114
mov edx, 0x4c
jmp fcn.0044fb2b

Function at 0x456d47
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.00457330
jb 0x456d79
xor eax, eax
jmp 0x456d66

Function at 0x456d56
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.00457330
jb 0x456d79
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.0045d137
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.0045d135
jmp fcn.0044fb36