joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44779b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x512c6c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5ff740]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004051df
call fcn.004bf17c
fld qword [0x5d1230]
mov eax, dword [eax + 0xc]
push ecx
push ecx
fstp qword [esp]
push 0x1a7
push dword [edi + 0x20]
lea ecx, [edi + 0x26b0]
mov edx, eax
call fcn.0040c1ff
push 0x1c
pop ecx
push ecx
mov ebx, 0x99
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x20], esp
mov esi, esp
push 0x5afd90
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.RESOURCESTRING
mov byte [edi + 0xe0], 1
call fcn.0040253b
and dword [esp + 0x3c], 0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5beef8
call fcn.0040253b
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406ef3
push 0xc2
push 0xc1
lea esi, [edi + 0x74]
push 0xc0
call fcn.004018b9
push 0x1c
pop eax
push eax
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
push 0x5afd90
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.RESOURCESTRING
mov byte [edi + 0x248], 1
call fcn.0040253b
push ecx
mov dword [esp + 0x40], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.IDS_BTN_EXCLUSION_LIST
call fcn.0040253b
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406ef3
push 0xc2
push 0xc1
lea esi, [edi + 0x1dc]
push 0xc0
call fcn.004018b9
push 0x1c
pop eax
push eax
mov eax, ebx
push eax
push ecx
mov byte [edi + 0x3b0], 1
mov esi, esp
mov dword [esp + 0x24], esp
push 0x5afd90
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov dword [esp + 0x40], 2
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.IDS_BTN_SCHEDULE
call fcn.0040253b
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406ef3
push 0xc2
push 0xc1
lea esi, [edi + 0x344]
push 0xc0
call fcn.004018b9
push 0x1c
pop eax
push eax
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
push 0x5afd90
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.RESOURCESTRING
mov byte [edi + 0x518], 1
call fcn.0040253b
push ecx
mov dword [esp + 0x40], 3
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.IDS_GEN_SETTINGS
call fcn.0040253b
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406ef3
push 0xc2
push 0xc1
lea esi, [edi + 0x4ac]
push 0xc0
call fcn.004018b9
push 1
push 0x1c
pop esi
push esi
push ebx
push 0x15
push esi
lea ecx, [edi + 0x74]
call fcn.004bf3f0
push 1
push esi
push ebx
push 0x15
push 0xbe
lea ecx, [edi + 0x1dc]
call fcn.004bf3f0
push 1
push esi
push ebx
push 0x15
push 0x160
lea ecx, [edi + 0x344]
call fcn.004bf3f0
push 1
push esi
push ebx
push 0x15
push 0x202
lea ecx, [edi + 0x4ac]
call fcn.004bf3f0
mov eax, edi
call fcn.00447a39
lea ecx, [edi + 0x618]
push 5
mov dword [edi + 0x614], ecx
call fcn.004bf430
push 0
push 0xff
push 0x111
push dword [edi + 0x20]
mov byte [edi + 0x151], 1
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4563d0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0x228
mov eax, 0x512a22
call fcn.004e3d69
call fcn.0047876d
cmp eax, 6
jne 0x456405
xor ebx, ebx
push ebx
cmp byte [ebp + 8], bl
je 0x4563fb
call fcn.004559b7
jmp 0x4564db
call fcn.004554b5
jmp 0x4564db
lea eax, [ebp - 0x21c]
mov edi, SysReAllocStringLen
push eax
lea esi, [ebp - 0x234]
mov dword [ebp - 0x21c], edi
call fcn.0040ac2c
push 1
push 0x5ba468
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0040ac48
test eax, eax
je 0x4564c2
cmp byte [ebp + 8], bl
je 0x4564a6
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004e38a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edi, [ebp - 0x218]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x45647a
mov esi, str.__rem
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
push str.RDReminder
lea edi, [ebp - 0x218]
lea ecx, [ebp - 0x234]
call fcn.0040ad1a
jmp 0x4564b7
push str.RDReminder
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea esi, [ebp - 0x234]
call fcn.0040aca6
lea esi, [ebp - 0x234]
call fcn.0040aca6
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0040285b
xor eax, eax
inc eax
call fcn.004e3dec
ret 4
Function at 0x45e618
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x512600
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x5ff740]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, 0x1b4
push edi
push dword [0x6098c0]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor ebx, ebx
test eax, eax
jne 0x45e669
push 0x64
mov dword [esi + 0xa64], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call fcn.004bd312
pop ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], ebx
cmp eax, ebx
je 0x45e684
push eax
call fcn.00405204
jmp 0x45e686
xor eax, eax
or dword [esp + 0x38], 0xffffffff
mov dword [esi + 0xa64], eax
mov dword [eax + 0x150], 1
mov eax, dword [esi + 0xa64]
mov edi, dword [esi + 0xa7c]
mov dword [eax + 0x16c], edi
mov eax, dword [esi + 0xa64]
mov edi, dword [esi + 0xa78]
mov dword [eax + 0x170], edi
mov eax, dword [esi + 0xa64]
mov dword [eax + 0x168], 0xff
mov eax, dword [esi + 0xa64]
mov ecx, 0xfe
mov dword [eax + 0x158], ecx
lea edx, [ecx - 0x3d]
mov dword [eax + 0x15c], edx
mov eax, dword [esi + 0xa64]
mov dword [eax + 0x60], ebx
mov eax, dword [esi + 0xa64]
mov dword [eax + 0x17c], ebx
lea eax, [esi + 0xa68]
cmp dword [eax], 0xffffffff
jne 0x45e70f
cmp dword [eax + 4], 0xffffffff
je 0x45e726
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0xa64]
mov dword [ecx + 0x160], edx
mov dword [ecx + 0x164], eax
mov eax, dword [esi + 0xa64]
mov ecx, dword [eax + 0x160]
mov edx, dword [eax + 0x164]
mov dword [eax + 0x160], ecx
mov dword [eax + 0x164], edx
mov edi, dword [esi + 0xa64]
push dword [0x60a800]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x13c]
test eax, eax
je 0x45e7cd
cmp dword [edi + 0x154], ebx
jne 0x45e7cd
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x140]
jmp 0x45e7cd
mov eax, dword [esi + 0xa64]
cmp eax, ebx
jne 0x45e782
xor eax, eax
jmp 0x45e785
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45e7e2
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x45e7bd
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
jne 0x45e7a7
push 0x1b4
push dword [esi + 0xa64]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x45e774
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f9bb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push str.Check_for_Update_started
call fcn.0040253b
call fcn.00454d39
movzx eax, byte [0x60a913]
push eax
movzx eax, byte [0x60a912]
push eax
call fcn.0046cbc0
add esp, 8
mov ecx, esp
mov dword [ebp - 4], esp
push str.Check_for_Update_Completed
mov esi, eax
call fcn.0040253b
call fcn.00454d39
cmp byte [0x60a912], 0
pop ecx
je 0x45fa1c
test esi, esi
je 0x45fa21
mov esi, dword [0x60a8d0]
call fcn.0045e618
xor eax, eax
pop esi
leave
ret
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push str.ExitProcess_:_No_Updates
call fcn.0040253b
call fcn.00454d39
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x462b62
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 8
mov eax, 0x502aa3
call fcn.004e3d00
push 0x208
xor ebx, ebx
push ebx
mov esi, 0x60c550
push esi
call fcn.004e38a0
add esp, 0xc
call fcn.00482292
push esi
push ebx
push ebx
test al, al
je 0x462b94
push 0x2a
jmp 0x462b96
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
lea ecx, [ebp - 0x10]
call fcn.0040253b
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Advanced_System_Optimizer_3
mov dword [ebp - 4], ebx
call fcn.0040253b
lea ecx, [ebp - 0x10]
call fcn.00406dee
push dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x462bf3
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.aso3.exe
call fcn.0040253b
lea ecx, [ebp - 0x10]
call fcn.00406dee
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x462bf3
mov bl, 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040285b
mov al, bl
call fcn.004e3dd8
ret
Function at 0x464d73
Capabilities:
Check for time delay via gettickcount
Continue service
Modify service
Query service status
Start service

Disassembly:
push 0x34
mov eax, 0x50ca6a
call fcn.004e3d00
lea edi, [ebp - 0x20]
call fcn.00464c2d
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x20], ebx
je 0x464ed3
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
je 0x464edd
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x3c]
push eax
push edi
call esi
test eax, eax
jne 0x464dce
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
jmp 0x464ee9
mov eax, dword [ebp - 0x38]
dec eax
je 0x464dfe
sub eax, 3
je 0x464dfa
sub eax, 3
jne 0x464db7
lea eax, [ebp - 0x3c]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x464db7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov bl, 1
jmp 0x464db7
call fcn.004bf17c
mov ecx, dword [eax + 4]
call fcn.004c596b
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 0x420
jne 0x464e28
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], bl
call fcn.0042365d
jmp 0x464dfa
cmp eax, ebx
jge 0x464e3c
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], bl
call fcn.0042365d
jmp 0x464db7
lea eax, [ebp - 0x3c]
push eax
push edi
call esi
test eax, eax
je 0x464e2c
cmp byte [ebp - 0x18], bl
jne 0x464e60
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
jmp 0x464ebe
mov eax, dword [ebp - 0x24]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x1f4
cmp eax, ecx
jb 0x464e8c
mov ecx, 0x1388
cmp eax, ecx
jbe 0x464e8e
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x464e2c
cmp dword [ebp - 0x28], edi
ja 0x464e66
call esi
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jbe 0x464ebe
cmp dword [ebp - 0x24], ebx
ja 0x464e2c
cmp dword [ebp - 0x38], 2
je 0x464e70
cmp dword [ebp - 0x38], 4
jne 0x464e2c
jmp 0x464e1b
cmp dword [ebp - 0x1c], ebx
je 0x464edd
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x20], ebx
je 0x464ee7
push dword [ebp - 0x20]
call esi
xor al, al
call fcn.004e3dd8
ret
Function at 0x466147
Capabilities:
Check if file exists

Disassembly:
push 0xcdc
mov eax, 0x507e83
call fcn.004e3d9f
mov edi, ecx
lea esi, [edi + 0x20]
push esi
mov dword [ebp - 0xc88], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [edi], bl
jne 0x466177
push esi
jmp 0x466250
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x38]
push ecx
push eax
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
call fcn.004cb095
cmp eax, ebx
je 0x466171
mov esi, 0x82c
push esi
lea eax, [ebp - 0xc80]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004e38a0
mov eax, dword [edi + 0x38]
add esp, 0xc
cmp eax, ebx
je 0x4661df
push eax
lea eax, [ebp - 0xc80]
call fcn.0040de7e
lea eax, [ebp - 0xa6e]
push eax
lea ecx, [ebp - 0xc8c]
mov byte [ebp - 4], 3
call fcn.0040253b
push 0x208
lea eax, [ebp - 0x220]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.004e38a0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
call fcn.00482496
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46625c
mov ecx, dword [ebp - 0xc8c]
add ecx, 0xfffffff0
call fcn.0040285b
push esi
lea eax, [ebp - 0xc80]
push ebx
push eax
call fcn.004e38a0
add esp, 0xc
push dword [ebp - 0xc88]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004e3dfb
ret
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0xc84]
call fcn.0040253b
push ecx
mov byte [ebp - 4], 5
lea eax, [ebp - 0xc8c]
mov dword [ebp - 0xc90], esp
mov ecx, esp
push eax
call fcn.00402305
lea ecx, [ebp - 0xc84]
call fcn.00406dee
push str..dat
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0xc90]
push eax
call fcn.00402187
add esp, 0xc
push eax
lea ecx, [ebp - 0xc84]
mov byte [ebp - 4], 6
call fcn.004025da
mov ecx, dword [ebp - 0xc90]
add ecx, 0xfffffff0
call fcn.0040285b
lea ecx, [ebp - 0xca0]
mov byte [ebp - 4], 7
call fcn.004ccfe8
push ebx
push 0x9001
mov byte [ebp - 4], 8
push dword [ebp - 0xc84]
lea ecx, [ebp - 0xca0]
call fcn.004cd46d
cmp eax, ebx
je 0x4663ad
push ebx
push 0x1000
push ebx
lea eax, [ebp - 0xca0]
push eax
lea ecx, [ebp - 0xce8]
mov byte [ebp - 4], 9
call fcn.004cc5e4
lea eax, [edi + 0x38]
push eax
lea ecx, [ebp - 0xce8]
mov byte [ebp - 4], 0xa
call fcn.00417b32
push dword [ebp - 0x434]
lea ecx, [ebp - 0xce8]
push dword [ebp - 0x438]
call fcn.004667d7
push dword [ebp - 0x444]
lea eax, [ebp - 0xce8]
push dword [ebp - 0x448]
push eax
call fcn.004cf5c0
lea ecx, [edi + 4]
mov eax, dword [ecx]
lea edx, [ebp - 0xce8]
push edx
call dword [eax + 8]
lea ecx, [ebp - 0xce8]
call fcn.004cc42d
lea ecx, [ebp - 0xce8]
mov byte [ebp - 4], 9
call fcn.004cc5a6
mov dword [ebp - 4], 8
jmp 0x4663a2
lea ecx, [ebp - 0xca0]
call fcn.004ccf82
lea ecx, [ebp - 0xca0]
mov byte [ebp - 4], 7
call fcn.004cd101
mov ecx, dword [ebp - 0xc84]
add ecx, 0xfffffff0
call fcn.0040285b
jmp 0x46622b
Function at 0x467570
Capabilities:
Check if file exists
Create process on windows
Terminate process

Disassembly:
push 0x14
mov eax, 0x50c621
call fcn.004e3d00
mov esi, 0x5c3750
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040dd8e
mov edi, eax
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x18]
call fcn.0040dd8e
push 0x60acbc
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00402130
push edi
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.00402130
add esp, 0x18
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040285b
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040285b
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040285b
push dword [0x60acbc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x467632
push 1
push 0x5afd90
push str._verysilent
push dword [ebp - 0x10]
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x5c3754
call fcn.0040253b
call fcn.00454d39
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040285b
call fcn.004e3dd8
ret

Function at 0x467643
Capabilities:
Delete file

Disassembly:
push 0x190
mov eax, 0x500e31
call fcn.004e3d33
and dword [ebp - 4], 0
mov al, byte [0x60c759]
test al, al
jne 0x4677ac
call fcn.0046687c
test eax, eax
je 0x4677ac
push dword [ebp + 8]
mov byte [0x60c759], 1
call fcn.0040716c
test al, al
je 0x46768c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
call fcn.00466869
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
call fcn.00407356
push 3
mov byte [ebp - 4], 2
push dword [0x60acb4]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
call fcn.00407356
mov byte [ebp - 4], 3
push dword [ebp - 0x94]
push dword [ebp - 0x118]
call fcn.00466837
lea eax, [ebp - 0x114]
pop ecx
pop ecx
cmp dword [ebp - 0x118], eax
je 0x467707
push dword [ebp - 0x118]
call fcn.004de9e3
pop ecx
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x94], eax
je 0x467725
push dword [ebp - 0x94]
call fcn.004de9e3
pop ecx
push 0x5c3698
push str.hidden
call fcn.0046688f
pop ecx
pop ecx
push dword [0x60a93c]
call fcn.0040716c
test al, al
je 0x467799
push 3
push dword [0x60a93c]
lea eax, [ebp - 0x198]
mov dword [ebp - 0x19c], eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00407356
mov byte [ebp - 4], 4
push dword [ebp - 0x19c]
push 0x5c36a8
call fcn.0046688f
lea eax, [ebp - 0x198]
pop ecx
mov byte [ebp - 4], 1
pop ecx
cmp dword [ebp - 0x19c], eax
je 0x467799
push dword [ebp - 0x19c]
call fcn.004de9e3
pop ecx
mov byte [0x60c759], 1
call fcn.00466853
mov byte [0x60c759], 0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040285b
call fcn.004e3dd8
ret
Function at 0x46d74f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5ff740]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
add esi, 4
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
cmp eax, ebx
je 0x46d77b
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [esi], ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 8], ebx
mov edi, SysReAllocStringLen
cmp dword [ebp + 8], ebx
je 0x46d7cc
push dword [ebp + 8]
call esi
push ebx
inc eax
cdq
push 2
push edx
push eax
call fcn.004e5f50
mov ecx, eax
add eax, edi
adc edx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edx
jne 0x46d7cc
cmp eax, 0xffffffff
jbe 0x46d7d1
mov dword [ebp - 0xc], ebx
jmp 0x46d80c
cmp ecx, 0x400
jg 0x46d7f0
push ecx
call fcn.0047869b
pop ecx
test al, al
je 0x46d7f0
mov eax, dword [ebp - 0x10]
call fcn.004e57a0
mov eax, esp
jmp 0x46d7fb
push dword [ebp - 0x10]
lea ecx, [ebp - 8]
call fcn.00478673
push 3
push dword [ebp - 0x10]
push dword [ebp + 8]
push eax
call fcn.00465e68
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], ebx
je 0x46d832
push dword [ebp + 0xc]
call esi
push ebx
inc eax
cdq
push 2
push edx
push eax
call fcn.004e5f50
mov esi, eax
add eax, edi
adc edx, ebx
mov dword [ebp - 0x1c], edx
jne 0x46d832
cmp eax, 0xffffffff
jbe 0x46d836
xor eax, eax
jmp 0x46d869
cmp esi, 0x400
jg 0x46d854
push esi
call fcn.0047869b
pop ecx
test al, al
je 0x46d854
mov eax, esi
call fcn.004e57a0
mov eax, esp
jmp 0x46d85d
push esi
lea ecx, [ebp - 8]
call fcn.00478673
push 3
push esi
push dword [ebp + 0xc]
push eax
call fcn.00465e68
cmp dword [ebp - 0xc], ebx
je 0x46d891
cmp eax, ebx
je 0x46d891
push dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
push ecx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.00445e2d
mov eax, esi
jmp 0x46d8a4
push 8
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea ecx, [ebp - 8]
call fcn.00445e2d
or eax, 0xffffffff
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004de422
leave
ret 8
Function at 0x46e933
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push edi
lea edx, [esi + 0x10]
push 6
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, edx
call fcn.004785b7
xor ebx, ebx
cmp eax, ebx
jge 0x46e954
push eax
call fcn.0040298d
lea edx, [esi + 0x28]
push 6
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, edx
call fcn.004785b7
cmp eax, ebx
jl 0x46e94e
or dword [esi + 0x40], 0xffffffff
mov dword [esi], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x2710
cmp dword [0x6068f0], ebx
je 0x46e9a5
push 0x606760
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x6068f0], eax
pop edi
mov eax, esi
pop ebx
ret

Function at 0x46eaaa
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
cmp byte [esi + 0x44], bl
je 0x46eabc
mov al, 1
jmp 0x46eb2e
mov eax, dword [esi + 0x40]
mov byte [ebp - 1], 1
cmp eax, 0xffffffff
jne 0x46eacc
xor al, al
jmp 0x46eb2e
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x46eb28
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x46eb22
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46eb25
push 0x2c
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.004e38a0
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x46eb28
mov dword [esi + 0x48], eax
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
mov byte [esi + 0x44], al
pop ebx
leave
ret 8
Function at 0x46eb33
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x46eb5a
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x46ec01
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x46eb78
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x46ec00
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x46ebc0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x46ebf2
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x46ebf5
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x46ebec
mov bl, 1
jmp 0x46ebf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
leave
ret 0xc