joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43dd1f
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2c4]
sub esp, 0x344
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp + 0x2c0], eax
push edi
mov edi, ecx
test edi, edi
jne 0x43dd4b
mov eax, 0xfffff019
jmp 0x43df33
push ebx
push esi
call fcn.00442ca6
xor eax, eax
mov dword [ebp - 0x54], 0x114
mov word [ebp - 0x40], ax
mov eax, dword [0x8c0118]
test eax, eax
je 0x43dd70
lea ecx, [ebp - 0x54]
push ecx
call eax
jmp 0x43dd82
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43de3f
lea eax, [ebp - 0x58]
xor ebx, ebx
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x100
test eax, eax
jne 0x43de03
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x200
push eax
lea eax, [ebp + 0xc0]
push eax
push ebx
push 2
push 0x589854
push ebx
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push dword [ebp - 0x58]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov esi, 0x100
jne 0x43de03
xor ecx, ecx
lea eax, [edi + 0x200]
push ecx
push ecx
push esi
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0xc0]
push eax
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
je 0x43de3f
cmp word [ebp - 0x40], 0
je 0x43de69
test ebx, ebx
jle 0x43de16
mov byte [edi + ebx + 0x1ff], 0x20
push 0
push 0
mov eax, esi
sub eax, ebx
push eax
lea eax, [edi + 0x200]
add eax, ebx
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x43de69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00449d08
mov byte [edi], 0
mov byte [edi + 0x100], 0
mov byte [edi + 0x200], 0
mov byte [edi + 0x300], 0
jmp 0x43df31
push esi
mov edx, str.Windows_NT
mov ecx, edi
call fcn.0044a31a
push dword [ebp - 0x48]
lea eax, [edi + 0x100]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push str._d._d._d
push esi
push eax
call fcn.004396b1
add esp, 0x1c
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x80]
cmp eax, 0xa
ja case.0x43dea7.8
jmp dword [eax*4 + 0x43df4b]
mov edx, str.x86_64
jmp 0x43df20
mov edx, str.ia64
jmp 0x43df20
push esi
lea ecx, [edi + 0x300]
mov edx, str.i386
call fcn.0044a31a
mov dx, word [ebp - 0x60]
add esp, 4
cmp dx, 3
jbe 0x43df2f
push 6
pop ecx
cmp dx, cx
movzx eax, dl
cmovb ecx, eax
add cl, 0x30
mov byte [edi + 0x301], cl
jmp 0x43df2f
mov edx, str.i686
jmp 0x43df20
mov edx, str.mips
jmp 0x43df20
mov edx, str.alpha
jmp 0x43df20
mov edx, str.powerpc
jmp 0x43df20
mov edx, 0x5898bc
jmp 0x43df20
mov edx, 0x5898c0
jmp 0x43df20
mov edx, str.unknown
push esi
lea ecx, [edi + 0x300]
call fcn.0044a31a
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp + 0x2c0]
xor ecx, ebp
pop edi
call fcn.0051b034
add ebp, 0x2c4
leave
ret
Function at 0x43e0da
Capabilities:
Send data
Send data on socket

Disassembly:
test byte [ecx + 0x2c], 1
je 0x43e0e6
mov eax, 0xfffff00d
ret
test dword [ecx + 0x2c], 0x8000
jne 0x43e0f5
mov eax, 0xfffff031
ret
mov eax, dword [ecx + 8]
sub eax, 7
je 0x43e118
sub eax, 5
je 0x43e113
dec eax
sub eax, 1
je 0x43e10e
mov eax, 0xfffff02a
ret
jmp fcn.00448a66
jmp fcn.00444bb5
mov eax, 0xfffff008
ret

Function at 0x43e2d5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x5c
mov edi, edx
mov ebx, ecx
pop edx
push 0x2f
pop esi
push 2
pop ecx
cmp edi, ecx
jbe 0x43e309
movzx eax, word [ebx]
cmp ax, dx
je 0x43e2f7
cmp ax, si
jne 0x43e30e
movzx eax, word [ebx + 2]
cmp ax, dx
je 0x43e305
cmp ax, si
jne 0x43e30e
xor esi, esi
jmp 0x43e37b
cmp edi, 1
jb 0x43e31f
movzx eax, word [ebx]
cmp ax, si
je 0x43e31b
cmp ax, dx
jne 0x43e31f
mov esi, ecx
jmp 0x43e37b
push 0x3a
pop eax
cmp edi, ecx
jb 0x43e377
cmp word [ebx + 2], ax
jne 0x43e361
cmp edi, 3
jb 0x43e33f
movzx eax, word [ebx + 4]
cmp ax, si
je 0x43e365
cmp ax, dx
je 0x43e365
mov esi, dword [esp + 0x28]
cmp esi, ecx
jb 0x43e305
push ecx
push ebx
push dword [esp + 0x2c]
call fcn.0053067a
add esp, 0xc
test eax, eax
jne 0x43e305
add ebx, 4
sub edi, 2
jmp 0x43e37b
cmp edi, ecx
jbe 0x43e377
mov esi, dword [esp + 0x28]
xor eax, eax
push 0x3a
pop ecx
cmp word [ebx + 2], cx
cmove esi, eax
jmp 0x43e37b
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
add ecx, edi
add ecx, dword [esp + 0x20]
add ecx, esi
lea ecx, [ecx*2 + 8]
call fcn.004396f2
push esi
push dword [esp + 0x28]
mov ebp, eax
push ebp
mov dword [esp + 0x34], ebp
call fcn.0052ea61
add esp, 0xc
lea ebp, [ebp + esi*2]
test esi, esi
je 0x43e3ce
movzx eax, word [ebp - 2]
push eax
push 0x589ab8
call fcn.0051e54f
pop ecx
pop ecx
test eax, eax
jne 0x43e3ce
push 0x5c
pop eax
mov word [ebp], ax
add ebp, 2
push edi
push ebx
push ebp
call fcn.0052ea61
lea esi, [edi*2]
add esp, 0xc
add esi, ebp
test edi, edi
je 0x43e404
movzx eax, word [esi - 2]
push eax
push 0x589ab8
call fcn.0051e54f
pop ecx
pop ecx
test eax, eax
jne 0x43e404
push 0x5c
pop eax
mov word [esi], ax
add esi, 2
mov ebp, dword [esp + 0x18]
push ebp
push dword [esp + 0x18]
push esi
call fcn.0052ea61
mov ebx, dword [esp + 0x2c]
lea esi, [esi + ebp*2]
add esp, 0xc
test ebx, ebx
je 0x43e445
test ebp, ebp
je 0x43e434
push 0x2e
pop eax
cmp word [esi - 2], ax
je 0x43e434
mov word [esi], ax
add esi, 2
push ebx
push dword [esp + 0x20]
push esi
call fcn.0052ea61
add esp, 0xc
lea esi, [esi + ebx*2]
xor eax, eax
mov word [esi], ax
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43e462
test al, 0x10
jne 0x43e462
mov eax, esi
jmp 0x43e46b
mov ecx, esi
call fcn.00439702
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x43f234
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp edx, 0x1c
ja 0x43f2d3
sub edx, 0
je 0x43f2a7
dec edx
sub edx, 1
je 0x43f261
sub edx, 7
je 0x43f261
sub edx, 6
je 0x43f261
mov eax, 0xfffff02a
jmp 0x43f2d8
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43f2a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 5
jne 0x43f29a
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x43f29a
cmp dword [ebp - 4], 0x103
je 0x43f29a
mov eax, 0xfffff038
jmp 0x43f2d8
mov ecx, edi
call fcn.00449d08
jmp 0x43f2d8
xor eax, eax
jmp 0x43f2d8
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x43f2c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x43f29c
xor eax, eax
mov ecx, 0xfffff038
cmp dword [ebp - 4], 0x103
cmovne eax, ecx
jmp 0x43f2d8
mov eax, 0xfffff019
pop edi
pop esi
leave
ret

Function at 0x43f3ab
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
test byte [edx], 1
push ebx
push esi
push edi
mov ebx, ecx
je 0x43f3d8
mov esi, dword [edx + 4]
test esi, esi
je 0x43f3da
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x20]
dec esi
add esi, eax
neg eax
and esi, eax
jmp 0x43f3da
xor esi, esi
push 0xc
call dword [0x603d38]
mov edi, eax
pop ecx
test edi, edi
jne 0x43f3f0
mov eax, 0xfffff027
jmp 0x43f461
mov eax, dword [ebp + 8]
push 0
push 4
push edi
push 0x43f353
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
push esi
push 0
mov dword [edi + 4], eax
call fcn.005308f5
add esp, 0x18
test eax, eax
jne 0x43f453
call fcn.0052d3fe
mov ecx, edi
mov esi, dword [eax]
call fcn.00439702
sub esi, 0
je 0x43f45f
sub esi, 0xb
je 0x43f44c
dec esi
sub esi, 1
je 0x43f445
sub esi, 9
je 0x43f43e
mov eax, 0xfffff01a
jmp 0x43f461
mov eax, 0xfffff019
jmp 0x43f461
mov eax, 0xfffff004
jmp 0x43f461
mov eax, 0xfffff008
jmp 0x43f461
mov dword [ebx], eax
push eax
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43f466
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x8934f4], 0
jne 0x43f482
mov edx, 0x43f33e
mov ecx, 0x8934f4
call fcn.0043f2dc
mov ecx, 0x8934fc
call fcn.0043f578
mov dword [ebp - 4], eax
test eax, eax
jne 0x43f4d0
push 2
push eax
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43f4d2
push dword [ebp - 4]
push dword [0x8934fc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x43f4e4
mov eax, dword [ebp - 4]
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x589b54
mov ecx, eax
call fcn.00449c84
call fcn.00529b17
int3
Function at 0x43f9a8
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x7fffffff
jbe 0x43f9be
mov eax, 0xfffff003
jmp 0x43fa1d
cmp dword [ebp + 0x10], 0
je 0x43f9cb
mov eax, 0xfffff019
jmp 0x43fa1d
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x43f9e3
call fcn.00442ca6
mov ecx, dword [ebp + 8]
mov edx, esi
pop esi
pop ebp
jmp fcn.0043df77
and dword [edx + 0x20], 0
mov dword [edx + 4], 0xa
inc dword [ecx + 0x10]
and dword [edx + 0x40], 0
mov dword [edx + 0x4c], eax
mov eax, dword [ebp + 8]
push 0x43f981
mov dword [edx + 0x3c], ecx
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], esi
add edx, 0x50
push 0x43f95f
push 0
call fcn.0043fd97
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret

Function at 0x44007e
Capabilities:
Create pipe

Disassembly:
push ebx
push ebp
push esi
mov ebx, edx
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [esp + 0x18]
push eax
push esi
push str._pipeuv_p__lu
push 0x40
push dword [esp + 0x20]
call fcn.004396b1
or ebx, 0x80000
jmp 0x4400d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x4400bb
cmp eax, 5
jne 0x4400fa
inc esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push str._pipeuv_p__lu
push 0x40
push dword [esp + 0x20]
call fcn.004396b1
add esp, 0x14
xor eax, eax
mov ecx, 0x10000
push eax
push eax
push ecx
push ecx
push 1
push eax
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
je 0x4400a9
mov dword [ebp], eax
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4400fe
Capabilities:
Connect pipe

Disassembly:
sub esp, 0x64
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x60], eax
or dword [esp], 0xffffffff
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x14], ecx
mov ecx, ebx
shr ecx, 4
and ecx, 1
mov dword [esp + 0x10], edx
mov edx, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x78]
or edx, 2
push ebp
or ebp, 0xffffffff
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
test bl, 0x20
push esi
cmove edx, ecx
mov ecx, eax
push edi
mov edi, edx
or edi, 0x40000000
test bl, 0x40
cmove edi, edx
and ecx, 0x10
or edi, 0x40000
test al, 0x20
je 0x440173
mov esi, 0xc0000000
mov eax, 0x40000080
jmp 0x44017d
mov esi, 0x80000100
mov eax, 0x180
push dword [esp + 0x18]
test ecx, ecx
mov edx, edi
push ecx
cmove esi, eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x38]
push eax
call fcn.0044007e
mov edi, dword [esp + 0x1c]
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4401f2
mov eax, dword [esp + 0x80]
xor ebx, ebx
mov dword [esp + 0x2c], eax
or esi, 0x40000
mov eax, dword [esp + 0x14]
push ebx
and eax, 0x40
mov dword [esp + 0x28], 0xc
shl eax, 0x18
push eax
push 3
lea eax, [esp + 0x30]
mov dword [esp + 0x34], ebx
push eax
push ebx
push esi
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x44021d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x440200
push edi
call esi
cmp ebp, 0xffffffff
je 0x440208
push ebp
call esi
mov eax, ebx
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x64
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x44023c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x217
je 0x44023c
call esi
jmp 0x4401f0
mov eax, dword [esp + 0x1c]
mov dword [eax], ebp
mov eax, dword [esp + 0x20]
mov dword [eax], edi
xor eax, eax
jmp 0x44020a
Function at 0x440d27
Capabilities:
Connect pipe

Disassembly:
push ecx
push ebx
push ebp
push esi
xor ebx, ebx
mov ebp, ecx
mov esi, edx
mov dword [esp + 0xc], ebp
push edi
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x1c], ebx
jne 0x440d6e
push ebx
push edi
call fcn.00440508
pop ecx
pop ecx
test eax, eax
jne 0x440d6e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jg 0x440d5d
call ebx
jmp 0x440d67
call ebx
movzx eax, ax
or eax, 0x80070000
mov dword [edi + 0x20], eax
mov ecx, ebp
jmp 0x440dce
push 0x14
lea ebp, [edi + 0x20]
push ebx
push ebp
call fcn.0051c010
add esp, 0xc
push ebp
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x440dd5
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
je 0x440dd5
call ebp
cmp eax, 0x217
je 0x440dc7
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x3c], 0xffffffff
call ebp
test eax, eax
jg 0x440dbc
call ebp
mov ebx, eax
jmp 0x440dc7
call ebp
movzx ebx, ax
or ebx, 0x80070000
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x20], ebx
mov edx, edi
call fcn.0043b558
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44115b
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0x14], ecx
push edi
test dword [esi + 0x2c], 0x1000000
lea ebp, [esi + 0x44]
je 0x4411b6
push 0x10
push ebp
push 0x440f5b
mov dword [esi + 0x138], 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x44127a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x4411a4
call edi
jmp 0x4411ae
call edi
movzx eax, ax
or eax, 0x80070000
lea ebx, [ebp + 0x20]
jmp 0x44126b
push 0x14
xor edi, edi
lea ebx, [ebp + 0x20]
push edi
push ebx
call fcn.0051c010
add esp, 0xc
lea eax, [esi + 0x80]
test dword [esi + 0x2c], 0x80000
mov dword [esp + 0x14], eax
je 0x4411e4
mov eax, dword [eax]
or eax, 1
mov dword [esi + 0x74], eax
jmp 0x4411e8
mov dword [esp + 0x14], eax
push ebx
push edi
push edi
push 0x606695
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x441225
call edi
cmp eax, 0x3e5
je 0x441225
call edi
test eax, eax
jg 0x441219
call edi
jmp 0x44126b
call edi
movzx eax, ax
or eax, 0x80070000
jmp 0x44126b
test dword [esi + 0x2c], 0x80000
je 0x44127a
lea ecx, [esi + 0x84]
cmp dword [ecx], 0xffffffff
jne 0x44127a
mov eax, dword [esp + 0x14]
push 4
push 0xffffffffffffffff
push ebp
push 0x4410f0
push dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x44127a
call edi
test eax, eax
jg 0x44125e
call edi
jmp 0x441268
call edi
movzx eax, ax
or eax, 0x80070000
lea ebx, [esi + 0x64]
mov ecx, dword [esp + 0x18]
mov edx, ebp
mov dword [ebx], eax
call fcn.0043b558
jmp 0x441281
mov ecx, esi
call fcn.00442034
or dword [esi + 0x2c], 0x10000
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x441a02
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
xor esi, esi
mov ebx, edx
mov ebp, ecx
cmp dword [esp + 0x14], esi
jbe 0x441a39
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441a40
add esi, dword [esp + 0xc]
cmp esi, dword [esp + 0x14]
jb 0x441a12
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x441a3b

Function at 0x441a48
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
and dword [ebp - 8], 0
push esi
push eax
push dword [ebp + 8]
mov esi, edx
push esi
call dword [esi + 0x34]
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x441abf
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x441abf
mov eax, dword [ebp + 0xc]
cmp eax, ecx
push 0
cmova eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441aac
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, esi
call fcn.00441950
jmp 0x441acc
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
call dword [esi + 0x38]
mov eax, dword [ebp - 4]
add esp, 0xc
jmp 0x441ad1
lea eax, [ebp - 0xc]
push eax
push 0xfffff024
push esi
call dword [esi + 0x38]
add esp, 0xc
xor eax, eax
pop esi
leave
ret
Function at 0x441bca
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, edx
push edi
mov edi, ecx
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 0x3c]
and eax, 0xffdeffff
dec edx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], edx
test al, 1
je 0x441c01
test edx, edx
jne 0x441c01
test al, 0x20
jne 0x441c01
or eax, 0x20
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x28], eax
mov dword [edi + 0x2c], esi
mov ecx, dword [esi + 0xa0]
test ecx, ecx
je 0x441c10
call fcn.0043f8b5
mov ebp, 0x1000
test dword [esi + 0x2c], ebp
je 0x441ceb
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x20], 0
jge 0x441c55
push dword [eax + 0x20]
call dword [0x8c012c]
cmp eax, 0x3e3
je 0x441ccf
push dword [0x5631f4]
mov edx, esi
push dword [0x5631f0]
push eax
call fcn.00441950
add esp, 0xc
jmp 0x441ccf
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x94]
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x441c91
push dword [0x5631f4]
push dword [0x5631f0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, esi
call fcn.00441950
add esp, 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x441ccf
test dword [esi + 0x2c], ebp
je 0x441ccf
mov edx, esi
cmp dword [esi + 0x90], ebx
je 0x441caf
call fcn.00441ad4
jmp 0x441cb9
push 0xffffffffffffffff
push eax
call fcn.00441a48
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x441ccf
mov eax, dword [esp + 0x10]
cmp ecx, eax
ja 0x441ccf
sub eax, ecx
mov dword [esp + 0x10], eax
jne 0x441c99
mov eax, dword [esi + 0x2c]
and eax, 0x11000
cmp eax, ebp
jne 0x441ceb
mov edx, esi
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp fcn.0044115b
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x44390a
Capabilities:
Set socket configuration

Disassembly:
push ebp
lea ebp, [esp - 0x208]
sub esp, 0x288
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp + 0x204], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x210]
lea eax, [ebp - 0x74]
push eax
push 0x8004667e
push edi
mov esi, edx
mov dword [ebp - 0x74], 1
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x443960
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00449d08
jmp 0x443a24
xor ecx, ecx
lea eax, [ebp - 0x80]
push ecx
push ecx
push eax
push 4
lea eax, [ebp - 0x78]
push eax
push ecx
push ecx
push 0x48000022
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 8
test eax, eax
mov dword [esi + 4], ebx
pop eax
cmove edi, dword [ebp - 0x78]
lea ecx, [esi + 0x10]
mov dword [esi + 0x2c], eax
mov dword [esi + 8], eax
lea eax, [ebx + 8]
mov dword [ecx], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x14], eax
mov dword [eax], ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
mov dword [ebx + 0xc], ecx
or dword [esi + 0x18], 0xffffffff
push eax
push 0x2005
push 0xffff
push edi
mov dword [esi + 0x34], edi
mov byte [esi + 0xfc], 0
mov dword [ebp - 0x7c], 0x274
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x44394e
lea edx, [ebp - 0x70]
mov ecx, ebx
call fcn.004435e0
cmp eax, 0xffffffff
je 0x4439eb
mov dword [esi + 0x38], eax
jmp 0x4439f2
or dword [esi + 0x2c], 0x1000000
xor ecx, ecx
mov dword [esi + 0x80], esi
push 0xd
pop eax
mov dword [esi + 0x84], eax
mov dword [esi + 0xc0], eax
xor eax, eax
mov word [esi + 0xf8], cx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xdc], ecx
mov dword [esi + 0xbc], esi
mov ecx, dword [ebp + 0x204]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
add ebp, 0x208
leave
ret

Function at 0x443c12
Capabilities:
Set socket configuration

Disassembly:
push esi
push 4
lea eax, [esp + 0xc]
mov esi, edx
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x443c36
pop esi
jmp dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp dword [esp + 8], 0
je 0x443c5b
push 4
lea eax, [esp + 0x10]
push eax
push 3
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x443c5b
pop esi
jmp dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
pop esi
ret
Function at 0x443c5f
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
mov edi, edx
xor ebp, ebp
inc ebp
mov ebx, ecx
mov dword [esp + 0xc], ebp
cmp dword [edi + 0x90], 0xffffffff
je 0x443c82
mov eax, 0xfffff00e
jmp 0x443d7e
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x443ca8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x443d7d
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x443d07
push 0
push esi
push dword [ebx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov edx, 0x80000
test eax, eax
jne 0x443cd9
cmp dword [esp + 0x24], eax
je 0x443d07
lea ebx, [edi + 0x2c]
or dword [ebx], edx
jmp 0x443cdc
lea ebx, [edi + 0x2c]
cmp dword [esp + 0x20], 0x17
mov ebp, ebx
mov ecx, dword [0x8c00c0]
cmove ecx, dword [0x8c00bc]
mov eax, dword [ebx]
test edx, eax
jne 0x443d1a
test ecx, ecx
jne 0x443d1a
push 3
push esi
call dword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
jne 0x443d0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x443d7d
or dword [ebx], 0x20000
lea ebp, [edi + 0x2c]
mov eax, dword [ebx]
test eax, 0x1000000
je 0x443d4d
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
push eax
push 1
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x443d4a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x443d7d
lea ebp, [edi + 0x2c]
test dword [edi + 0x2c], 0x2000000
je 0x443d67
push 0x3c
push 1
mov edx, esi
call fcn.00443c12
pop ecx
pop ecx
test eax, eax
jne 0x443d7d
cmp dword [esp + 0x20], 0x17
mov dword [edi + 0x90], esi
jne 0x443d7b
or dword [ebp], 0x400000
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret