joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424d99
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
call fcn.0040ae5a
mov ecx, dword [ebp + 8]
call fcn.0040adce
call fcn.0040fdf7
cmp dword [0x525cb0], 3
jl 0x424e38
push str._KILL
push dword [0x525cbc]
call fcn.004c03bf
test eax, eax
pop ecx
pop ecx
jne 0x424e26
push eax
call fcn.0040ab0e
pop ecx
mov ecx, dword [0x525cc0]
push 1
call fcn.0040b6b7
mov esi, eax
test esi, esi
pop ecx
jne 0x424e01
push dword [0x525cc0]
push str._n__s__was_successfully_terminated.
call fcn.004106d5
pop ecx
pop ecx
jmp 0x424e15
push esi
push dword [0x525cc0]
push str._n__s__could_not_be_terminated:_exit_code__d
call fcn.004106d5
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.004c2e93
push str._TESTPCL
push dword [0x525cbc]
call fcn.004c03bf
pop ecx
pop ecx
call fcn.0042509b
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x424e44
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
xor eax, eax
cmp dword [eax*4 + 0x6063e0], ebp
je 0x424e5c
inc eax
cmp eax, 2
jl 0x424e4d
xor ebx, ebx
cmp eax, 2
mov edi, 0x6cc5c
jge 0x424f44
mov esi, eax
imul esi, esi, 0x6cc5c
add esi, 0x52cb28
inc ebx
mov dword [eax*4 + 0x6063e0], ebx
push edi
push ebp
push esi
call fcn.004c05d0
add esp, 0xc
push 0x64
lea ecx, [esi + 0x4c0]
lea eax, [esi + 0x32c]
pop edx
mov dword [eax - 0x194], ecx
mov dword [eax], ecx
add eax, 4
dec edx
jne 0x424e9c
push ebp
push ebp
mov dword [esi + 0x37608], ebx
call fcn.0045f7e3
push eax
push 0x4de4e4
mov edi, 0x104
lea eax, [esi + 0x240c]
push edi
push eax
call fcn.00486e10
add esp, 0x18
push str.PaulaConfig.cfg
push ebp
push ebp
call fcn.0045f646
pop ecx
pop ecx
push eax
mov ebx, 0x4df748
push ebx
lea eax, [esi + 0x22a8]
push edi
push eax
call fcn.00486e10
add esp, 0x14
push str.PaulaEmpConfig.cfg
push ebp
push ebp
call fcn.0045f646
pop ecx
pop ecx
push eax
push ebx
lea eax, [esi + 0x21a4]
push edi
push eax
call fcn.00486e10
add esp, 0x14
xor eax, eax
call fcn.00424f73
cmp eax, ebp
je 0x424f2b
push esi
mov ebx, eax
call fcn.0046e6fb
pop ecx
push esi
call fcn.00437484
pop ecx
mov ecx, 0x43a0c8
call fcn.00440544
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
inc ebx
push ebx
call fcn.004bf452
mov esi, eax
cmp esi, ebp
pop ecx
pop ecx
jne 0x424e82
push str._n_nERROR:_OUT_OF_MEMORY__Could_not_create_PAULA_object_
call fcn.0040eb78
mov dword [esp], 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x424f3e
Function at 0x432cab
Capabilities:
Delete file

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
push esi
push edi
jne 0x432cee
mov esi, str.MsSa7Pw.flg
push esi
push ebx
mov dword [0x606f94], ebx
call fcn.0045f7e3
pop ecx
pop ecx
mov edi, eax
call fcn.0041a56b
test eax, eax
je 0x432ce6
push esi
push ebx
call fcn.0045f7e3
pop ecx
pop ecx
pop edi
pop esi
pop ebx
jmp fcn.0041a0f3
xor eax, eax
inc eax
jmp 0x432d77
cmp dword [0x606f94], ebx
jne 0x432ce6
push 0x2e36
push str..MainPAULA.c
push str.MsSa7Pw.flg
push ebx
call fcn.0045f7e3
pop ecx
pop ecx
mov edx, 0x4e1360
mov ecx, eax
call fcn.0041c35a
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x432d75
push str.PAULA__please_ask_the_user_to_provide_the_password_for_SA7.__Thanks___KB.
push esi
call fcn.004c0930
mov edx, dword [esp + 0x1c]
pop ecx
pop ecx
call fcn.00485754
test eax, eax
jne 0x432d57
mov eax, dword [esp + 0x14]
push ebx
call fcn.00487d1c
pop ecx
push eax
push 0x4e242c
push esi
call fcn.004c0930
add esp, 0xc
jmp 0x432d64
push 0x4e04b4
push esi
call fcn.004c0930
pop ecx
pop ecx
push esi
call fcn.0041c787
xor eax, eax
inc eax
pop ecx
mov dword [0x606f94], eax
jmp 0x432d77
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x437833
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor ebx, ebx
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], 0
call fcn.004c05d0
add esp, 0xc
call fcn.004b53e1
test eax, eax
jle 0x43789a
push ebx
push ebx
call fcn.00440b4b
pop ecx
pop ecx
push eax
push ecx
push ebx
xor eax, eax
call fcn.00440abb
pop ecx
pop ecx
push eax
push str._nThe_session_is_entirely_complete___s____s_
call fcn.004b5786
add esp, 0xc
xor ecx, ecx
call fcn.004b586d
push 5
call fcn.0040eb78
pop ecx
call fcn.00480feb
test eax, eax
je 0x437a71
mov eax, dword [ebp + 8]
dec eax
je 0x4379cb
dec eax
dec eax
je 0x437946
dec eax
je 0x437a71
dec eax
je 0x437a71
push ebx
push ebx
call fcn.0045f646
push eax
lea eax, [ebp - 0x110]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.004c054e
add esp, 0x14
lea edi, [ebp - 0x110]
call fcn.0041a56b
test eax, eax
je 0x437924
push 1
call fcn.00483dc4
test eax, eax
pop ecx
je 0x437911
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x20001
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0x4f3d08
call fcn.0040eb78
mov dword [esp], str._n___Paula_has_left_the_building.__She_is_no_longer_here.
call fcn.0040eb78
mov dword [esp], str._n___Please_press_any_key_to_terminate_this_window...
jmp 0x437a49
push ebx
push ebx
call fcn.0045f646
push eax
lea eax, [ebp - 0x110]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.004c054e
add esp, 0x14
lea edi, [ebp - 0x110]
call fcn.0041a56b
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x3e8
je 0x43799e
push 1
call fcn.00483dc4
test eax, eax
pop ecx
je 0x43798b
push edi
call esi
push 0x20001
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
call fcn.0040dddd
push str._n_nPAULA_has_left..._n
call fcn.004106d5
pop ecx
push 3
pop ebx
push ebx
push str._rThis_screen_will_terminate_in__d_seconds.
call fcn.004106d5
pop ecx
pop ecx
push edi
call esi
dec ebx
test ebx, ebx
jg 0x4379b1
jmp 0x437a71
push ebx
push ebx
call fcn.0045f646
push eax
lea eax, [ebp - 0x110]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.004c054e
add esp, 0x14
lea edi, [ebp - 0x110]
call fcn.0041a56b
test eax, eax
je 0x437a20
push 1
call fcn.00483dc4
test eax, eax
pop ecx
je 0x437a0d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x20001
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0x4f3d08
call fcn.0040eb78
mov dword [esp], str._n___Paula_has_left_the_building.__She_is_no_longer_here.
call fcn.0040eb78
mov dword [esp], str._n___You_will_have_to_reclick_Paula_to_get_her_to_come_back.
call fcn.0040eb78
mov dword [esp], str._n___Press_any_key_to_close_this_window...
call fcn.0040eb78
mov dword [esp], str._n_n_n_n
call fcn.0040eb78
mov dword [esp], str.Press_any_key_to_exit..._n_n_n_n_n_n_n
call fcn.0040eb78
pop ecx
mov eax, 0xea60
call fcn.0041f8bd
call fcn.00437478
push dword [ebp + 8]
call fcn.004c2e93
int3
Function at 0x43f09a
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp + 0x88], eax
mov eax, dword [ebp + 0x98]
push esi
mov esi, ecx
test esi, esi
push edi
mov dword [ebp - 0x80], eax
jg 0x43f0cb
mov esi, 0x200
push 1
push 0x1f0
call fcn.004bf452
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x43f0e6
xor eax, eax
jmp 0x43f1d3
lea eax, [esi + 0xa]
push eax
push 1
call fcn.004bf452
test eax, eax
pop ecx
pop ecx
mov dword [edi], eax
jne 0x43f102
push edi
call fcn.004bf2a6
pop ecx
jmp 0x43f0df
and dword [edi + 4], 0
and dword [edi + 0xc], 0
inc dword [0x608dc8]
mov eax, dword [0x608dc8]
push ebx
mov ebx, dword [0x608dc4]
test ebx, ebx
mov dword [edi + 0x2c], eax
mov dword [edi + 8], esi
jne 0x43f133
call fcn.0046e649
mov ebx, eax
mov dword [0x608dc4], ebx
push edi
call fcn.0046e6fb
cmp dword [0x608dc4], 0
pop ecx
jne 0x43f156
push dword [edi]
call fcn.004bf2a6
push edi
call fcn.004bf2a6
pop ecx
pop ecx
xor eax, eax
jmp 0x43f1d2
lea ebx, [edi + 0x30]
push str..Message.c
push ebx
call fcn.0041cee3
pop ecx
pop ecx
mov esi, str.A_Message_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0041d0de
mov eax, 0x7d0
mov ecx, ebx
call fcn.0041d107
cmp dword [ebp - 0x80], 0
mov eax, dword [ebp + 0x94]
mov dword [edi + 0x10], eax
je 0x43f1c9
push 0x103
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.004c05d0
push dword [ebp - 0x80]
mov ecx, 0x104
lea eax, [ebp - 0x7c]
call fcn.00485786
mov esi, eax
call fcn.00485a88
mov eax, esi
push eax
push 0x16
lea eax, [edi + 0x14]
pop ecx
call fcn.00485786
add esp, 0x14
mov eax, edi
call fcn.0043ff9d
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x88]
pop edi
xor ecx, ebp
pop esi
call fcn.004bfeb5
add ebp, 0x8c
leave
ret
Function at 0x43f968
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x100000
mov edi, eax
mov dword [ebp - 8], esi
call fcn.00485754
test eax, eax
je 0x43f98e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, edi
call fcn.0043f2b1
test eax, eax
je 0x43f987
mov edx, dword [ebp + 8]
xor ecx, ecx
call fcn.0041ab42
cmp eax, esi
jae 0x43f9b5
test eax, eax
mov dword [ebp - 8], eax
jg 0x43f9b5
mov dword [ebp - 8], 0x400
mov eax, edi
call fcn.0043ff87
test eax, eax
je 0x43f987
mov ecx, dword [ebp + 8]
push 0x435
push str..Message.c
mov edx, 0x4e3c30
call fcn.0041c35a
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x43f9e9
mov eax, edi
call fcn.0043ff9d
jmp 0x43f987
mov ebx, dword [ebp - 8]
lea eax, [ebx + 0x400]
push 1
push eax
call fcn.004bf452
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x43f9e0
push dword [ebp - 0xc]
push ebx
jmp 0x43fa4c
and dword [ebp - 4], 0
test ebx, ebx
jle 0x43fa46
mov eax, dword [edi + 0xc]
inc eax
cmp eax, dword [edi + 8]
jl 0x43fa22
call fcn.0043ff32
test eax, eax
je 0x43fa62
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi]
mov ecx, dword [edi]
mov byte [eax + ecx], dl
inc dword [edi + 0xc]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 4]
jle 0x43fa3e
mov dword [edi + 4], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x43fa10
push dword [ebp - 0xc]
push dword [ebp - 8]
push 1
push esi
call fcn.004c0915
mov ebx, eax
add esp, 0x10
test ebx, ebx
jg 0x43fa08
xor ebx, ebx
inc ebx
jmp 0x43fa64
xor ebx, ebx
push dword [ebp - 0xc]
call fcn.0041c787
mov eax, edi
call fcn.0043ff9d
push esi
call fcn.004bf2a6
pop ecx
pop ecx
mov eax, ebx
jmp 0x43f989

Function at 0x43fabc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x43fb26
cmp byte [ebx], 0
je 0x43fb26
mov eax, esi
call fcn.0043f2b1
test eax, eax
je 0x43fb26
mov eax, esi
call fcn.0043ff87
test eax, eax
je 0x43fb26
cmp dword [ebp + 8], edi
mov dword [ebp - 4], 1
je 0x43fb2c
xor ecx, ecx
mov edx, ebx
call fcn.0041ab42
test eax, eax
jbe 0x43fb01
mov dword [ebp - 4], edi
push 0x4ad
mov edx, 0x4e3c34
push str..Message.c
mov ecx, ebx
call fcn.0041c35a
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
jne 0x43fb38
mov eax, esi
call fcn.0043ff9d
xor eax, eax
pop edi
pop ebx
leave
ret
push 0x4b2
mov edx, 0x4e1360
jmp 0x43fb0b
cmp dword [esi + 4], edi
jle 0x43fb85
cmp dword [ebp + 8], edi
je 0x43fb54
cmp dword [ebp - 4], edi
jne 0x43fb54
push ebx
push 0xa
call fcn.004c040f
pop ecx
xor edi, edi
pop ecx
inc edi
push ebx
push dword [esi + 4]
push 1
push dword [esi]
call fcn.004bf5f0
add edi, eax
add esp, 0x10
cmp edi, dword [esi + 4]
jge 0x43fb85
mov eax, dword [esi]
call fcn.00485776
test eax, eax
jne 0x43fb85
inc dword [0x608dcc]
push ebx
call fcn.0041c787
pop ecx
jmp 0x43fb1f
push ebx
call fcn.0041c787
pop ecx
mov eax, esi
call fcn.0043ff9d
xor eax, eax
inc eax
jmp 0x43fb28
Function at 0x441212
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
cmp dword [0x60c7f4], esi
push edi
jne 0x441342
push 0x103
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.004c05d0
add esp, 0xc
push str.FtpMode.dat
push esi
push esi
call fcn.0045f7e3
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x110]
push 0x4df748
push eax
call fcn.004c054e
push 0x672
mov ebx, str..Network.c
mov esi, 0x4de27c
push ebx
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.0041c35a
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4412e5
lea edi, [ebp - 0x110]
call fcn.0041a56b
test eax, eax
je 0x441342
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x677
push ebx
mov edx, esi
mov ecx, edi
call fcn.0041c35a
test eax, eax
pop ecx
pop ecx
jne 0x441342
cmp dword [0x60c85c], eax
jne 0x441342
mov dword [0x60c85c], 1
jmp 0x441342
push edi
push 1
lea eax, [ebp - 0x114]
push 4
push eax
mov dword [ebp - 0x114], 0xfffe4df9
call fcn.004c0915
add esp, 0x10
cmp eax, 1
push edi
jae 0x441311
call fcn.0041c787
pop ecx
jmp 0x441342
call fcn.0041c787
mov eax, dword [ebp - 0x114]
pop ecx
lea ecx, [eax + 3]
cmp ecx, 6
ja 0x441342
test eax, eax
je 0x441342
jle 0x441334
and dword [0x609734], 0
jmp 0x441342
test eax, eax
jge 0x441342
mov dword [0x609734], 0x8000000
mov ecx, dword [ebp - 4]
mov eax, dword [0x609734]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret
Function at 0x441356
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x103
lea eax, [ebp - 0x10f]
push edi
push eax
mov dword [ebp - 0x114], edi
mov byte [ebp - 0x110], 0
call fcn.004c05d0
mov ecx, dword [ebp + 8]
mov eax, dword [0x609734]
add esp, 0xc
cmp ecx, 0x8000000
mov dword [ebp - 0x120], eax
je 0x4413ae
cmp ecx, edi
jne 0x441557
push str.FtpMode.dat
push edi
push edi
mov dword [0x609734], ecx
call fcn.0045f7e3
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x110]
push 0x4df748
push eax
call fcn.004c054e
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
mov dword [ebp - 0x118], edi
mov ebx, 0x96
jmp 0x4413ec
xor edi, edi
push 0x6c5
push str..Network.c
mov edx, 0x4de4e0
lea ecx, [ebp - 0x110]
call fcn.0041c35a
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp - 0x11c], eax
jne 0x441478
lea edi, [ebp - 0x110]
call fcn.0041a56b
test eax, eax
je 0x441433
push ebx
call esi
inc dword [ebp - 0x118]
cmp dword [ebp - 0x118], 5
jl 0x4413ea
and dword [ebp - 0x118], 0
xor edi, edi
cmp dword [ebp - 0x11c], edi
jne 0x441486
push 0x6da
push str..Network.c
mov edx, 0x4de440
lea ecx, [ebp - 0x110]
call fcn.0041c35a
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x11c], eax
jne 0x441484
push ebx
call esi
inc edi
cmp edi, 5
jl 0x441444
jmp 0x441551
mov dword [ebp - 0x118], 1
jmp 0x44143c
xor edi, edi
cmp dword [ebp - 0x118], edi
je 0x4414b2
push dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
push 1
push 4
push eax
call fcn.004c0915
add esp, 0x10
cmp eax, 1
jae 0x4414b2
mov dword [ebp - 0x114], edi
push 3
pop eax
push 0xfffffffffffffffd
pop ecx
cmp dword [ebp - 0x114], ecx
jl 0x4414c8
cmp dword [ebp - 0x114], eax
jle 0x4414ce
mov dword [ebp - 0x114], edi
cmp dword [ebp + 8], edi
jne 0x4414e7
inc dword [ebp - 0x114]
jne 0x4414ff
mov dword [ebp - 0x114], 1
jmp 0x4414ff
cmp dword [ebp + 8], 0x8000000
jne 0x4414ff
dec dword [ebp - 0x114]
jne 0x4414ff
or dword [ebp - 0x114], 0xffffffff
cmp dword [ebp - 0x114], eax
jle 0x44150f
mov dword [ebp - 0x114], eax
jmp 0x44151d
cmp dword [ebp - 0x114], ecx
jge 0x44151d
mov dword [ebp - 0x114], ecx
push edi
push edi
push dword [ebp - 0x11c]
call fcn.004bfb1f
add esp, 0xc
push dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
push 1
push 4
push eax
call fcn.004bf5f0
push dword [ebp - 0x11c]
call fcn.0041c787
add esp, 0x14
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret
Function at 0x442369
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
xor esi, esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x4423a7
push 1
push dword [ebp - 4]
call fcn.004bf452
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
jne 0x44239c
xor eax, eax
jmp 0x4423f8
push edi
lea eax, [ebp - 4]
push eax
push esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, edi
je 0x4423b8
cmp esi, edi
je 0x442398
push esi
call fcn.004bf2a6
pop ecx
jmp 0x442398
mov edx, dword [esi]
xor eax, eax
cmp edx, edi
push ebx
jle 0x4423ee
lea ecx, [esi + 4]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x4423d1
cmp dword [ecx + 0x10], ebx
jne 0x4423dd
mov ebx, dword [ecx]
cmp ebx, dword [ebp + 8]
jne 0x4423dd
cmp dword [ecx + 0xc], edi
jne 0x4423e7
inc eax
add ecx, 0x38
cmp eax, edx
jl 0x4423c4
jmp 0x4423ee
imul eax, eax, 0x38
mov edi, dword [eax + esi + 0x10]
push esi
call fcn.004bf2a6
pop ecx
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4423fc
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x2c], bl
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
stosw word es:[edi], ax
mov edx, esi
mov dword [ebp - 0x38], esi
stosb byte es:[edi], al
call fcn.00485754
test eax, eax
jne 0x442504
mov al, byte [esi]
cmp al, bl
je 0x44245e
mov ecx, esi
cmp al, 0x2e
je 0x44245e
cmp al, 0x3f
je 0x4424fd
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x44244b
mov eax, esi
call fcn.00444aee
test eax, eax
je 0x442504
mov eax, str._._._._
call fcn.00444aee
test eax, eax
je 0x442504
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
mov dword [ebp - 0x34], ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x442504
push 1
push dword [ebp - 0x34]
call fcn.004bf452
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x442504
push ebx
lea eax, [ebp - 0x34]
push eax
push esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp dword [esi], ebx
mov dword [ebp - 0x30], ebx
jle 0x442525
lea edi, [esi + 4]
mov ecx, dword [edi]
lea eax, [ebp - 0x18]
call fcn.004451a2
mov ecx, dword [edi + 0xc]
lea eax, [ebp - 0x2c]
call fcn.004451a2
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x18]
call fcn.00444bc6
test eax, eax
je 0x44251d
lea edx, [ebp - 0x2c]
mov ecx, str._._._._
call fcn.00444bc6
test eax, eax
je 0x44251d
push edi
call sub.iphlpapi.dll_DeleteIpForwardEntry
test eax, eax
jne 0x442516
inc dword [ebp - 0x30]
jmp 0x44251d
mov byte [0x527fca], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret
mov byte [0x527fcb], 1
inc ebx
add edi, 0x38
cmp ebx, dword [esi]
jl 0x4424b9
push esi
call fcn.004bf2a6
mov eax, dword [ebp - 0x30]
pop ecx
jmp 0x442507
Function at 0x4448d7
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x51f5d0]
xor eax, esp
mov dword [esp + 0x198], eax
and word [esp + 4], 0
push edi
push 0x18e
lea eax, [esp + 0xe]
push 0
push eax
call fcn.004c05d0
add esp, 0xc
test esi, esi
je 0x44494f
cmp dword [ebp + 8], 0
jle 0x44494f
lea eax, [esp + 8]
push eax
push 0x101
mov byte [esi], 0
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x44494b
push dword [ebp + 8]
push esi
call sub.WSOCK32.dll_gethostname
mov edi, eax
call sub.WSOCK32.dll_WSACleanup
test edi, edi
jne 0x44494b
push esi
call fcn.004bf880
test eax, eax
pop ecx
ja 0x44494f
xor eax, eax
jmp 0x444951
mov eax, esi
mov ecx, dword [esp + 0x19c]
pop edi
xor ecx, esp
call fcn.004bfeb5
mov esp, ebp
pop ebp
ret
Function at 0x445574
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x18e
lea eax, [ebp - 0x322]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov word [ebp - 0x324], bx
call fcn.004c05d0
add esp, 0xc
push 0x7f
lea eax, [ebp - 0x8b]
push ebx
push eax
mov byte [ebp - 0x8c], bl
call fcn.004c05d0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x193]
push ebx
push eax
mov byte [ebp - 0x194], bl
call fcn.004c05d0
add esp, 0xc
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x330], ebx
jge 0x4455f7
mov dword [ebp + 8], 0x104
cmp edi, ebx
je 0x44575b
cmp esi, ebx
je 0x44575b
cmp dword [ebp + 8], ebx
jle 0x44575b
call fcn.004af84c
push edi
push 0x7e
pop ecx
lea eax, [ebp - 0x8c]
mov byte [esi], bl
call fcn.00485786
pop ecx
lea eax, [ebp - 0x194]
call fcn.004856d7
mov edi, 0x4f46a8
push edi
lea eax, [ebp - 0x330]
lea ecx, [ebp - 0x8c]
call fcn.004871eb
cmp eax, ebx
pop ecx
mov dword [ebp - 0x328], eax
je 0x445669
push edi
lea eax, [ebp - 0x330]
xor ecx, ecx
call fcn.004871eb
pop ecx
mov dword [ebp - 0x328], eax
mov edx, dword [ebp - 0x328]
call fcn.00485754
test eax, eax
jne 0x44569f
push dword [ebp - 0x328]
mov ecx, 0x104
lea eax, [ebp - 0x194]
call fcn.00485786
pop ecx
push 0x3a
xor eax, eax
lea edi, [ebp - 0x194]
call fcn.004865da
pop ecx
lea ebx, [ebp - 0x8c]
call fcn.00444964
test eax, eax
je 0x44575b
call fcn.0045fb6e
test eax, eax
jne 0x44576c
call fcn.0045fba0
test eax, eax
je 0x4456e3
push 0
call fcn.0045fad4
pop ecx
push eax
mov eax, ebx
push eax
call fcn.004c03bf
test eax, eax
pop ecx
pop ecx
je 0x44576c
lea eax, [ebp - 0x324]
push eax
push 0x101
mov byte [esi], 0
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x44575b
lea ecx, [ebp - 0x8c]
call fcn.004451fb
push 2
mov dword [ebp - 0x32c], eax
push 4
lea eax, [ebp - 0x32c]
push eax
call sub.WSOCK32.dll_gethostbyaddr
mov edi, eax
test edi, edi
je 0x445744
mov eax, dword [edi]
test eax, eax
je 0x445744
push eax
call fcn.004bf880
test eax, eax
pop ecx
jbe 0x445744
push dword [edi]
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00485786
pop ecx
xor edi, edi
jmp 0x445747
or edi, 0xffffffff
call sub.WSOCK32.dll_WSACleanup
test edi, edi
jne 0x44575b
push esi
call fcn.004bf880
test eax, eax
pop ecx
ja 0x44579e
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret
call fcn.0045fb6e
cmp eax, 1
jne 0x44577d
push str.WebSrv22
jmp 0x445793
call fcn.0045fb6e
cmp eax, 2
jne 0x44578e
push str.WebSrv21
jmp 0x445793
push str.Mission_Control
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00485786
pop ecx
lea eax, [ebp - 0x194]
push eax
mov eax, dword [ebp + 8]
call fcn.00485856
pop ecx
call fcn.004af84c
mov eax, esi
jmp 0x44575d
Function at 0x447741
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and word [ebp - 0x14], 0
and dword [ebp - 4], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x212e
mov esi, str..Network.c
push esi
stosd dword es:[edi], eax
push str.addrchng.flg
push 0
stosw word es:[edi], ax
call fcn.0045f7e3
pop ecx
pop ecx
mov edx, 0x4de3b8
mov ecx, eax
call fcn.0041c35a
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4477c8
push 0x2133
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004b0243
call fcn.0040ffd6
push edi
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004bf5f0
push edi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004bf5f0
push edi
call fcn.0041c787
xor eax, eax
add esp, 0x30
inc eax
pop edi
pop esi
leave
ret