joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436468
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x436553
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4364db
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.00406c34
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x436538
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x436538
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.00406dfc
mov eax, dword [ebp - 0xc]
call fcn.004061f8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x436538
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406dfc
mov eax, dword [ebp - 0x10]
call fcn.004061f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43655a
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405b60
ret

Function at 0x436bec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041ab40
test eax, eax
je 0x436c9d
cmp word [eax + 0x18], 0x20b
jne 0x436c2a
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x436c3c
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x436c9d
jmp 0x436c97
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x436c53
push ebp
call fcn.00436a2c
pop ecx
jmp 0x436c9d
cmp dword [esi + 0x10], 0
je 0x436c94
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x436c8f
cmp edi, dword [ebx]
jne 0x436c8c
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x436c8c
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x436c61
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x436c42
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437eec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x438071
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.00406ba8
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x438045
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x438045
cmp dword [0x69ecdc], 0
jne 0x437f6e
push 0x438080
push 0x4380ac
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a198
mov dword [0x69ecdc], eax
cmp dword [0x69ecdc], 0
je 0x437fa0
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x69ecdc]
test eax, eax
je 0x437fa0
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406db8
jmp 0x437fd7
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x437fd7
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.00405df0
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.00406dd4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x438003
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.00435874
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040f8a4
cmp dword [edi], 0
je 0x438045
mov eax, dword [edi]
call fcn.00406e68
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x438045
test bl, bl
je 0x438030
mov eax, edi
mov edx, 0x4380d0
call fcn.00406f0c
jmp 0x438045
mov eax, dword [edi]
call fcn.00406e68
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.004072dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438078
lea eax, [ebp - 0x21c]
call fcn.00406b98
lea eax, [ebp - 0x218]
call fcn.00405b3c
lea eax, [ebp - 4]
call fcn.00408de8
ret
Function at 0x438b1c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
xor eax, eax
push ebp
push 0x438bd2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438b50
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438bbc
lea eax, [ebp - 4]
call fcn.00405d1c
call fcn.00406e68
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x438bb7
lea eax, [ebp - 4]
call fcn.00405d1c
call fcn.00406e68
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, esi
pop ecx
call fcn.00403418
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438bd9
lea eax, [ebp - 4]
call fcn.00406b98
ret
Function at 0x43ad70
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x43af24
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.0043aca4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43af02
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x689ed4], 0
jne 0x43aed6
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.00436628
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040dfd4
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x43af44
call fcn.00405f80
mov eax, dword [ebp - 0x2c]
call fcn.004061f8
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x43ae4a
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040dfd4
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x43af44
call fcn.00405f80
mov eax, dword [ebp - 0x34]
call fcn.004061f8
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x43ae65
xor esi, esi
push 0
push 0x43af5c
push 0x43af68
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x43aec5
test bl, bl
je 0x43aeac
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.0040b0a4
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x43aec5
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x43aed6
mov eax, esi
call fcn.00469238
mov dword [0x689ed4], esi
cmp dword [0x689ed4], 0
je 0x43aeec
mov eax, dword [0x689ed4]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43af09
mov eax, dword [ebp - 8]
call fcn.0043ad5c
ret

Function at 0x43ef78
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x689f00], 0
jne 0x43f00b
xor eax, eax
call fcn.0041a2e0
mov dword [0x689f00], eax
cmp dword [0x689f00], 0
je 0x43f00b
mov eax, 0x43eddc
xor ecx, ecx
xor edx, edx
call fcn.0041a7e4
mov dword [0x689f04], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x689f14], eax
push 0x689ef8
push 4
push 0
push 0x43ee24
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x689efc], eax
cmp dword [0x689efc], 0
je 0x43f00b
mov edx, 0x43f018
mov eax, dword [0x689ef8]
call fcn.00437284
push 2
mov eax, dword [0x689efc]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x689efc]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x43f054
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x689f00], 0
je 0x43f125
mov ebx, dword [0x689f14]
xor eax, eax
mov dword [0x689f14], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x689f10], 0
je 0x43f09d
mov ebx, dword [0x689f10]
xor eax, eax
mov dword [0x689f10], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x689f0c], 0xffffffff
mov eax, 0x43eddc
xor ecx, ecx
xor edx, edx
call fcn.0041aa10
push 0x1f4
mov eax, dword [0x689efc]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43f0ea
push 0
mov eax, dword [0x689efc]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x689f18], 0
je 0x43f0ea
mov eax, dword [0x689f18]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x689f18], eax
mov eax, dword [0x689efc]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x689ef8]
call fcn.00436ff8
xor eax, eax
mov dword [0x689efc], eax
xor eax, eax
mov dword [0x689ef8], eax
xor eax, eax
mov dword [0x689f00], eax
pop ebx
ret
Function at 0x44708c
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004061f8
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4470b8
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4470b8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x448cb4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x68959c], 0
je 0x448cda
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00448c4c
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.00434c18
test al, al
jne 0x448d5a
cmp esi, 0x80090318
jne 0x448d62
test edi, edi
je 0x448d62
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x448d92
cmp dword [ebp - 0x24], 0
je 0x448d92
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x448d88
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x448da6
cmp dword [ebp - 0x18], 0
je 0x448da6
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x448db4
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeac
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x448e39
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x6895bc]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x448f73
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x448f73
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
mov dword [esp + 0x160], 2
xor eax, eax
mov dword [esp + 0x164], eax
lea eax, [esp + 0x160]
push eax
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00448c4c
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.00448cb4
mov ebp, eax
sub ebp, 0x80090318
je 0x448f6b
sub ebp, 0x7ff6fce8
je 0x448ee8
sub ebp, 0x90312
je 0x448f30
sub ebp, 0xe
je 0x448f5c
jmp 0x448f73
cmp dword [esp + 0x30], 5
jne 0x448f2a
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403418
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x448f73
cmp dword [esp + 0x30], 5
jne 0x448f55
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403418
mov esi, dword [esp + 0x2c]
jmp 0x448dce
xor esi, esi
jmp 0x448dce
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x448dce
or edi, 0xffffffff
jmp 0x448dce
movzx eax, byte [esp]
add esp, 0x154
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x448f84
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004061e8
xor eax, eax
push ebp
push 0x449101
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.004061f8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405d4c
call fcn.00405ed0
mov edi, eax
mov dword [ebp - 0x10], 0x400
cmp dword [ebx + 8], 0
je 0x4490dd
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x68]
jbe 0x4490dd
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
jmp 0x4490dd
cmp edi, dword [ebp - 0x10]
jbe 0x448ffa
mov esi, dword [ebp - 0x10]
jmp 0x448ffc
mov esi, edi
cmp dword [ebx + 8], 0
je 0x4490c2
mov edx, dword [ebx + 0x78]
add edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.00403418
push 3
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
add eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 3
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x6c]
push eax
push 3
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], 6
xor eax, eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
push 3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00448c4c
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebx + 0x54]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x4490b7
push 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4490bb
xor eax, eax
jmp 0x4490bd
mov al, 1
mov byte [ebp - 5], al
jmp 0x4490d8
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg byte [ebp - 5]
add dword [ebp - 0xc], esi
sub edi, esi
cmp byte [ebp - 5], 0
je 0x4490eb
test edi, edi
ja 0x448ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449108
lea eax, [ebp - 4]
call fcn.00405b3c
ret
Function at 0x449e74
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x44a0db
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x44a097
cmp byte [0x6895a4], 0
jne 0x449eff
mov eax, ebx
call fcn.00436cfc
test al, al
je 0x449f3c
push 0x44a0fc
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.0040f594
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041c65c
push dword [ebp - 0x21c]
push 0x44a114
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040604c
jmp 0x449f4b
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00406dfc
push 0x44a124
lea eax, [ebp - 0x228]
mov edx, dword [0x689f88]
mov ecx, 0
call fcn.00405df0
push dword [ebp - 0x228]
push 0x44a134
push 0x44a144
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.00447ad4
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.00406dfc
push dword [ebp - 0x22c]
push 0x44a160
push dword [ebp - 4]
push 0x44a178
push 0x44a134
push 0x44a188
push 0x44a134
push 0x44a1b8
push dword [ebp - 4]
push 0x44a178
push 0x44a134
push 0x44a134
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.0040604c
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.00448f84
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x44a097
cmp esi, 0xff
jbe 0x44a009
mov ebx, 0xff
jmp 0x44a00b
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44a02b
cmp ebx, dword [ebp - 0x14]
je 0x44a03d
mov edx, 0x44a134
mov eax, edi
call fcn.00448f84
mov byte [ebp - 0xd], 0
jmp 0x44a097
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.0041c524
lea eax, [ebp - 0x234]
mov edx, 0x44a134
call fcn.00405f04
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.00448f84
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x44a08f
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x449ffa
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a0e2
lea eax, [ebp - 0x234]
call fcn.00405b3c
lea eax, [ebp - 0x230]
call fcn.00406b98
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.00405b60
lea eax, [ebp - 4]
call fcn.00405b3c
ret
Function at 0x44c2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44c3c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x44c2ea
mov dword [ebp - 0x10], 0x600
jmp 0x44c2f1
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.004064dc
test esi, esi
jbe 0x44c3a9
cmp esi, dword [ebp - 0x10]
jae 0x44c317
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.004064dc
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405d4c
call fcn.00405ed0
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44c352
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405d4c
call fcn.00405ed0
cmp eax, dword [ebp - 0x14]
je 0x44c356
xor ebx, ebx
jmp 0x44c3a9
cmp byte [ebp + 8], 0
je 0x44c375
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0041c65c
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.0044b5e4
mov ebx, eax
jmp 0x44c381
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0044b5e4
mov ebx, eax
test bl, bl
je 0x44c3a9
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0044bb78
test esi, esi
ja 0x44c306
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c3ce
lea eax, [ebp - 0x18]
call fcn.00405b3c
lea eax, [ebp - 4]
call fcn.00405b3c
ret
Function at 0x451bc4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
xor eax, eax
push ebp
push 0x451d18
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040f8a4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406bfc
cmp dword [ebp - 4], 0
je 0x451cee
lea eax, [ebp - 4]
call fcn.00405d1c
call fcn.00406e68
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00405d1c
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x451c42
lea eax, [ebp - 4]
call fcn.00405d1c
call fcn.00406e68
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004072dc
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x451c8e
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x451c8a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00451bc4
pop ecx
test al, al
je 0x451c86
push 0
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x451c8a
xor ebx, ebx
jmp 0x451cf0
mov bl, 1
jmp 0x451cf0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406dfc
mov eax, dword [ebp - 0xc]
call fcn.004061f8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x451cea
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00451bc4
pop ecx
test al, al
je 0x451ce6
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406dfc
mov eax, dword [ebp - 0x10]
call fcn.004061f8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x451cea
xor ebx, ebx
jmp 0x451cf0
mov bl, 1
jmp 0x451cf0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451d1f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405b60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret