joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d500
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c150
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x48948c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x58]
call fcn.00457910
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x58]
mov byte [eax + 1], 0
mov ecx, dword [ebp - 0x58]
mov byte [ecx + 2], 0
mov edx, dword [ebp - 0x58]
mov dword [edx + 4], 0xffffffff
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x58]
cmp dword [edx + 4], 0xffffffff
jne 0x41d5a1
push str.unable_to_create_udp_socket_n
lea ecx, [ebp - 0x54]
call fcn.0040d100
mov byte [ebp - 4], 1
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040bc50
push 0x482418
lea ecx, [ebp - 0x38]
push ecx
call fcn.00439310
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040df60
mov dword [ebp - 0x10], 1
push 4
lea edx, [ebp - 0x10]
push edx
push 0x20
push 0xffff
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
push 0
mov edx, dword [ebp - 0x58]
add edx, 0x18
push edx
call fcn.00431910
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 0x58]
mov word [ecx + 0x18], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x41d740
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x48948c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x41d786
xor eax, eax
jmp 0x41d7ac
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
movzx edx, word [ebp - 0x16]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004313c7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bff6
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x48948c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push ecx
fld dword [ebp + 0x18]
fstp dword [esp]
push ecx
fld dword [ebp + 0x14]
fstp dword [esp]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.00422280
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x28]
mov dword [edx], vtable.TUIO::TuioContainer.0
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
call fcn.004235e0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebp - 0x28]
fldz
fstp dword [edx + 0x20]
mov eax, dword [ebp - 0x28]
fldz
fstp dword [eax + 0x24]
mov ecx, dword [ebp - 0x28]
fldz
fstp dword [ecx + 0x28]
mov edx, dword [ebp - 0x28]
fldz
fstp dword [edx + 0x2c]
mov eax, dword [ebp - 0x28]
push ecx
fld dword [eax + 8]
fstp dword [esp]
mov ecx, dword [ebp - 0x28]
push ecx
fld dword [ecx + 4]
fstp dword [esp]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [edx + 0xc]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00422280
mov byte [ebp - 4], 3
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
call fcn.004237b0
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x4c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004222f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040d140
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x422570
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bfae
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x48948c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
push ecx
fld dword [ebp + 0x10]
fstp dword [esp]
push ecx
fld dword [ebp + 0xc]
fstp dword [esp]
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.00422200
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov dword [eax], vtable.TUIO::TuioContainer.0
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
call fcn.004235e0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 0x28]
fldz
fstp dword [eax + 0x20]
mov ecx, dword [ebp - 0x28]
fldz
fstp dword [ecx + 0x24]
mov edx, dword [ebp - 0x28]
fldz
fstp dword [edx + 0x28]
mov eax, dword [ebp - 0x28]
fldz
fstp dword [eax + 0x2c]
mov ecx, dword [ebp - 0x28]
push ecx
fld dword [ecx + 8]
fstp dword [esp]
mov edx, dword [ebp - 0x28]
push ecx
fld dword [edx + 4]
fstp dword [esp]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [eax + 0xc]
push edx
lea ecx, [ebp - 0x24]
call fcn.00422280
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
call fcn.004237b0
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x4c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004222f0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bf30
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48948c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push ecx
fld dword [ebp + 0x14]
fstp dword [esp]
push ecx
fld dword [ebp + 0x10]
fstp dword [esp]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.00422370
mov edx, dword [ebp - 0x28]
fld dword [ebp + 0x18]
fstp dword [edx + 0x20]
mov eax, dword [ebp - 0x28]
fld dword [ebp + 0x1c]
fstp dword [eax + 0x24]
mov ecx, dword [ebp - 0x28]
fld dword [ecx + 0x20]
mov edx, dword [ebp - 0x28]
fmul dword [edx + 0x20]
mov eax, dword [ebp - 0x28]
fld dword [eax + 0x24]
mov ecx, dword [ebp - 0x28]
fmul dword [ecx + 0x24]
faddp st(1)
fstp dword [ebp - 0x2c]
fld dword [ebp - 0x2c]
push ecx
fstp dword [esp]
call fcn.004220c0
add esp, 4
mov edx, dword [ebp - 0x28]
fstp dword [edx + 0x28]
mov eax, dword [ebp - 0x28]
fld dword [ebp + 0x20]
fstp dword [eax + 0x2c]
mov ecx, dword [ebp - 0x28]
push ecx
fld dword [ecx + 8]
fstp dword [esp]
mov edx, dword [ebp - 0x28]
push ecx
fld dword [edx + 4]
fstp dword [esp]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [eax + 0xc]
push edx
lea ecx, [ebp - 0x24]
call fcn.00422280
mov byte [ebp - 4], 1
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
call fcn.004237b0
mov ecx, dword [ebp - 0x28]
fld dword [ecx + 0x2c]
fcomp qword [0x47ec68]
fnstsw ax
test ah, 0x41
jne 0x422a36
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x4c], 1
jmp 0x422a5f
mov eax, dword [ebp - 0x28]
fld dword [eax + 0x2c]
fcomp qword [0x47ec68]
fnstsw ax
test ah, 5
jp 0x422a55
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x4c], 2
jmp 0x422a5f
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x4c], 3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004222f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040d140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x422a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bef8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48948c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
push ecx
fld dword [ebp + 0xc]
fstp dword [esp]
push ecx
fld dword [ebp + 8]
fstp dword [esp]
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.00422350
mov eax, dword [ebp - 0x28]
fld dword [ebp + 0x10]
fstp dword [eax + 0x20]
mov ecx, dword [ebp - 0x28]
fld dword [ebp + 0x14]
fstp dword [ecx + 0x24]
mov edx, dword [ebp - 0x28]
fld dword [edx + 0x20]
mov eax, dword [ebp - 0x28]
fmul dword [eax + 0x20]
mov ecx, dword [ebp - 0x28]
fld dword [ecx + 0x24]
mov edx, dword [ebp - 0x28]
fmul dword [edx + 0x24]
faddp st(1)
fstp dword [ebp - 0x2c]
fld dword [ebp - 0x2c]
push ecx
fstp dword [esp]
call fcn.004220c0
add esp, 4
mov eax, dword [ebp - 0x28]
fstp dword [eax + 0x28]
mov ecx, dword [ebp - 0x28]
fld dword [ebp + 0x18]
fstp dword [ecx + 0x2c]
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
call fcn.004237f0
mov edx, dword [ebp - 0x28]
push ecx
fld dword [edx + 8]
fstp dword [esp]
mov eax, dword [ebp - 0x28]
push ecx
fld dword [eax + 4]
fstp dword [esp]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ecx + 0xc]
push eax
lea ecx, [ebp - 0x24]
call fcn.00422280
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
call fcn.004237b0
mov edx, dword [ebp - 0x28]
fld dword [edx + 0x2c]
fcomp qword [0x47ec68]
fnstsw ax
test ah, 0x41
jne 0x422b85
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x4c], 1
jmp 0x422bae
mov ecx, dword [ebp - 0x28]
fld dword [ecx + 0x2c]
fcomp qword [0x47ec68]
fnstsw ax
test ah, 5
jp 0x422ba4
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x4c], 2
jmp 0x422bae
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x4c], 3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004222f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4231a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c400
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x48948c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
add ecx, 0x30
call fcn.00423780
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x2c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x28], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x24], edx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 1
push ecx
fld dword [ebp + 0x14]
fstp dword [esp]
push ecx
fld dword [ebp + 0x10]
fstp dword [esp]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.004226a0
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x30]
call fcn.00422430
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0xc
call fcn.00422110
lea ecx, [ebp - 0x4c]
call fcn.0040d140
lea ecx, [ebp - 0x18]
call fcn.004221d0
mov dword [ebp - 0x58], eax
fild dword [ebp - 0x58]
fdiv qword [0x47eca8]
fstp dword [ebp - 0x44]
mov ecx, dword [ebp - 0x50]
fld dword [ecx + 0x54]
fstp dword [ebp - 0x10]
mov edx, dword [ebp - 0x50]
fld dword [edx + 0x58]
fstp dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
fld dword [ebp + 0x18]
fstp dword [eax + 0x54]
mov ecx, dword [ebp - 0x50]
fld dword [ecx + 0x54]
fsub dword [ebp - 0x10]
fdiv qword [0x47ecb8]
fstp qword [ebp - 0x3c]
fld qword [0x47ecb0]
fcomp qword [ebp - 0x3c]
fnstsw ax
test ah, 5
jp 0x4232b1
fld qword [ebp - 0x3c]
fsub qword [0x47ecb8]
fstp qword [ebp - 0x3c]
jmp 0x4232cd
fld qword [0x47ecb0]
fcomp qword [ebp - 0x3c]
fnstsw ax
test ah, 0x41
jne 0x4232cd
fld qword [ebp - 0x3c]
fadd qword [0x47ecb8]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
fstp dword [ebp - 0x5c]
fld dword [ebp - 0x5c]
fdiv dword [ebp - 0x44]
mov edx, dword [ebp - 0x50]
fstp dword [edx + 0x58]
mov eax, dword [ebp - 0x50]
fld dword [eax + 0x58]
fsub dword [ebp - 0x40]
fdiv dword [ebp - 0x44]
mov ecx, dword [ebp - 0x50]
fstp dword [ecx + 0x5c]
mov edx, dword [ebp - 0x50]
fld dword [edx + 0x5c]
fcomp qword [0x47ec68]
fnstsw ax
test ah, 0x44
jnp 0x423317
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x4c], 3
jne 0x423317
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x4c], 5
lea ecx, [ebp - 0x18]
call fcn.0040d140
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004222f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040d140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x429ca0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x468fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48948c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48948c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
xor edi, edi
cmp ebp, edi
mov ebx, ecx
mov dword [esp + 0x14], ebx
jne 0x429cf3
push edi
push edi
push edi
push 2
call fcn.0042bca0
xor al, al
jmp 0x429e86
mov esi, dword [ebx + 0x1c]
cmp esi, edi
je 0x429d11
lea ebx, [ebx]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x44]
push 1
call edx
cmp esi, edi
jne 0x429d00
push 2
or eax, 0xffffffff
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
push edi
push ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
call fcn.00435ffd
push ebp
call fcn.00439c1f
xor esi, esi
push esi
push esi
push ebp
mov edi, eax
call fcn.00435ffd
add esp, 0x1c
cmp edi, esi
jg 0x429d55
push esi
push esi
push esi
push 0xd
mov ecx, ebx
call fcn.0042bca0
xor al, al
jmp 0x429e86
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], esi
mov byte [esp + 0x1c], 0
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], esi
call fcn.00429660
lea eax, [edi + 1]
push eax
call fcn.004306b0
push ebp
push 1
mov ebx, eax
push edi
push ebx
mov byte [ebx], 0
call fcn.00439a65
add esp, 0x14
cmp eax, 1
je 0x429dc9
push ebx
call fcn.0043198a
mov ecx, dword [esp + 0x18]
add esp, 4
push 0
push 0
push 0
push 2
call fcn.0042bca0
cmp dword [esp + 0x30], 0x10
jb 0x429dc2
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00431514
add esp, 4
xor al, al
jmp 0x429e86
mov byte [ebx + edi], 0
cmp byte [ebx], 0
mov eax, ebx
mov esi, ebx
je 0x429e30
mov cl, byte [esi]
cmp cl, 0xa
jne 0x429df6
mov edx, esi
sub edx, eax
add edx, 1
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.004040a0
add esi, 1
mov eax, esi
jmp 0x429e2b
cmp cl, 0xd
jne 0x429e28
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x429e0e
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004040a0
push 0xa
push 1
lea ecx, [esp + 0x20]
call fcn.004030a0
cmp byte [esi + 1], 0xa
jne 0x429def
add esi, 2
mov eax, esi
jmp 0x429e2b
add esi, 1
cmp byte [esi], 0
jne 0x429dd6
sub esi, eax
je 0x429e3f
push esi
push eax
lea ecx, [esp + 0x20]
call fcn.004040a0
push ebx
call fcn.0043198a
mov eax, dword [esp + 0x20]
add esp, 4
cmp dword [esp + 0x30], 0x10
jae 0x429e57
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x4c]
mov esi, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 8]
push ecx
push 0
push eax
mov ecx, esi
call edx
cmp byte [esi + 0x48], 0
lea ecx, [esp + 0x18]
je 0x429e7f
call fcn.0040df60
xor al, al
jmp 0x429e86
call fcn.0040df60
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004313c7
add esp, 0x30
ret 8
Function at 0x42a1c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4690c3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48948c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
call fcn.0042dfb0
xor ebx, ebx
or eax, 0xffffffff
mov dword [edi + 0xc], eax
mov dword [edi + 8], eax
lea ebp, [edi + 0x24]
mov dword [edi + 0x10], ebx
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], 1
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
lea esi, [edi + 0x48]
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [edi], vtable.TiXmlElement.0
call fcn.0042dfb0
or eax, 0xffffffff
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi], vtable.TiXmlAttribute.0
mov dword [esi + 0x2c], ebx
mov eax, 0xf
mov dword [esi + 0x30], eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], ebx
mov byte [esi + 0x38], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x54], esi
mov dword [esi + 0x50], esi
mov esi, dword [esp + 0x28]
mov eax, esi
mov byte [esp + 0x20], 1
mov dword [edi + 0x20], ebx
mov dword [edi + 0x1c], ebx
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x42a280
sub eax, ecx
push eax
push esi
mov ecx, ebp
call fcn.0040d020
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x431150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x43115f
mov eax, dword [eax + 4]
jmp 0x431162
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4311af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
je 0x43119e
cmp eax, 3
je 0x43119e
cmp eax, 0x7b
je 0x43119e
cmp eax, 0x57
je 0x43119e
cmp eax, 0x35
je 0x43119e
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [esp + 4]
mov dword [ecx], 0
mov dword [eax], 1
ret
mov ecx, dword [esp + 0xc]
test al, 0x10
mov dword [ecx], 0
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4311d1
mov dword [esp + 8], 2
mov edx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], edx
ret
Function at 0x431310
Capabilities:
Create directory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x18], 0x10
jb 0x431321
mov eax, dword [edi + 4]
jmp 0x431324
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x431342
mov eax, dword [esp + 0xc]
mov dword [eax], 0
mov byte [eax + 4], 1
pop edi
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x43137f
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.00431150
add esp, 0xc
cmp dword [esp + 0x14], 3
jne 0x43137f
mov eax, dword [esp + 0x10]
pop esi
mov dword [eax], 0
mov byte [eax + 4], 0
pop edi
pop ecx
ret
mov eax, dword [esp + 0x10]
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop edi
pop ecx
ret

Function at 0x4313c7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48948c]
jne 0x4313d1
repz ret
jmp fcn.0043c28a

Function at 0x435cee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x435d1f
call fcn.0043bfef
mov dword [eax], esi
call fcn.0043bfdc
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00435a97
add esp, 0x14
push 0x16
pop eax
jmp 0x435d74
test dword [ebp + 0xc], 0xfffffff9
jne 0x435cfb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x435d4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043c002
pop ecx
call fcn.0043bfdc
mov eax, dword [eax]
jmp 0x435d74
test al, 0x10
jne 0x435d72
test al, 1
je 0x435d72
test byte [ebp + 0xc], 2
je 0x435d72
call fcn.0043bfef
mov dword [eax], 5
call fcn.0043bfdc
mov dword [eax], 0xd
jmp 0x435d43
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44bec8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043c402
and dword [ebp - 4], 0
cmp dword [0x48d008], 0
mov ebx, eax
jne 0x44bf79
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44c02a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x479058
push edi
call esi
test eax, eax
je 0x44c02a
push eax
call fcn.0043c390
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48d008], eax
call esi
push eax
call fcn.0043c390
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48d00c], eax
call esi
push eax
call fcn.0043c390
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48d010], eax
call esi
push eax
call fcn.0043c390
pop ecx
mov dword [0x48d018], eax
test eax, eax
je 0x44bf79
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043c390
pop ecx
mov dword [0x48d014], eax
mov eax, dword [0x48d014]
cmp eax, ebx
je 0x44bfd1
cmp dword [0x48d018], ebx
je 0x44bfd1
push eax
call fcn.0043c40b
push dword [0x48d018]
mov esi, eax
call fcn.0043c40b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44bfd1
test edi, edi
je 0x44bfd1
call esi
test eax, eax
je 0x44bfc8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44bfc8
test byte [ebp - 0xc], 1
jne 0x44bfd1
or dword [ebp + 0x10], 0x200000
jmp 0x44c00a
mov eax, dword [0x48d00c]
cmp eax, ebx
je 0x44c00a
push eax
call fcn.0043c40b
pop ecx
test eax, eax
je 0x44c00a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44c00a
mov eax, dword [0x48d010]
cmp eax, ebx
je 0x44c00a
push eax
call fcn.0043c40b
pop ecx
test eax, eax
je 0x44c00a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48d008]
call fcn.0043c40b
pop ecx
test eax, eax
je 0x44c02a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44c02c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44ffe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0xffffffff
jne 0x450004
push str.INVALID_SOCKET
call fcn.00437de0
add esp, 4
or eax, 0xffffffff
jmp 0x450062
mov dword [ebp - 4], 0x10
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00431910
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x450058
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x38], 1
jmp 0x45005f
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x38], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8