joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438410
Capabilities:
Create udp socket
Initialize winsock library
Resolve dns
Send data
Send data on socket

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x1a4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1bc]
push esi
push edi
mov edi, ecx
cmp edi, 0x5a0
mov esi, edx
jbe 0x438440
mov edi, 0x5a0
lea eax, [esp + 0x20]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4384e1
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x4384da
mov ecx, dword [esp + 0x1c0]
xor eax, eax
push ecx
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
mov edx, dword [esi + 0xc]
xor ecx, ecx
cmp dword [edx], ecx
jne 0x4384bb
mov eax, edx
jmp 0x4384b0
add eax, 4
add ecx, 1
cmp dword [eax], 0
je 0x4384b0
mov edx, dword [edx + ecx*4]
mov eax, dword [edx]
test eax, eax
mov dword [esp + 0x14], eax
je 0x4384da
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
push edi
push ebp
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005787fd
add esp, 0x1ac
ret

Function at 0x438500
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5a7978
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.0040b6f0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x438554
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.0040f950
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
lea eax, [esp + 0x14]
mov ecx, esi
mov word [esi + 4], di
call fcn.0040b6f0
cmp dword [esp + 0x24], 8
jb 0x43859e
mov eax, dword [esp + 0x10]
push eax
call fcn.00578327
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4385f0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x5a793b
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x820], eax
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x834]
mov dword fs:[0], eax
xor edi, edi
push 0x802
lea eax, [esp + 0x32]
push edi
push eax
mov word [esp + 0x38], di
call fcn.00580260
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebp, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], edi
mov word [esp + 0x14], di
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x438670
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x30]
push edx
lea esi, [esp + 0x18]
call fcn.0040bce0
push 0xffffffffffffffff
push edi
mov eax, esi
mov ecx, ebx
mov dword [esp + 0x844], edi
call fcn.0040b6f0
cmp dword [esp + 0x28], 8
jb 0x4386b5
mov eax, dword [esp + 0x14]
push eax
call fcn.00578327
add esp, 4
xor eax, eax
cmp ebp, edi
setge al
mov ecx, dword [esp + 0x834]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.005787fd
add esp, 0x830
ret

Function at 0x438be0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x17c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x178], eax
mov eax, dword [esp + 0x180]
push ebp
lea edx, [esp + 8]
push edx
push 0x40
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x140]
push eax
push ebx
push esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0
call edi
cmp dword [esp + 8], 0x40
jne 0x438cf5
cmp word [esp + 0x138], 0x5a4d
jne 0x438cf5
mov ecx, dword [esp + 0x174]
lea edx, [esp + 8]
push edx
push pe_nt_image_headers32
lea eax, [esp + 0x20]
push eax
lea ebp, [ebx + ecx]
push ebp
push esi
mov dword [esp + 0x1c], 0
call edi
cmp dword [esp + 8], 0xf8
jne 0x438cf5
cmp dword [esp + 0x18], 0x4550
jne 0x438cf5
cmp word [esp + 0x1c], 0x14c
jne 0x438cf5
cmp word [esp + 0x30], 0x10b
jne 0x438cf5
add ebp, 0xf8
cmp word [esp + 0x1e], 0
mov dword [esp + 0xc], 0
jbe 0x438cf5
lea ecx, [esp + 8]
push ecx
push 0x28
lea edx, [esp + 0x118]
push edx
push ebp
push esi
mov dword [esp + 0x1c], 0
call edi
cmp dword [esp + 8], 0x28
jne 0x438cf5
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x438cf5
mov ecx, dword [esp + 0x134]
and ecx, 0x20000020
cmp ecx, 0x20000020
je 0x438d0d
mov eax, dword [esp + 0xc]
movzx edx, word [esp + 0x1e]
add eax, 1
cmp eax, edx
mov dword [esp + 0xc], eax
jb 0x438c9f
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.005787fd
add esp, 0x17c
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x120]
add eax, ebx
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
add eax, edx
mov dword [ecx], eax
mov ecx, dword [esp + 0x17c]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.005787fd
add esp, 0x17c
ret
Function at 0x440b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a21a3
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.CFaceSetDlg.0
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
call fcn.004642e0
mov dword [esi + 0x58], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x58]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x58]
mov dword [eax], eax
mov eax, dword [esi + 0x58]
mov dword [eax + 8], eax
mov dword [esi + 0x5c], edi
mov byte [esp + 0x14], 1
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
call fcn.00464620
mov dword [esi + 0x70], eax
mov byte [eax + 0x1d], 1
mov eax, dword [esi + 0x70]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x70]
mov dword [eax], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 8], eax
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
push 0xffffff
mov dword [esi + 0x84], edi
mov dword [esi + 0x80], edi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x440e20
Capabilities:
Hide graphical window

Disassembly:
push ecx
push edi
call fcn.00528b80
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esi + 0x80], eax
mov eax, dword [esi + 4]
push 0x54c
push eax
call edi
mov ecx, dword [esi + 4]
push 0x54d
push ecx
mov dword [esi + 0x78], eax
call edi
mov edx, dword [esi + 0x78]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [esi + 0x7c], eax
call edi
mov eax, dword [esi + 0x7c]
push 0
push eax
call edi
mov ecx, dword [esi + 0x78]
mov edi, dword [sym.imp.USER32.dll_SetScrollRange]
push 1
push 0x64
push 0
push 2
push ecx
call edi
mov edx, dword [esi + 0x7c]
push 1
push 0x64
push 0
push 2
push edx
call edi
mov eax, dword [esi + 0x78]
mov edi, dword [sym.imp.USER32.dll_SetScrollPos]
push 1
push 0
push 2
push eax
call edi
mov ecx, dword [esi + 0x7c]
push 1
push 0
push 2
push ecx
call edi
push esi
call fcn.00441b90
mov edx, dword [esp + 0xc]
mov dword [edx], 0
mov eax, 1
pop edi
pop ecx
ret 4
Function at 0x443910
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5aa4db
mov eax, dword fs:[0]
push eax
sub esp, 0x85c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x858], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x870]
mov dword fs:[0], eax
mov ebp, dword [0x602cc8]
mov esi, 0x602cc0
lea edi, [esp + 0x14]
mov ebx, ecx
call fcn.00444970
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x443970
cmp eax, 0x602cc4
je 0x443975
call fcn.00578ff3
cmp dword [esi + 4], ebp
je 0x4439c4
mov ecx, 0x602cc0
call fcn.00444870
mov esi, eax
mov eax, 1
test byte [0x6036fc], al
mov ecx, 0x213
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
jne 0x4439b1
or dword [0x6036fc], eax
push 0x5afe30
call fcn.0057a6a7
add esp, 4
call fcn.00486380
test eax, eax
jne 0x4439c4
lea eax, [esp + 0x1c]
push eax
call fcn.00485d40
mov ecx, dword [0x601d48]
test ecx, ecx
mov dword [ebx + 0x8c8], ecx
mov edx, dword [0x601d4c]
mov dword [ebx + 0x8cc], edx
mov eax, dword [0x601d50]
mov dword [ebx + 0x8d0], eax
je 0x443a90
test edx, edx
je 0x443a90
lea ebx, [esp + 0x14]
call fcn.004747c0
mov dword [esp + 0x878], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x443a3c
lea eax, [ecx - 1]
test eax, eax
jl 0x443ab8
cmp eax, ecx
jg 0x443ab8
movzx eax, word [edx + eax*2]
cmp ax, 0x5c
je 0x443a3c
push 0x5c
mov edi, ebx
call fcn.00404400
push 0xf
push str.QQPYTrayBar.exe
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403fc0
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x878], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443a90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x870]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x858]
xor ecx, esp
call fcn.005787fd
add esp, 0x868
ret
push 0x80070057
call fcn.00404550
int3
Function at 0x445770
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x5a7870
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [edi]
xor ebx, ebx
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [edi + 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x4457c1
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
call fcn.00446620
mov eax, dword [edi + 4]
push eax
call esi
test eax, eax
jne 0x4457d8
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
push edi
call fcn.00446620
mov edx, dword [edi + 4]
mov ecx, dword [edi + 0xc]
push edi
call fcn.00446d60
push edi
call fcn.00447660
call fcn.0041ddc0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
lea eax, [edi + 8]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], ebx
push ecx
mov ebx, str.SkinlistOrder.dat
call fcn.00412480
add esp, 8
lea edx, [esp + 0x1c]
mov byte [esp + 0x30], 1
mov eax, dword [eax]
push edx
push eax
call fcn.00481720
xor ebx, ebx
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x445849
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x5c05dc
call fcn.00404460
lea edx, [esp + 0x14]
lea ebp, [edi + 0x24]
push edx
mov ecx, ebp
mov byte [esp + 0x34], 2
call fcn.0047f420
mov ecx, dword [eax + 4]
cmp ecx, ebx
je 0x445889
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
je 0x445889
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
call fcn.0047f5d0
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4458ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x5c05e8
call fcn.00404460
lea edx, [esp + 0x14]
push edx
mov ecx, ebp
mov byte [esp + 0x34], 3
call fcn.0047f420
mov ecx, dword [eax + 4]
cmp ecx, ebx
je 0x4458ea
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
je 0x4458ea
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
call fcn.0047f5d0
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44590e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x1c]
call fcn.00449240
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00578327
mov eax, 1
add esp, 4
mov dword [edi + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x44a8e0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x5aac90
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
lea edi, [esp + 0x14]
call fcn.00474ab0
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
cmp eax, ebx
jle 0x44a94b
lea ecx, [eax - 1]
cmp ecx, ebx
jl 0x44aa84
cmp ecx, eax
jg 0x44aa84
movzx eax, word [edx + ecx*2]
cmp ax, 0x5c
je 0x44a94b
push 0x5c
call fcn.00404400
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
cmp eax, ebx
jle 0x44a9f6
lea eax, [edx - 0x10]
call fcn.00403ce0
lea ecx, [eax + 0x10]
mov dword [esp + 0x28], ecx
mov byte [esp + 0x20], 1
mov eax, dword [ecx - 0xc]
cmp eax, ebx
jle 0x44a999
lea edx, [eax - 1]
cmp edx, ebx
jl 0x44aa84
cmp edx, eax
jg 0x44aa84
movzx eax, word [ecx + edx*2]
cmp ax, 0x5c
je 0x44a999
push 0x5c
lea edi, [esp + 0x2c]
call fcn.00404400
push 4
push str.log_
lea eax, [esp + 0x30]
push eax
call fcn.00403fc0
mov ecx, dword [esp + 0x28]
push ebx
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xc
push str.qqpinyin.log
lea edx, [esp + 0x30]
push edx
call fcn.00403fc0
mov esi, dword [esp + 0x28]
push 4
lea edi, [ebp + 0x74]
call fcn.0044aeb0
lea eax, [esi - 0x10]
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44a9f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
mov dword [ebp + 0x7c], ecx
xor esi, esi
xor edi, edi
cmp dword [0x5faec8], ebx
mov dword [esp + 0x28], ebx
jne 0x44aa13
mov dword [0x5faec8], ebx
lea edx, [ebp + 0x20]
push edx
push 0x5fccac
mov ebx, 0x5fae98
call fcn.0044b810
add esp, 8
push esi
push 0
push closesocket
movzx ebx, ax
push 0
push edi
mov eax, ebp
call fcn.0044b740
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44aa8e
lea esi, [ebp + 0x74]
push esi
call fcn.0044b010
push str.sw_st
push esi
call fcn.0044b130
lea ecx, [ebp + 0x24]
add esp, 8
mov dword [ecx], ebx
call fcn.0044ad90
test eax, eax
je 0x44aaad
mov eax, dword [ebp + 4]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x28], 1
jmp 0x44aaad
push 0x80070057
call fcn.00404550
add ebp, 0x74
push ebp
call fcn.0044b010
push str.sw_er
push ebp
call fcn.0044b130
add esp, 8
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44aad5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x44ab30
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push 0xffffffffffffffff
push 0x5a1edb
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x330]
mov dword fs:[0], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor ebp, ebp
push ebp
push ebp
mov esi, ecx
call edi
mov dword [esp + 0x14], eax
add eax, eax
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, ebp
jne 0x44ab9a
call fcn.00403f60
jmp 0x44acbb
push 1
push 0x5bf15c
push esi
call fcn.00403fc0
mov ecx, dword [esp + 0x14]
push ebx
push ecx
call edi
xor edi, edi
cmp dword [esp + 0x14], ebp
jle 0x44acb4
jmp 0x44abc0
push 0x102
lea edx, [esp + 0x22]
push ebp
push edx
mov word [esp + 0x28], bp
call fcn.00580260
mov ecx, dword [ebx + edi*4]
add esp, 0xc
push 0x80
lea eax, [esp + 0x20]
push eax
push ecx
call sub.IMM32.dll_ImmGetDescriptionW
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
call fcn.00404460
mov dword [esp + 0x338], ebp
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
cmp eax, ebp
je 0x44ac0f
push eax
push ecx
jmp 0x44ac69
push 0x208
lea eax, [esp + 0x126]
push ebp
push eax
mov word [esp + 0x12c], bp
call fcn.00580260
movzx edx, word [ebx + edi*4]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x124]
push ecx
push 2
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [esp + 0x120]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x44ac51
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x124]
push eax
push esi
call fcn.00403fc0
push 1
push 0x5bf15c
push esi
call fcn.00403fc0
mov dword [esp + 0x338], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44aca7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 1
cmp edi, dword [esp + 0x14]
jl 0x44abc0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x330]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x318]
xor ecx, esp
call fcn.005787fd
add esp, 0x328
ret
Function at 0x44ad90
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov esi, ecx
call fcn.0047ec60
test eax, eax
jne 0x44ae90
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x44ade9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test edi, edi
jne 0x44ae8e
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005787fd
add esp, 0x1c
ret
xor ecx, ecx
mov dword [esp + 0xe], ecx
mov dword [esp + 0x12], ecx
mov dword [esp + 0x16], ecx
mov word [esp + 0x1a], cx
mov dword [esp + 0x10], ecx
mov word [esp + 0xe], cx
push 0x10
lea ecx, [esp + 0x10]
push ecx
push eax
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x44adc3
mov edx, dword [esi]
mov eax, dword [esi + 4]
push 1
push 0x82cb
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov edi, eax
cmp edi, 0xffffffff
je 0x44adc3
push 0x1f40
mov word [esi + 0x38], 0
mov byte [esi + 0x3b], 1
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0xe], ax
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x44ae5f
test eax, eax
jne 0x44ae7d
push str.srf.qq.com
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
je 0x44ae76
test eax, eax
jne 0x44ae7d
mov eax, esi
call fcn.0044b150
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x44ae8e
test eax, eax
je 0x44ae8e
call fcn.0044b1f0
mov eax, edi
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.005787fd
add esp, 0x1c
ret
Function at 0x44aeb0
Capabilities:
Check if file exists
Delete file
Get file size
Move file

Disassembly:
push 0xffffffffffffffff
push 0x5a0518
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
push 0
push 0x80
push ebp
push 0
push 7
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x44afc3
call fcn.004129d0
mov ebx, eax
test ebx, ebx
jl 0x44aff8
mov ecx, dword [edi]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44af31
call fcn.004129d0
test eax, eax
jl 0x44aff6
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x10], 0
ja 0x44af43
cmp eax, 0x40000
jbe 0x44aff6
mov eax, dword [edi]
test eax, eax
je 0x44af56
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.00404460
push 4
push str..old
lea eax, [esp + 0x34]
xor ebx, ebx
push eax
mov dword [esp + 0x30], ebx
call fcn.00403fc0
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44af93
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebx
push 0x80
push ebp
push ebx
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x44afcc
call fcn.004129d0
mov ebx, eax
jmp 0x44afce
mov dword [edi], eax
xor ebx, ebx
jmp 0x44af09
mov dword [edi], eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44aff6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x44b1f0
Capabilities:
Send data
Send data on socket

Disassembly:
test esi, esi
push edi
je 0x44b1fa
lea edi, [esi - 0x24]
jmp 0x44b1fc
xor edi, edi
mov ecx, edi
call fcn.0044a2d0
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x24]
push 0x10
lea eax, [esi + 0xc]
push eax
mov eax, dword [esi + 4]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
add word [esi + 0x38], 1
movzx eax, word [esi + 0x38]
cmp ax, 3
jb 0x44b239
cmp byte [esi + 0x3c], 0
jne 0x44b239
call fcn.0044aaf0
pop edi
ret
mov ecx, dword [esi]
push 0
push 0x1388
push 0xc2d
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
ret