joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c3c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c3e1a
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x5c3c9e
movzx ecx, byte [esp + 0x80]
jmp 0x5c3cab
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x5c3ce3
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x5c3e01
cmp cl, 0xe4
je 0x5c3cc2
cmp ax, 0x303
jmp 0x5c3ce7
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x5c3d75
cmp cl, 0xe3
jne 0x5c3d3f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0045f54e
call fcn.005c3950
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.00487540
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x63eda0]
mov dword [esp], eax
lea eax, [0x6d28b8]
mov dword [esp + 4], eax
call fcn.00433470
nop
call fcn.0045dbb0
jmp fcn.005c3c70
Function at 0x5e0a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e0c7a
sub esp, 0x44
mov eax, dword [esp + 0x50]
test eax, eax
je 0x5e0c31
mov ecx, dword [esp + 0x4c]
movzx edx, byte [ecx]
mov byte [esp + 0x2f], dl
mov byte [esp], 7
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
call fcn.005e06b0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
test eax, eax
jne 0x5e0bf4
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x5e0b41
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edi
sar eax, 0x1f
cmp ebp, eax
seta dl
mov edi, dword [esp + 0x34]
cmp ebx, edi
xchg edi, ebx
seta bl
xchg edi, ebx
cmp ebp, eax
sete al
and eax, edi
or eax, edx
test al, al
jne 0x5e0af4
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
jmp 0x5e0b41
mov eax, dword [0xe733b8]
mov ecx, dword [0xe733bc]
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x44
ret
mov eax, esi
sar esi, 0x1f
cmp ebp, esi
sete dl
cmp eax, ebx
setb bl
cmp ebp, esi
xchg ebp, ebx
seta bl
xchg ebp, ebx
and ebx, edx
or ebx, ebp
test bl, bl
je 0x5e0ba6
mov edx, dword [0xe733c0]
mov ebx, dword [0xe733c4]
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ebx
add esp, 0x44
ret
movzx edx, byte [esp + 0x2f]
test dl, 0x80
setne dl
mov byte [esp + 0x58], dl
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], edi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x64], edx
sub edx, edi
mov ebx, edx
neg edx
sar edx, 0x1f
and edx, edi
add ecx, edx
mov dword [esp + 0x68], ecx
sub eax, edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x44
ret
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x40]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
add esp, 0x44
ret
mov ecx, dword [0xe733c0]
mov edx, dword [0xe733c4]
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x44
ret
call fcn.0045dbb0
jmp fcn.005e0a30
Function at 0x5f3770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f3982
sub esp, 0x6c
mov eax, dword [esp + 0x80]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test ecx, ecx
jne 0x5f379d
xor eax, eax
jmp 0x5f37bc
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
mov eax, ebx
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x7c]
test ecx, ecx
setne cl
mov edx, dword [esp + 0x78]
test edx, edx
setne dl
or edx, ecx
test dl, dl
je 0x5f3840
call fcn.004a3480
lea edi, [esp + 0x58]
lea esi, [esp]
call fcn.0045f59e
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x34], ecx
lea edi, [esp]
lea esi, [esp + 0x58]
call fcn.0045f59e
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
call fcn.004a2950
lea edi, [esp + 0x44]
lea esi, [esp + 0x1c]
call fcn.0045f59e
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov eax, dword [eax + 0x28]
mov dword [esp], ecx
lea edi, [esp + 4]
lea esi, [esp + 0x44]
call fcn.0045f59e
call eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov ecx, dword [ecx + 0x2c]
mov dword [esp], edx
mov edx, dword [esp + 0x8c]
sub edx, eax
mov ebp, edx
neg edx
sar edx, 0x1f
and edx, eax
mov esi, dword [esp + 0x84]
add edx, esi
mov dword [esp + 4], edx
mov edx, dword [esp + 0x88]
sub edx, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
call ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x38]
add ebx, eax
mov dword [esp + 0x38], ebx
mov ebp, dword [esp + 0x88]
cmp ebp, ebx
jle 0x5f38eb
test eax, eax
jg 0x5f38b1
xor eax, eax
jmp 0x5f38ed
mov eax, dword [0xe73250]
mov ebx, dword [0xe73254]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00464790
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x88]
jmp 0x5f38ed
xor eax, eax
test al, al
jne 0x5f37ba
mov ebp, dword [esp + 0x7c]
test ebp, ebp
xchg ebp, ebx
setne bl
xchg ebp, ebx
mov esi, dword [esp + 0x78]
test esi, esi
xchg esi, ebx
setne bl
xchg esi, ebx
or esi, ebp
xchg esi, eax
test al, al
xchg esi, eax
je 0x5f3946
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x30], ecx
mov dword [esp], edx
lea edi, [esp + 4]
xor eax, eax
call fcn.0045f0bb
mov ecx, dword [esp + 0x30]
call ecx
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x80]
mov dword [ebp], ecx
mov esi, dword [0xe996c0]
test esi, esi
jne 0x5f395f
mov dword [ebp + 4], edx
jmp 0x5f3969
lea edi, [ebp + 4]
mov eax, edx
call fcn.0045efc0
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], edx
add esp, 0x6c
ret
call fcn.0045dbb0
jmp fcn.005f3770
Function at 0x600940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x600ad3
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
test ecx, ecx
jne 0x600974
nop
mov eax, dword [0xe7271c]
lea ecx, [0x6d40e8]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], eax
lea eax, [0x642320]
mov dword [esp + 4], eax
lea eax, [0xe99394]
mov dword [esp + 8], eax
call ecx
mov eax, dword [esp + 0x10]
lea ecx, [0x64b0a0]
cmp dword [esp + 0xc], ecx
je 0x6009a2
xor eax, eax
test eax, eax
je 0x600acf
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x600acf
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f0bb
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
movzx edx, byte [esp + 0x70]
mov byte [esp + 0x44], dl
lea ebx, [ecx + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp], ebx
call fcn.00465e80
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x64]
test edx, edx
je 0x6009fd
mov eax, dword [edx]
jmp 0x6009ff
xor eax, eax
test eax, eax
sete al
movzx edx, byte [esp + 0x70]
and edx, eax
mov byte [esp + 0x45], dl
test dl, dl
je 0x600aa8
lea esi, [ecx + 0x7c]
mov dword [esp + 0x20], esi
lea edi, [esp + 0x28]
call fcn.0045f59e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
test ecx, 0x80000000
je 0x600a5b
shl ecx, 1
mov edx, eax
shr eax, 0x1f
or ecx, eax
mov eax, edx
shl edx, 1
mov ebx, ecx
shl ecx, 1
shr edx, 0x1f
or ecx, edx
shr ebx, 0x1f
add ecx, 0xd7b17f80
adc ebx, 0xd
jmp 0x600a63
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
test ecx, ecx
sete cl
test ebx, ebx
sete dl
and edx, ecx
test dl, dl
je 0x600a7a
test eax, 0x3fffffff
je 0x600aa8
lea edi, [esp + 0x50]
mov esi, dword [esp + 0x20]
call fcn.0045f59e
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.0045f59e
call fcn.004a2e00
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00466200
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx]
lea edi, [esp]
lea esi, [esp + 0x3c]
call fcn.0045f59e
call eax
add esp, 0x64
ret
add esp, 0x64
ret
call fcn.0045dbb0
jmp fcn.00600940
Function at 0x4011a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00408910
test eax, eax
je 0x4011c6
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00408910
cmp eax, 0xffffffff
jne 0x4011ca
xor eax, eax
jmp 0x4011de
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00408910
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esp, ebp
pop ebp
ret
Function at 0x406c50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x406c59
xor ecx, ecx
jne 0x406c59
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406ca0
mov eax, dword [ebp - 0xc]
jmp 0x406cfd
cmp dword [ebp - 4], 1
je 0x406cb3
cmp dword [ebp - 4], 2
je 0x406cb3
mov eax, 0xd
jmp 0x406cfd
cmp dword [ebp + 0xc], 0
je 0x406cf1
cmp dword [ebp - 8], 0
je 0x406ce9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x406ce0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x406ce7
mov eax, 0xd
jmp 0x406cfd
jmp 0x406cf1
mov edx, dword [ebp + 0xc]
mov word [edx], 0
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x407abd
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x407c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x407ad0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x407b1c
push 0x1388
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407b05
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x407c80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0
jne 0x407ca4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
jne 0x407d02
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx]
call eax
test eax, eax
je 0x407d02
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
mov edx, dword [edx]
mov eax, dword [edx]
call eax
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x407d02
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x407f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x407d10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0
je 0x407d2d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
je 0x407d72
push 0x1388
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407d5b
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x20], 0
je 0x407d92
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x408150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434b98
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x18]
call fcn.004013e0
mov dword [ebp - 4], 0
mov ax, word [0x43cfe0]
mov word [ebp - 0x22c], ax
push 0x206
push 0
lea ecx, [ebp - 0x22a]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x14], 0x208
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push str.idex
push str.CLSID9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0Implemented_CategoriesA5F7140E_4311_4ef9_AABC_F55941B5EBE5
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x18]
call fcn.00401440
lea ecx, [ebp - 0x18]
call fcn.00401460
cmp eax, 0x20
je 0x40821f
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401420
mov eax, dword [ebp - 0x238]
jmp 0x4082ae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], 0
jmp 0x408240
mov ecx, dword [ebp - 0x230]
add ecx, 1
mov dword [ebp - 0x230], ecx
cmp dword [ebp - 0x230], 0x10
jge 0x40828f
mov dword [ebp - 0x234], 0
lea edx, [ebp - 0x234]
push edx
push 0x43d198
lea ecx, [ebp - 0x18]
call fcn.00408910
mov ecx, dword [ebp - 0x230]
shl ecx, 1
lea edx, [eax + ecx*2]
push edx
call dword [sym.imp.MSVCR80.dll_swscanf_s]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x230]
mov cl, byte [ebp - 0x234]
mov byte [eax], cl
jmp 0x408231
mov dword [ebp - 0x23c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401420
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0042b108
mov esp, ebp
pop ebp
ret

Function at 0x409c02
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x409c43
cmp byte [ebp - 0x194], 2
jne 0x409c3d
cmp byte [ebp - 0x193], 2
je 0x409c46
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b108
leave
ret
Function at 0x40c406
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax + 4], 2
push edi
sete bl
test ebx, ebx
je 0x40c42a
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [esi + 0xc]
jmp 0x40c45d
cmp dword [esi + 8], 0
jne 0x40c44c
push 0x4366ec
push dword [eax + 8]
call dword [sym.imp.MSVCR80.dll_fopen]
test eax, eax
pop ecx
pop ecx
mov dword [esi + 8], eax
jne 0x40c44c
or eax, 0xffffffff
jmp 0x40c484
push dword [esi + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40c46b
cmp edi, dword [ebp + 0xc]
jbe 0x40c482
test ebx, ebx
jne 0x40c47c
push dword [esi + 8]
call dword [sym.imp.MSVCR80.dll_fclose]
and dword [esi + 8], ebx
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x41420e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x41423d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x41435e
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x164]
test ecx, ecx
je 0x41437e
push dword [esi + 0xf4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x4143b9
cmp eax, 2
jg 0x4143b9
imul eax, eax, 3
push edi
push dword [esi + 0xf0]
mov edi, dword [sym.imp.MSVCR80.dll_fwrite]
push 1
add eax, 0x437688
push 2
push eax
call edi
push dword [esi + 0xf0]
push 1
push dword [esp + 0x24]
push dword [esp + 0x24]
call edi
add esp, 0x20
pop edi
xor eax, eax
ret

Function at 0x41460a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x128]
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [ebp + 0x18]
and dword [edi], 0
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x41467c
push ebx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x414656
and dword [ebp + 8], 0
mov dword [edi], 0x51
jmp 0x41467b
push ebx
push esi
call fcn.0042754d
push eax
push str.Send_failure:__s
push dword [esi]
call fcn.004144d7
mov eax, dword [esi]
mov dword [eax + 0x855c], ebx
add esp, 0x14
mov dword [edi], 0x37
pop ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
Function at 0x414cf5
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
mov esi, dword [ebp + 0x98]
cmp dword [esi + 0x194], 0
mov ebx, dword [esi]
push edi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x80], ebx
jne 0x414e12
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x9c]
mov edi, 0x80
mov dword [ebp - 0x7c], edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x414d72
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.0042754d
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.004144d7
add esp, 0x18
jmp 0x414e19
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x9c]
mov dword [ebp - 0x7c], edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x414da5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.0042754d
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
jmp 0x414d64
lea edi, [esi + 0xc4]
lea ebx, [esi + 0x96]
lea esi, [ebp - 0x74]
call fcn.00414cbc
test eax, eax
jne 0x414dda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp - 0x78]
call fcn.0042754d
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push dword [ebp - 0x80]
jmp 0x414d65
mov eax, dword [ebp - 0x78]
lea edi, [eax + 0xf8]
lea ebx, [eax + 0xc8]
lea esi, [ebp + 0xc]
call fcn.00414cbc
test eax, eax
jne 0x414e0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp - 0x78]
call fcn.0042754d
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
jmp 0x414dd5
mov esi, dword [ebp - 0x78]
push esi
call fcn.00414c6a
pop ecx
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b108
add ebp, 0x90
leave
ret

Function at 0x414e31
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x308]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push 6
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x414e76
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0042754d
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0041446d
add esp, 0x14
jmp 0x414e83
push str.TCP_NODELAY_set_n
push esi
call fcn.0041446d
pop ecx
pop ecx
pop esi
leave
ret