joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a5c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x48]
push ebp
mov ebp, dword [esp + 0x44]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x58]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x3c
push edx
mov dword [esp + 0x14], 0x440
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], str.open
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x42a650
test edi, edi
jne 0x42a620
mov edi, str.NULL
push edi
push ebp
push str.ShellExecuteEx__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0042bb90
mov ecx, dword [eax]
add esp, 0x14
lea edx, [esp + 0x4c]
mov dword [esp + 0x4c], ecx
push 0x43f988
push edx
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [esp + 0x44]
push 0x104
lea ecx, [esi + 4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ecx
mov dword [esi], eax
call ebp
test edi, edi
je 0x42a684
push 0x400
add esi, 0x108
push edi
push esi
call ebp
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 0x10
mov byte [esi + 0x108], 0
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 0x10
Function at 0x42a790
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esp
push eax
mov esi, ecx
push ebx
mov dword [ebp - 4], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x42a7f9
push ebx
push str.GetFileVersionInfoSize__s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 8]
push eax
push ecx
call fcn.0042bb90
mov edx, dword [eax]
add esp, 0x10
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
push 0x43f988
push eax
call sub.MSVCRT.dll__CxxThrowException
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esi], eax
jne 0x42a823
lea ecx, [ebp + 0xb]
call fcn.0042bc00
mov cl, byte [eax]
lea edx, [ebp - 0x11]
push 0x43f9f0
push edx
mov byte [ebp - 0x11], cl
call sub.MSVCRT.dll__CxxThrowException
push eax
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x42a86d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push ebx
push str.GetFileVersionInfo__s__lu_
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x28]
push eax
push ecx
call fcn.0042bb90
mov edx, dword [eax]
add esp, 0x14
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], edx
push 0x43f988
push eax
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [esi]
lea ecx, [ebp - 0x18]
lea edi, [esi + 4]
push ecx
push edi
push 0x444e98
push edx
mov dword [ebp - 0x18], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42a899
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42a899
cmp dword [edi], 0
jne 0x42a8b6
call fcn.0042c3b0
push ebx
push str.No_FIXEDFILEINFO_in_VerInfo_resource_in__s
push 2
push eax
call dword [sym.imp.CwLogging.dll_public:_void___cdecl_CwLogging::LogWrite_unsigned_long_int__char_const__]
add esp, 0x10
mov dword [edi], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42a940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x434778
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 8]
call fcn.00406e60
mov esi, dword [esp + 0x30]
lea ecx, [esp + 8]
push esi
mov dword [esp + 0x2c], 0
call fcn.0042c2c0
push str.DllGetVersion
lea ecx, [esp + 0xc]
call fcn.0042c360
test eax, eax
jne 0x42a9b2
push esi
lea eax, [esp + 0xb]
push str._s:_No_DllGetVersion__
push eax
call fcn.0042bb40
mov cl, byte [eax]
add esp, 0xc
lea edx, [esp + 0x30]
mov byte [esp + 0x30], cl
push 0x43c758
push edx
call sub.MSVCRT.dll__CxxThrowException
xor ecx, ecx
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call eax
test eax, eax
jge 0x42aa03
push esi
lea eax, [esp + 0xb]
push str._s:_DllGetVersion___failed
push eax
call fcn.0042bb40
mov cl, byte [eax]
add esp, 0xc
lea edx, [esp + 0x30]
mov byte [esp + 0x30], cl
push 0x43c758
push edx
call sub.MSVCRT.dll__CxxThrowException
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
and esi, 0xffff
and eax, 0xffff
shl esi, 0x10
lea ecx, [esp + 8]
or esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.0042c2b0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x42bda0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, ecx
push esi
call edi
cmp eax, 0xffffffff
jne 0x42be1e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x42bdee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateDirectory
lea ecx, [esp + 0x18]
call fcn.0042bb60
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push 0x43f988
push ecx
mov dword [esp + 0x1c], eax
call sub.MSVCRT.dll__CxxThrowException
push esi
call edi
cmp eax, 0xffffffff
jne 0x42be1e
push esi
lea edx, [esp + 0x14]
push str.Fail_to_create_TmpFile_because__s_not_exist
push edx
call fcn.0042bb40
mov al, byte [eax]
add esp, 0xc
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
push 0x43c758
push ecx
call sub.MSVCRT.dll__CxxThrowException
and eax, 0x10
cmp al, 0x10
je 0x42be4d
push esi
lea edx, [esp + 0x14]
push str.Fail_to_create_TmpFile_because__s_is_not_a_directory
push edx
call fcn.0042bb40
mov al, byte [eax]
add esp, 0xc
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
push 0x43c758
push ecx
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [esp + 0x10]
lea edx, [ebx + 1]
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x42be8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempFileName
lea ecx, [esp + 0x18]
call fcn.0042bb60
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push 0x43f988
push edx
mov dword [esp + 0x1c], ecx
call sub.MSVCRT.dll__CxxThrowException
pop edi
mov byte [ebx], 1
pop esi
pop ebx
ret 8
Function at 0x42bea0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 1]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42bed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Fail_to_delete_TmpFile__s__LastErr_lu
push 2
call fcn.0042c3b0
push eax
call dword [sym.imp.CwLogging.dll_public:_void___cdecl_CwLogging::LogWrite_unsigned_long_int__char_const__]
add esp, 0x14
mov byte [esi], 0
pop edi
pop esi
ret

Function at 0x42bee0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bf06
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x42bf06
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [esp + 0xc]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x42bf48
push esi
push edi
push str.CopyFile__s___s__FALSE_
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x18]
push eax
push edx
call fcn.0042bb90
mov eax, dword [eax]
add esp, 0x14
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
push 0x43f988
push ecx
call sub.MSVCRT.dll__CxxThrowException
pop edi
pop esi
ret

Function at 0x42bf50
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push esi
push eax
call fcn.0042bee0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42bf9e
push esi
push str.GetFileAttributes__s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.0042bb90
mov edx, dword [eax]
add esp, 0x10
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edx
push 0x43f988
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x42bfe5
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x42bfe5
push esi
push str.SetFileAttributes__s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push eax
push edx
call fcn.0042bb90
mov eax, dword [eax]
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
push 0x43f988
push ecx
call sub.MSVCRT.dll__CxxThrowException
pop esi
ret
Function at 0x42c150
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], esp
push str.dummy
push 0x20
mov esi, ecx
push eax
push str.dummy
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
call fcn.0042a350
cmp dword [eax + 0x14], 1
jne 0x42c20a
call fcn.0042a350
cmp dword [eax + 8], 4
jne 0x42c20a
mov edi, dword [ebp + 8]
push edi
call fcn.0042bff0
add esp, 4
test al, al
jne 0x42c20d
push 0x445348
lea ecx, [esi + 0x208]
call fcn.0042bc80
lea ebx, [esi + 0x209]
push ebx
push edi
call fcn.0042bf50
add esp, 8
push 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call ebx
push 0x104
add esi, 0x104
push edi
push esi
call ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
push 0x104
push edi
jmp 0x42c1df

Function at 0x42c260
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
add esi, 0xfffffffe
cmp eax, esi
pop esi
jb 0x42c2a2
push str.Section_of_IniFile
lea ecx, [esp + 0xc]
call fcn.0042bc20
mov dl, byte [eax]
lea eax, [esp + 0xc]
push 0x43f978
push eax
mov byte [esp + 0x14], dl
call sub.MSVCRT.dll__CxxThrowException
ret 0xc

Function at 0x42c4a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
lea eax, [esp + 4]
push esi
push eax
mov esi, ecx
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x42c4e4
lea ecx, [esp + 7]
push str.Fail_to_init_WinSock_library
push ecx
call fcn.0042bb40
mov dl, byte [eax]
add esp, 8
lea eax, [esp + 6]
mov byte [esp + 6], dl
push 0x43c758
push eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, esi
pop esi
add esp, 0x194
ret
Function at 0x42c500
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x44af68]
sub esp, 0x22c
test eax, eax
jne 0x42c6b7
mov eax, dword [0x44af64]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x42c740
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x42ce70
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x42c6f0
je 0x42c556
mov eax, dword [0x448364]
jmp 0x42c6b2
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x42c69f
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x42c5f7
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x42c66f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x42c69f
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x42c66f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42c69f
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x42c666
inc ebx
add edi, 8
cmp ebx, 3
jl 0x42c675
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x448364], edx
add eax, 8
cmp eax, 0x18
jl 0x42c68d
mov eax, dword [0x448364]
pop edi
pop esi
pop ebp
mov dword [0x44af64], 1
pop ebx
mov dword [0x44af68], eax
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp + 0x238]
push ecx
mov ecx, dword [esp + 0x238]
push edx
mov edx, dword [esp + 0x238]
push ecx
push edx
call eax
add esp, 0x22c
ret 0x10
Function at 0x42d0b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x44af6c]
sub esp, 0x22c
test eax, eax
jne 0x42d267
mov eax, dword [0x44af64]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x42c740
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x42ce70
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x42c6f0
je 0x42d106
mov eax, dword [0x448374]
jmp 0x42d262
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x42d24f
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x42d1a7
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x42d21f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x42d24f
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x42d21f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42d24f
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x42d216
inc ebx
add edi, 8
cmp ebx, 3
jl 0x42d225
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x448364], edx
add eax, 8
cmp eax, 0x18
jl 0x42d23d
mov eax, dword [0x448374]
pop edi
pop esi
pop ebp
mov dword [0x44af64], 1
pop ebx
mov dword [0x44af6c], eax
mov ecx, dword [esp + 0x230]
push ecx
call eax
add esp, 0x22c
ret 4
Function at 0x42d280
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x44af70]
sub esp, 0x22c
test eax, eax
jne 0x42d437
mov eax, dword [0x44af64]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x42c740
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x42ce70
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x42c6f0
je 0x42d2d6
mov eax, dword [0x44836c]
jmp 0x42d432
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x42d41f
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x42d377
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x42d3ef
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x42d41f
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x42d3ef
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42d41f
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x42d3e6
inc ebx
add edi, 8
cmp ebx, 3
jl 0x42d3f5
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x448364], edx
add eax, 8
cmp eax, 0x18
jl 0x42d40d
mov eax, dword [0x44836c]
pop edi
pop esi
pop ebp
mov dword [0x44af64], 1
pop ebx
mov dword [0x44af70], eax
mov ecx, dword [esp + 0x248]
mov edx, dword [esp + 0x244]
push ecx
mov ecx, dword [esp + 0x244]
push edx
mov edx, dword [esp + 0x244]
push ecx
mov ecx, dword [esp + 0x244]
push edx
mov edx, dword [esp + 0x244]
push ecx
mov ecx, dword [esp + 0x244]
push edx
push ecx
call eax
add esp, 0x22c
ret 0x1c
Function at 0x42e930
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 8
call sub.MFC42.DLL_operatornew
add esp, 4
test eax, eax
je 0x42e950
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x42e952
xor eax, eax
push eax
push 0
push 0x42ea20
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x42e992
lea eax, [esp + 8]
push str.Fail_to_begin_thread
push eax
call fcn.0042bb40
mov cl, byte [eax]
add esp, 8
lea edx, [esp + 4]
mov byte [esp + 4], cl
push 0x43c758
push edx
call sub.MSVCRT.dll__CxxThrowException
ret 8

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret