joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443a77
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x77], 0
jne 0x443a9c
push closesocket
push str.Read_access_denied
lea ecx, [esi + 0x50]
call fcn.0042cf82
xor al, al
jmp 0x443acb
cmp byte [esi + 0x74], 0
push edi
je 0x443ad0
push dword [ebp + 0xc]
lea ecx, [esi + 0x38]
mov eax, dword [ecx]
push dword [ebp + 8]
mov eax, dword [eax]
call eax
test al, al
jne 0x443b22
push closesocket
push str.Read_past_end_of_file
lea ecx, [esi + 0x50]
call fcn.0042cf82
xor al, al
pop edi
pop esi
leave
ret 8
cmp dword [esi + 0xc], 0
jne 0x443ae2
push closesocket
push str.File_not_open
jmp 0x443ac0
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x443b1d
lea eax, [ebp - 0x10]
push eax
call fcn.00449638
pop ecx
push eax
lea ecx, [esi + 0x50]
call fcn.004074e1
lea ecx, [ebp - 0x10]
call fcn.00424b62
jmp 0x443ac8
cmp edi, dword [ebp - 4]
jne 0x443ab6
mov al, 1
jmp 0x443aca

Function at 0x443f66
Capabilities:
Clear file content

Disassembly:
cmp byte [ecx + 0x78], 0
je 0x443f92
cmp byte [ecx + 0x74], 0
je 0x443f7d
add ecx, 0x38
call fcn.00423c21
mov al, 1
ret
cmp dword [ecx + 0xc], 0
je 0x443f92
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
ret
xor al, al
ret

Function at 0x4441cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
je 0x4441f3
jns 0x4441fc
push closesocket
push str.Illegal_write_size
lea ecx, [esi + 0x4c]
call fcn.0042cf82
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
cmp byte [esi + 0x74], 0
jne 0x444218
push closesocket
push str.Write_access_denied
lea ecx, [esi + 0x4c]
call fcn.0042cf82
xor al, al
jmp 0x4441f5
cmp byte [esi + 0x70], 0
je 0x44422f
lea ecx, [esi + 0x38]
mov eax, dword [ecx]
push edi
push dword [ebp + 8]
call dword [eax]
mov byte [esi + 0x71], 1
jmp 0x4441f3
cmp dword [esi + 8], 0
jne 0x444241
push closesocket
push str.File_not_open
jmp 0x44420c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], 0x100000
push eax
call fcn.00401882
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp + 8]
jmp 0x444295
cmp ebx, dword [ebp - 0xc]
jne 0x4442db
sub edi, ebx
mov dword [ebp + 0xc], edi
test edi, edi
jle 0x4442c4
add dword [ebp - 4], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401882
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp - 4]
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44426a
lea eax, [ebp - 0x18]
push eax
call fcn.00449638
pop ecx
push eax
lea ecx, [esi + 0x4c]
call fcn.0042402b
lea ecx, [ebp - 0x18]
call fcn.00424b62
jmp 0x444214
cmp byte [esi + 0x72], 0
je 0x4441f3
lea ecx, [esi - 4]
call fcn.00442f5e
jmp 0x4441f3
push closesocket
push str.Not_all_data_could_be_written
jmp 0x44420c
Function at 0x4447a9
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov eax, 0x47cea3
call fcn.0045a9c4
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
cmp dword [edi], ebx
je 0x4447cd
xor eax, eax
jmp 0x444895
mov ecx, dword [0x4ae73c]
mov eax, dword fs:[0x2c]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x4ae098]
cmp eax, dword [esi + 4]
jg 0x4448a4
mov eax, dword [0x4ae0a0]
cmp eax, dword [esi + 4]
jg 0x4448d8
mov dword [ebp - 4], ebx
mov esi, dword [0x4ae094]
test esi, esi
jne 0x44483a
mov esi, 0x4ae094
mov ecx, esi
call fcn.00401894
push esi
push 0x489000
push 1
push ebx
push 0x488ff0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, dword [0x4ae094]
test esi, esi
jne 0x44483a
push 2
pop eax
jmp 0x444895
mov eax, dword [0x4ae09c]
test eax, eax
jne 0x44486a
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
mov ecx, 0x4ae09c
call fcn.00401894
push 0x4ae09c
push esi
call edi
mov eax, dword [0x4ae09c]
test eax, eax
jne 0x444867
push 3
jmp 0x444837
mov edi, dword [ebp - 0x14]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
cmp dword [edi], ebx
jne 0x444879
push 4
jmp 0x444837
or dword [ebp - 4], 0xffffffff
jmp 0x444893
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
push 0x4ae098
call fcn.0045b4cb
pop ecx
cmp dword [0x4ae098], 0xffffffff
jne 0x4447ed
push 0x47d41a
call fcn.0045ac98
mov dword [esp], 0x4ae098
call fcn.0045b481
pop ecx
jmp 0x4447ed
mov esi, 0x4ae0a0
push esi
call fcn.0045b4cb
pop ecx
cmp dword [0x4ae0a0], 0xffffffff
jne 0x4447fe
push 0x47d42a
call fcn.0045ac98
push esi
call fcn.0045b481
pop ecx
pop ecx
jmp 0x4447fe
Function at 0x44857c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [0x4ae33c], 0
push esi
mov esi, 0x4ae340
jne 0x4486a1
push ebx
xor ebx, ebx
mov byte [0x4ae33c], 1
push ebx
push 0x13c
push esi
call fcn.004280f1
add esp, 0xc
mov dword [0x4ae340], 0x11c
call fcn.00448795
mov dword [0x4ae478], eax
mov eax, dword [0x4ae31c]
test eax, eax
je 0x4485d2
push esi
call eax
test eax, eax
je 0x4485e1
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4486a0
push edi
push 6
pop edi
cmp dword [0x4ae344], edi
jb 0x44862f
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.GetProductInfo
call fcn.00431437
push eax
call fcn.0043144f
add esp, 0xc
test al, al
je 0x44862f
movzx eax, word [0x4ae456]
push 0x4ae45c
push eax
movzx eax, word [0x4ae454]
push eax
push dword [0x4ae348]
push dword [0x4ae344]
call dword [ebp - 4]
cmp dword [0x4ae344], 5
jb 0x44869f
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.GetNativeSystemInfo
call fcn.00431437
push eax
call fcn.0043144f
add esp, 0xc
test al, al
je 0x44869f
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
mov eax, dword [ebp - 0x24]
mov dword [0x4ae460], eax
mov eax, dword [ebp - 0x20]
mov dword [0x4ae464], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x4ae468], eax
mov eax, dword [ebp - 0x18]
mov dword [0x4ae46c], eax
mov eax, dword [ebp - 0x14]
mov dword [0x4ae470], eax
cmp word [ebp - 0x28], di
je 0x448698
cmp word [ebp - 0x28], 9
mov byte [0x4ae474], bl
jne 0x44869f
mov byte [0x4ae474], 1
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret
Function at 0x449a89
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
lea eax, [ebp - 0x108]
mov byte [ebp - 0x108], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0042717c
mov edi, closesocket
lea eax, [ebp - 0x108]
push edi
push eax
mov ecx, esi
call fcn.0042cf82
cmp dword [esi + 4], 0
jg 0x449ade
push edi
push 0x48b8b0
mov ecx, esi
call fcn.0042cf82
push 0x5c
mov ecx, esi
call fcn.00425480
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x449aed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0042717c
mov edi, closesocket
lea eax, [ebp - 0x20c]
push edi
push eax
mov ecx, esi
call fcn.0042d49b
cmp dword [esi + 4], 0
jg 0x449b44
push edi
push str.c:_temp
mov ecx, esi
call fcn.0042d49b
push 0x5c
mov ecx, esi
call fcn.00425631
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x44ac2f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
jne 0x44ac4c
mov dword [esi + 0x14], 0x2736
xor al, al
jmp 0x44ad89
cmp dword [esi + 0x20], 0xffffffff
jne 0x44ac5b
mov dword [esi + 0x14], 0x2726
jmp 0x44ac45
push ebx
push edi
call fcn.0044bef3
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x44ac80
mov ecx, dword [esi + 0xc]
shr ecx, 2
test cl, 1
jne 0x44ac8d
call fcn.0044b3ea
mov edi, eax
test edi, edi
je 0x44ac8d
xor eax, eax
cmp dword [edi], ebx
cmovne eax, edi
mov edi, eax
test edi, edi
jne 0x44ac9a
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.0044b716
jmp 0x44ad00
cmp dword [edi + 4], ebx
lea eax, [esi + 0x1c]
push eax
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
mov ecx, 0x47e730
cmovne ecx, dword [edi + 4]
push eax
push ecx
call fcn.0043507e
mov ebx, eax
push ebx
call fcn.00435954
add esp, 0x14
test al, al
je 0x44acee
push ebx
call fcn.004357cc
push eax
push ebx
lea eax, [esi + 0x44]
push str.Failed_to_resolve_the_proxy_server__code__d:__s
push eax
call fcn.00426b39
add esp, 0x14
mov dword [esi + 0x14], 0xfffffffe
xor al, al
jmp 0x44ad87
push dword [edi + 0x1c]
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0044b6c1
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
sete bl
test eax, eax
jne 0x44ad58
test edi, edi
je 0x44ad58
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x18]
or dword [esi + 0x10], 3
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00458e5f
push eax
lea ecx, [edi + 0x10]
call fcn.004074e1
lea ecx, [ebp - 0x10]
call fcn.00424b62
push edi
mov ecx, esi
call fcn.0044b93d
test al, al
jne 0x44ad58
mov dword [esi + 0x14], 0xfffffffe
xor bl, bl
mov ecx, dword [esi + 0x10]
mov eax, ecx
and eax, 0xfffffffe
or ecx, 1
test bl, bl
cmove ecx, eax
mov eax, ecx
or ecx, 2
and eax, 0xfffffffd
test bl, bl
cmove ecx, eax
mov dword [esi + 0x10], ecx
jne 0x44ad85
test edi, edi
jne 0x44ad85
mov ecx, esi
call fcn.0044c9d8
mov al, bl
pop edi
pop ebx
pop esi
leave
ret
Function at 0x44b12b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push 1
push dword [ebp + 8]
call fcn.0045919d
test al, al
je 0x44b14c
mov al, 1
jmp 0x44b22f
push ebx
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
call fcn.0042e596
pop ecx
test al, al
je 0x44b170
push 0x2726
call fcn.0044cfd1
pop ecx
xor al, al
jmp 0x44b22e
lea ecx, [ebp - 0xc]
call fcn.0042717c
push closesocket
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0042cf82
lea ecx, [ebp - 0xc]
call fcn.0042382f
cmp dword [0x4ab3e4], ebx
je 0x44b1ad
lea eax, [ebp - 0xc]
push eax
call fcn.0044b2ed
pop ecx
test al, al
je 0x44b1ad
push 0x2afc
jmp 0x44b1f2
call fcn.0044cfc8
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x44b1d6
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2afc
jne 0x44b224
lea eax, [ebp - 0xc]
push eax
call fcn.0044b232
jmp 0x44b1f7
cmp word [eax + 8], 2
jne 0x44b1e4
cmp word [eax + 0xa], 4
je 0x44b1fa
call sub.WS2_32.dll_WSAGetLastError
test eax, eax
jne 0x44b224
push 0x273e
call fcn.0044cfd1
pop ecx
jmp 0x44b224
mov eax, dword [eax + 0xc]
mov ecx, esi
mov edx, dword [eax]
movzx eax, byte [edx + 3]
push eax
movzx eax, byte [edx + 2]
push eax
movzx eax, byte [edx + 1]
push eax
movzx eax, byte [edx]
push eax
call fcn.0045915b
mov ecx, esi
call fcn.004364f7
xor al, 1
mov bl, al
lea ecx, [ebp - 0xc]
call fcn.00424b62
mov al, bl
pop ebx
pop esi
leave
ret

Function at 0x44b34a
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44b3e4
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x44b3e0
push 0x4ae4b8
xor ebx, ebx
mov dword [ebp - 0x104], ecx
push ebx
push ebx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 1
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x44b3e0
lea eax, [ebp - 0x108]
push eax
push dword [esi + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x44b3e0
push 2
push 1
lea eax, [ebp - 1]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x44b3e0
je 0x44b3e4
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
push esi
call fcn.0044cf9c
pop ecx
test al, al
jne 0x44b3da
cmp esi, 0x2726
jne 0x44b3dc
mov bl, 1
mov al, bl
jmp 0x44b3e6
xor al, al
jmp 0x44b3e6
mov al, 1
pop esi
pop ebx
leave
ret

Function at 0x44b414
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [0x4ae4a8]
mov ecx, 0x47e730
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x44b432
push 3
pop eax
ret
cmp word [eax + 8], 2
je 0x44b43d
push 4
pop eax
ret
cmp word [eax + 0xa], 4
je 0x44b448
push 5
pop eax
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
mov ecx, 0x4ae4b4
push eax
call fcn.0045915b
xor eax, eax
ret
Function at 0x44b5bb
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4ab3fc]
sub esp, 0x190
cmp eax, 6
jne 0x44b67b
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44b5f0
xor eax, eax
inc eax
jmp 0x44b676
push esi
push edi
push 0x44b67d
call fcn.0045ac98
pop ecx
mov edi, 0x4ae4a8
push 0x64
mov ecx, edi
call fcn.00422803
mov eax, dword [0x4ae4a8]
mov esi, 0x47e730
test eax, eax
mov edx, esi
push 0x63
cmovne edx, eax
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
mov ecx, edi
call fcn.00427ca5
mov eax, dword [0x4ae4a8]
test eax, eax
cmovne esi, eax
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x44b66f
push closesocket
push dword [eax]
mov esi, 0x4ae49c
mov ecx, esi
call fcn.0042cf82
mov ecx, esi
call fcn.0042ee2b
mov ecx, esi
call fcn.0042ee13
push 1
push 0x2e
push 0x20
mov ecx, esi
call fcn.0042b827
call fcn.0044b414
pop edi
pop esi
mov dword [0x4ab3fc], eax
leave
ret
Function at 0x44bf10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
je 0x44c120
and dword [ebp - 4], 0
mov ebx, dword [ebp + 0x10]
test bl, 4
je 0x44bf41
mov dword [ebp - 4], eax
test bl, 8
jne 0x44bf41
mov ecx, eax
call fcn.00424b62
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, 0xfffff
ja 0x44c120
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x44bf6b
test byte [esi + 0x10], 1
jne 0x44bf6b
mov dword [esi + 0x14], 0x2749
jmp 0x44c127
and dword [esi + 0x14], 0
xor edi, edi
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
mov ecx, esi
mov al, bl
and al, 1
mov byte [ebp + 0x13], al
mov eax, ebx
shr eax, 1
and eax, 0xffffff01
mov dword [ebp - 0x20], eax
call fcn.0044c17f
mov dword [ebp - 0x14], eax
mov eax, ebx
shr eax, 3
and eax, 2
mov dword [ebp - 8], 0xa
mov ecx, eax
or ecx, 1
and bl, 0x20
mov ebx, dword [ebp + 8]
cmove ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, esi
call fcn.0044c130
mov dword [ebp - 0xc], eax
test eax, eax
jg 0x44c03b
js 0x44c113
cmp byte [ebp + 0x13], 0
jne 0x44c113
push dword [ebp - 0x10]
call fcn.004498f8
pop ecx
cmp eax, dword [esi + 0x30]
jae 0x44c10c
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x44bff9
test byte [esi + 0x10], 1
je 0x44c0f4
mov ecx, esi
call fcn.0044b34a
test al, al
jne 0x44c103
push dword [ebp - 8]
call fcn.0044976c
mov eax, dword [ebp - 8]
add eax, 5
mov dword [ebp - 0xc], 0x3c
mov dword [ebp + 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0040185c
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x44bfb6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004210ac
mov ecx, eax
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp + 8], ecx
test eax, eax
jne 0x44c05f
mov eax, ebx
jmp 0x44c072
push ecx
mov ecx, eax
call fcn.00426d61
test eax, eax
je 0x44c117
mov ecx, dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x18]
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x44c093
mov ecx, esi
call fcn.0044c9d8
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44c0be
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
sub ecx, eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.00424f1f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
jle 0x44c113
add edi, eax
cmp byte [ebp - 0x20], 0
jne 0x44c0d2
cmp eax, dword [ebp - 0xc]
jge 0x44c113
mov edx, dword [ebp + 0xc]
sub edx, eax
mov dword [ebp + 0xc], edx
test edx, edx
jle 0x44c113
mov dword [ebp - 8], 0xa
test ecx, ecx
jne 0x44bfb6
add ebx, eax
jmp 0x44bfb6
cmp dword [esi + 0x14], 0
jne 0x44c113
mov dword [esi + 0x14], 0x2749
jmp 0x44c113
mov dword [esi + 0x14], 0x2746
jmp 0x44c113
mov dword [esi + 0x14], 0x274c
mov eax, edi
jmp 0x44c129
mov dword [esi + 0x14], 8
jmp 0x44c113
mov dword [esi + 0x14], 0x2726
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44c130
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x44c152
test byte [esi + 0x10], 1
jne 0x44c152
mov dword [esi + 0x14], 0x2749
or eax, 0xffffffff
jmp 0x44c17c
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x44c179
mov ecx, esi
call fcn.0044c9d8
and dword [esi + 0x10], 0xfffffffe
jmp 0x44c14d
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x44c7eb
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x44c958
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x7fffffff
jne 0x44c818
push esi
call fcn.0042e903
mov ebx, eax
pop ecx
mov dword [ebp + 0xc], ebx
test ebx, ebx
jle 0x44c958
mov ecx, dword [edi + 0xc]
shr ecx, 1
test cl, 1
jne 0x44c83f
mov eax, dword [edi + 0x10]
shr eax, 1
test al, 1
jne 0x44c83f
mov dword [edi + 0x14], 0x2749
jmp 0x44c95f
mov ecx, edi
call fcn.0044c968
mov ecx, dword [edi + 0xc]
shr ecx, 1
mov dword [ebp - 8], eax
test cl, 1
je 0x44c85e
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0044b716
mov byte [ebp - 1], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00401882
pop ecx
pop ecx
mov ecx, dword [edi + 0xc]
shr ecx, 1
test cl, 1
je 0x44c890
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push esi
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_sendto]
jmp 0x44c89d
push 0
push eax
push esi
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x44c925
mov ecx, edi
call fcn.0044c9d8
mov esi, dword [edi + 0x14]
cmp esi, 0x2733
jne 0x44c8cf
mov ecx, edi
call fcn.0044b6bb
test al, al
jne 0x44c8fd
push 0xa
call fcn.0044976c
pop ecx
mov esi, dword [ebp + 8]
jmp 0x44c862
cmp esi, 0x2747
jne 0x44c8fd
cmp byte [ebp - 1], 0
jne 0x44c8fd
mov eax, 0x1000
cmp dword [ebp - 8], eax
jle 0x44c8fd
push eax
mov ecx, edi
mov byte [ebp - 1], 1
mov dword [ebp - 8], eax
call fcn.0044c990
mov dword [edi + 0x14], esi
test al, al
jne 0x44c8ca
cmp esi, 0x2746
jg 0x44c938
cmp esi, 0x2744
jge 0x44c94b
sub esi, 0x271e
je 0x44c91f
sub esi, 0x15
je 0x44c954
sub esi, 0xf
je 0x44c94b
and dword [edi + 0x10], 0xfffffffd
jmp 0x44c95f
sub ebx, eax
mov dword [ebp + 0xc], ebx
test ebx, ebx
jle 0x44c954
add esi, eax
mov dword [ebp + 8], esi
jmp 0x44c862
sub esi, 0x274a
je 0x44c91f
dec esi
sub esi, 1
je 0x44c94b
sub esi, 5
jne 0x44c91f
mov ecx, edi
call fcn.0044abf4
jmp 0x44c95f
mov al, 1
jmp 0x44c961
mov dword [edi + 0x14], 0x2726
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44dc89
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
jne 0x44dc9a
push 2
jmp 0x44dca3
mov edi, dword [ebp + 8]
test edi, edi
jne 0x44dcad
push 5
pop esi
call fcn.00449763
mov eax, esi
jmp 0x44dd0c
test byte [ebp + 0xc], 0x20
push dword [ebp + 0x10]
je 0x44dccf
push edi
call fcn.0044ebd5
test al, al
jne 0x44dcdc
push 0x91
call fcn.00449755
pop ecx
push 4
jmp 0x44dd0b
mov eax, dword [ebp + 0xc]
and eax, 0xffffffef
push eax
push edi
call fcn.0044dd93
push edi
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
push edi
call fcn.00449755
pop ecx
push 2
pop eax
cmp edi, eax
je 0x44dd0c
test edi, edi
jne 0x44dcff
xor eax, eax
inc eax
jmp 0x44dd0c
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0044f4dd
push 3
pop eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x44de4c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x3000f
push 0x40
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
call fcn.0044ec72
test eax, eax
jne 0x44de7a
call sub.KERNEL32.dll_GetLastError
xor ecx, ecx
cmp eax, 2
setne cl
lea eax, [ecx + 2]
jmp 0x44de91
push esi
push dword [ebp + 0x10]
mov ecx, edi
call fcn.0044de96
mov ecx, edi
mov esi, eax
call fcn.0044d66f
mov eax, esi
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x44de96
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x44dead
push 6
call fcn.00449755
pop ecx
push 2
pop eax
jmp 0x44ded4
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
jne 0x44dec1
inc eax
jmp 0x44ded3
push esi
call fcn.00449755
xor eax, eax
cmp esi, 2
pop ecx
setne al
add eax, 2
pop esi
pop ebp
ret 4

Function at 0x44e0bf
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x44e0d6
push 6
call fcn.00449755
pop ecx
push 2
pop eax
jmp 0x44e0fd
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x44e0ea
inc eax
jmp 0x44e0fc
push esi
call fcn.00449755
xor eax, eax
cmp esi, 2
pop ecx
setne al
add eax, 2
pop esi
pop ebp
ret 4
Function at 0x44e101
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x44e122
push 6
call fcn.00449755
pop ecx
xor eax, eax
jmp 0x44e1a4
push edi
push 0xc7
lea eax, [ebp - 0xd4]
xor edi, edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x44e190
push esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
call fcn.0042717c
push closesocket
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xc]
call fcn.0042cf82
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00424b62
push 0xc7
lea eax, [ebp - 0xd4]
inc edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x44e140
pop esi
xor ecx, ecx
cmp eax, 0x103
cmovne ecx, eax
push ecx
call fcn.00449755
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret 4

Function at 0x44e1a9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x44e1ca
push 6
call fcn.00449755
pop ecx
xor eax, eax
jmp 0x44e24c
push edi
push 0xc7
lea eax, [ebp - 0x19c]
xor edi, edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x44e238
push esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
call fcn.0042717c
push closesocket
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0042d49b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00424b62
push 0xc7
lea eax, [ebp - 0x19c]
inc edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x44e1e8
pop esi
xor ecx, ecx
cmp eax, 0x103
cmovne ecx, eax
push ecx
call fcn.00449755
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret 4