joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441eac
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x441f64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00441f74
mov eax, dword [ebp - 4]
call fcn.004052ac
mov dword [ebx + 4], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x14], eax
mov word [ebp - 0x18], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebp - 0x14], esi
inc esi
jne 0x441f31
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x441f4e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.wsock32.dll_connect
test eax, eax
jge 0x441f4a
mov byte [ebx + 0x10], 0
jmp 0x441f4e
mov byte [ebx + 0x10], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441f6b
lea eax, [ebp - 4]
call fcn.00404dec
ret

Function at 0x444140
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x44426f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x444284
call fcn.00404e84
mov eax, dword [0x45cd90]
call fcn.00409150
test al, al
jne 0x444185
mov edx, dword [0x45cd90]
mov eax, 0x444290
call fcn.00446198
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x44429c
call fcn.004050f8
mov edx, dword [ebp - 8]
mov eax, dword [0x45cdcc]
call fcn.0044409c
push 0x1e
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4442a8
call fcn.004050f8
mov edx, dword [ebp - 0xc]
mov eax, dword [0x45cd2c]
call fcn.0044409c
push 0x1e
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4442b4
call fcn.004050f8
mov edx, dword [ebp - 0x10]
mov eax, dword [0x45cd68]
call fcn.0044409c
push 0x1e
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x45cd94]
call fcn.00448430
mov edx, eax
mov eax, dword [0x45cd90]
call fcn.00446b58
push 1
lea eax, [ebp - 0x18]
call fcn.00443cc4
push dword [ebp - 0x18]
push 0x4442c0
lea edx, [ebp - 0x1c]
mov eax, dword [0x45cd90]
call fcn.004094b4
push dword [ebp - 0x1c]
push 0x4442d0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040516c
mov eax, dword [ebp - 0x14]
call fcn.004052ac
push eax
mov eax, dword [0x45cd90]
call fcn.004052ac
push eax
call sub.kernel32.dll_MoveFileExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444276
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404e10
ret
Function at 0x4442d8
Capabilities:
Terminate thread

Disassembly:
mov byte [0x45ac54], 0
mov eax, dword [0x45ce00]
call fcn.00404008
xor eax, eax
mov dword [0x45ce00], eax
cmp dword [0x45cdf8], 0
je 0x444306
push 0
mov eax, dword [0x45cdf8]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x45cdf8], eax
ret

Function at 0x444310
Capabilities:
Terminate thread

Disassembly:
mov byte [0x45ac5c], 0
mov eax, dword [0x45cdfc]
call fcn.00404008
xor eax, eax
mov dword [0x45cdfc], eax
cmp dword [0x45cdf4], 0
je 0x44433e
push 0
mov eax, dword [0x45cdf4]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x45cdf4], eax
ret

Function at 0x444348
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x87
add esp, 0xfffff004
push eax
dec eax
jne 0x444351
mov eax, dword [ebp - 4]
add esp, 0xfffff410
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x87bf4], edx
mov dword [ebp - 0x87bf0], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x444475
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004052ac
mov edx, eax
lea eax, [ebp - 0x87bf0]
call fcn.00404fe4
mov eax, dword [ebp - 0x87bf0]
call fcn.00409150
test al, al
je 0x44444f
mov eax, dword [ebp - 4]
call fcn.00446714
test al, al
jne 0x44444f
mov esi, 0x43df0
lea ebx, [ebp - 0x43dfc]
lea edx, [ebp - 0x87bf4]
mov eax, 1
call fcn.004449c4
mov eax, dword [ebp - 0x87bf4]
mov al, byte [eax]
mov byte [ebx], al
inc ebx
dec esi
jne 0x4443d4
xor esi, esi
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004052ac
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44444f
push 2
push 0
push 2
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0xc]
push eax
push 0x87be1
lea eax, [ebp - 0x87bec]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
inc esi
cmp esi, 0x28
jl 0x4443f4
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44447c
lea eax, [ebp - 0x87bf4]
mov edx, 2
call fcn.00404e10
lea eax, [ebp - 4]
call fcn.00404dec
ret

Function at 0x444488
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call dword [0x45ce84]
mov dword [esp + 8], 1
lea eax, [esp + 0xc]
push eax
push 0x4444f8
push 0
call dword [0x45ce88]
test bl, bl
je 0x4444c5
mov dword [esp + 0x14], 2
jmp 0x4444cb
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call dword [0x45ce8c]
mov eax, dword [esp]
push eax
call dword [0x45ce28]
add esp, 0x28
pop ebx
ret
Function at 0x44489c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4448a5
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
mov eax, dword [ebp - 8]
call fcn.0040529c
xor eax, eax
push ebp
push 0x4449b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.00402df4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004089f0
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x45cd54]
call fcn.004089f0
mov edx, dword [ebp - 0x14]
pop eax
call fcn.004051f8
je 0x44493c
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.00402df4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004089f0
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x45cd4c]
call fcn.004089f0
mov edx, dword [ebp - 0x20]
pop eax
call fcn.004051f8
jne 0x44497d
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004050f8
mov eax, dword [ebp - 0x24]
call fcn.004052ac
mov ebx, eax
mov eax, ebx
call fcn.0044307c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44499b
push 0
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004050f8
push ebx
call sub.kernel32.dll_WinExec
jmp 0x44499b
push 0
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004050f8
mov eax, dword [ebp - 0x2c]
call fcn.004052ac
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4449bd
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00404e10
ret
Function at 0x4452d0
Capabilities:
Shutdown system

Disassembly:
cmp byte [0x45ac50], 1
je 0x4452ee
mov byte [0x45ac50], 1
push 0
push 2
call sub.user32.dll_ExitWindowsEx
call fcn.00404c78
ret

Function at 0x445310
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push 0
push 0
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44532f
push 0
push 0x445330
call sub.kernel32.dll_WinExec
ret

Function at 0x4455d8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x445683
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409150
test al, al
je 0x44566d
xor eax, eax
push ebp
push 0x445663
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 4
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004052ac
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x445659
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov dword [0x45cd08], eax
mov eax, dword [0x45cd04]
push eax
mov eax, dword [0x45cd08]
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_LockFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44566d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44568a
lea eax, [ebp - 4]
call fcn.00404dec
ret

Function at 0x4490e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x4491ca
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [0x415e04]
call fcn.00403fd8
mov dword [ebp - 8], eax
mov dl, 0x7c
mov eax, dword [ebp - 8]
call fcn.0041837c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004181ec
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4491ac
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
xor eax, eax
push ebp
push 0x449198
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00408db4
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x44918e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4491a4
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x44914d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4491d1
lea eax, [ebp - 0x14]
call fcn.00404dec
lea eax, [ebp - 4]
call fcn.00404dec
ret
Function at 0x4491dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x449375
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e84
xor edx, edx
mov eax, 2
call fcn.0041d2cc
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.0041d2ec
mov ebx, eax
jmp 0x449338
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.0040505c
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.004094b4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004087c8
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 8]
call fcn.004087c8
mov edx, dword [ebp - 0x140]
pop eax
call fcn.004051f8
je 0x44930c
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.0040505c
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004087c8
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
call fcn.004087c8
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.004051f8
jne 0x449329
mov eax, dword [ebp - 0x128]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
push 0
push edi
call sub.kernel32.dll_TerminateProcess
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.0041d30c
mov ebx, eax
test ebx, ebx
jne 0x449267
push esi
mov eax, dword [0x45b13c]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44937c
lea eax, [ebp - 0x14c]
mov edx, 7
call fcn.00404e10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e10
ret
Function at 0x449524
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x449790
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, 0x200
call fcn.00402a50
mov ebx, eax
push ebx
push 0x200
call sub.kernel32.dll_GetLogicalDriveStringsA
push 1
call sub.kernel32.dll_SetErrorMode
jmp 0x449769
lea eax, [ebp - 0x11d]
xor ecx, ecx
mov edx, 0x105
call fcn.0040353c
lea eax, [ebp - 0x222]
xor ecx, ecx
mov edx, 0x105
call fcn.0040353c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x105
lea eax, [ebp - 0x222]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x105
lea eax, [ebp - 0x11d]
push eax
push ebx
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x228]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.0040505c
cmp dword [ebp - 0x228], 0
jne 0x449642
push esi
push edi
mov esi, 0x4497a0
lea edi, [ebp - 0x11d]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [0x45ae74]
mov eax, dword [eax]
call eax
mov eax, dword [esi]
mov edx, dword [esi + 4]
add eax, dword [ebp - 8]
adc edx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], edx
lea edx, [ebp - 0x22c]
mov eax, 0x4498b0
call fcn.00446a90
mov eax, dword [ebp - 0x22c]
call fcn.004052ac
push eax
mov eax, dword [0x45ad14]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_LoadLibraryA
push eax
call fcn.00444bf4
mov edx, dword [0x45b028]
mov dword [edx], eax
push dword [edi]
lea eax, [ebp - 0x230]
mov edx, ebx
call fcn.00404fe4
push dword [ebp - 0x230]
push 0x4498f0
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.0040505c
push dword [ebp - 0x234]
push 0x4498f0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x238]
call fcn.00408cf0
push dword [ebp - 0x238]
push 0x4498f0
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x23c]
call fcn.00408cf0
push dword [ebp - 0x23c]
push 0x4498f0
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x222]
mov ecx, 0x105
call fcn.0040505c
push dword [ebp - 0x240]
push 0x4498f0
push ebx
mov eax, dword [0x45b028]
mov eax, dword [eax]
call eax
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x244]
call fcn.00408cf0
push dword [ebp - 0x244]
push 0x4498f0
mov eax, edi
mov edx, 0xd
call fcn.0040516c
add ebx, 4
cmp byte [ebx], 0
jne 0x4495a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449797
lea eax, [ebp - 0x244]
mov edx, 8
call fcn.00404e10
ret
Function at 0x4498f4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x5c
push 0
push 0
dec ecx
jne 0x4498fc
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x164]
mov edx, dword [0x407b40]
call fcn.0040573c
xor eax, eax
push ebp
push 0x449baf
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov eax, esi
call fcn.00409160
test al, al
jne 0x449967
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x15
jne 0x449956
mov eax, ebx
mov edx, 0x449bc4
call fcn.00404e40
jmp 0x449b5d
mov eax, ebx
mov edx, 0x449bdc
call fcn.00404e40
jmp 0x449b5d
lea eax, [ebp - 0x2c8]
mov ecx, 0x449bf4
mov edx, esi
call fcn.004050f8
mov eax, dword [ebp - 0x2c8]
lea ecx, [ebp - 0x164]
mov edx, 0x3f
call fcn.004092d8
test eax, eax
jne 0x449b56
mov eax, dword [ebp - 0x15c]
and eax, 0x10
cmp eax, 0x10
jne 0x449a50
lea eax, [ebp - 0x2cc]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0x158]
call fcn.0040530c
mov eax, dword [ebp - 0x2cc]
mov edx, 0x449c00
call fcn.004051f8
je 0x449b29
push dword [ebp - 8]
push 0x449c0c
push dword [ebp - 0x158]
push 0x449c18
mov eax, dword [ebp - 0x164]
call fcn.004095f0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2d0]
call fcn.0040b594
push dword [ebp - 0x2d0]
push 0x449c24
mov eax, dword [ebp - 0x164]
call fcn.004095f0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2d4]
call fcn.0040b5ac
push dword [ebp - 0x2d4]
push 0x449c30
lea eax, [ebp - 8]
mov edx, 8
call fcn.0040516c
jmp 0x449b29
push 0x400
push 0x160
lea eax, [ebp - 0x2c4]
push eax
push 0
lea eax, [ebp - 0x2d8]
mov ecx, dword [ebp - 0x158]
mov edx, esi
call fcn.004050f8
mov eax, dword [ebp - 0x2d8]
call fcn.004052ac
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x1b4]
mov ecx, 0x50
call fcn.0040505c
push dword [ebp - 4]
push dword [ebp - 0x158]
push 0x449c30
lea edx, [ebp - 0x2dc]
mov eax, dword [ebp - 0x160]
call fcn.00408c04
push dword [ebp - 0x2dc]
push 0x449c30
push dword [ebp - 0xc]
push 0x449c30
mov eax, dword [ebp - 0x164]
call fcn.004095f0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2e0]
call fcn.0040b594
push dword [ebp - 0x2e0]
push 0x449c24
mov eax, dword [ebp - 0x164]
call fcn.004095f0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2e4]
call fcn.0040b5ac
push dword [ebp - 0x2e4]
push 0x449c30
lea eax, [ebp - 4]
mov edx, 0xb
call fcn.0040516c
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004050f8
lea eax, [ebp - 0x164]
call fcn.00409328
test eax, eax
je 0x449997
lea eax, [ebp - 0x164]
call fcn.0040934c
jmp 0x449b5d
mov eax, ebx
call fcn.00404dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449bb6
lea eax, [ebp - 0x2e4]
mov edx, 6
call fcn.00404e10
lea eax, [ebp - 0x2cc]
call fcn.00404dec
lea eax, [ebp - 0x2c8]
call fcn.00404dec
lea eax, [ebp - 0x164]
mov edx, dword [0x407b40]
call fcn.0040580c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e10
ret
Function at 0x449c34
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x449da1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x449dbc
call fcn.00446a90
mov eax, dword [ebp - 8]
call fcn.004052ac
push eax
mov eax, dword [0x45ad14]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_LoadLibraryA
push eax
call fcn.00444bf4
mov dword [0x45cf04], eax
lea edx, [ebp - 0xc]
mov eax, 0x449e14
call fcn.00446a90
mov eax, dword [ebp - 0xc]
call fcn.004052ac
push eax
mov eax, dword [0x45ad14]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_LoadLibraryA
push eax
call fcn.00444bf4
mov dword [0x45cf08], eax
mov eax, dword [ebp - 4]
call fcn.00409150
test al, al
je 0x449d17
xor eax, eax
push ebp
push 0x449d0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004052ac
mov esi, eax
push esi
call dword [0x45cf04]
mov ebx, eax
and bl, 2
and bl, 1
and bl, 4
xor eax, eax
mov al, bl
push eax
push esi
call dword [0x45cf08]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x449d17
mov eax, dword [ebp - 4]
call fcn.00409368
mov eax, dword [ebp - 4]
call fcn.00409150
test al, al
je 0x449d74
push 1
lea eax, [ebp - 0x14]
call fcn.00443cc4
push dword [ebp - 0x14]
push 0x449e6c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004094b4
push dword [ebp - 0x18]
push 0x449e7c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040516c
mov eax, dword [ebp - 0x10]
call fcn.004052ac
push eax
mov eax, dword [ebp - 4]
call fcn.004052ac
push eax
call sub.kernel32.dll_MoveFileExA
mov eax, dword [ebp - 4]
call fcn.00409150
test al, al
je 0x449d84
xor ebx, ebx
jmp 0x449d86
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449da8
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404e10
ret

Function at 0x449e84
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x449f45
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x449f23
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.0040353c
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.0040353c
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.004096e8
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x449f2f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449f4c
lea eax, [ebp - 4]
call fcn.00404dec
ret
Function at 0x44b5c8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x44b651
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45cf1c
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x44b63b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040bf60
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x44b668
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x45b02c]
mov dl, 1
mov eax, dword [0x44adcc]
call fcn.0040c894
call fcn.004047a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b658
lea eax, [ebp - 0x1c]
call fcn.00404dec
ret

Function at 0x44bcf8
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0044bc1c
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00404210
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x44bd5c
call fcn.0044b510
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x44bd4e
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00404210
pop esi
pop ebx
ret

Function at 0x44bd80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044bab8
xor eax, eax
push ebp
push 0x44bdff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404dec
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x44bdb9
call fcn.00404854
jmp 0x44be06
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x44bde9
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44be06
mov eax, dword [ebp - 4]
call fcn.0044bac4
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44be0c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004052ac
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.0040353c
test ebx, ebx
je 0x44be57
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret