joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f46a
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x44f493
call fcn.00451787
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x44f4b6
push eax
push dword [esi + 4]
call fcn.0044f3f7
push esi
push eax
mov ecx, 0x471630
call fcn.0044f2a7
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x44f64b
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x44f774
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44f774
mov ecx, dword [esi + 0x3c]
test ecx, ecx
jne 0x44f692
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x44f68a
push 0
jmp 0x44f776
mov eax, dword [ebp - 4]
jmp 0x44f755
mov eax, dword [esi + 0x38]
push ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x34]
jb 0x44f6e6
mov ebx, dword [esi + 0x40]
sub ebx, eax
jns 0x44f6aa
xor ebx, ebx
jmp 0x44f6b2
cmp ebx, edi
ja 0x44f75a
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00436920
mov eax, dword [esi + 0x34]
add esp, 0xc
mov dword [esi + 0x38], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub edi, ebx
push edi
add eax, ebx
push eax
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44f683
mov eax, dword [ebp - 4]
jmp 0x44f751
mov edx, dword [esi + 0x40]
lea ebx, [eax + edi]
cmp ebx, edx
jb 0x44f75e
sub edx, eax
jns 0x44f6f8
xor ebx, ebx
jmp 0x44f6fe
mov ebx, edx
cmp ebx, edi
ja 0x44f75a
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00436920
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44f683
mov eax, dword [ebp + 0xc]
sub edi, ebx
cmp edi, eax
mov dword [esi + 0x40], eax
jae 0x44f737
mov dword [ebp + 0xc], edi
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [esi + 0x3c]
add eax, ebx
push eax
call fcn.00436920
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [esi + 0x38], eax
add eax, ebx
pop edi
pop ebx
pop esi
leave
ret 8
xor eax, eax
jmp 0x44f753
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00436920
add esp, 0xc
add dword [esi + 0x38], edi
mov eax, edi
jmp 0x44f753
push 6
push dword [esi + 0x1c]
call fcn.0044f3f7
int3
Function at 0x44f77f
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x18], 1
push edi
je 0x44f828
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44f828
mov ecx, dword [esi + 0x30]
test ecx, ecx
mov edi, dword [ebp + 0xc]
jne 0x44f7c3
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x44f7bc
push 0
jmp 0x44f82a
cmp dword [ebp + 0xc], edi
je 0x44f801
jmp 0x44f7b8
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, dword [esi + 0x28]
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetWriteFile]
jb 0x44f7e8
lea edx, [ebp + 0xc]
push edx
push eax
push ecx
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x44f7b8
and dword [esi + 0x2c], 0
mov ecx, dword [esi + 0x28]
cmp edi, ecx
jb 0x44f807
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x44f7b8
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, ecx
ja 0x44f800
mov ecx, dword [esi + 0x30]
push edi
push dword [ebp + 8]
add ecx, eax
push ecx
call fcn.00436920
add esp, 0xc
add dword [esi + 0x2c], edi
jmp 0x44f800
push 6
push dword [esi + 0x1c]
call fcn.0044f3f7
int3

Function at 0x44f862
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
jne 0x44f89f
push 0x1000
call fcn.0044f061
test eax, eax
je 0x44f8fa
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44f900
mov eax, dword [ebp - 4]
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], ebx
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x3c]
push edi
mov edi, dword [ebp + 8]
jmp 0x44f8ef
mov ecx, dword [esi + 0x38]
cmp ecx, dword [esi + 0x40]
jb 0x44f8da
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44f900
mov eax, dword [ebp - 4]
cmp eax, ebx
mov dword [esi + 0x40], eax
je 0x44f909
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x38], ebx
mov cl, byte [eax]
cmp cl, 0xd
je 0x44f8e4
mov byte [edi], cl
inc edi
inc dword [esi + 0x38]
mov cl, byte [eax]
inc eax
cmp cl, 0xa
je 0x44f8f4
dec dword [ebp + 0xc]
jne 0x44f8ab
mov eax, dword [ebp + 8]
mov byte [edi], bl
pop edi
pop esi
pop ebx
leave
ret 8
push ebx
push dword [esi + 0x1c]
call fcn.0044f3f7
mov eax, edi
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
jmp 0x44f8f7
Function at 0x44fb9c
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x456c21
call fcn.00436cec
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0044ba44
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [esi], vtable.CInternetFile.0
mov dword [esi + 0x1c], eax
call fcn.00401df0
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.004025b0
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.004025b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x4500a1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x46e580]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x4500ff
push 0x45d21c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00434625
add esp, 0x10
cmp eax, 0xffffffff
je 0x450113
cmp eax, esi
jae 0x450113
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x450115
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x4500ca
jmp 0x450116
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.004336ce
leave
ret
Function at 0x450136
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x46e580]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4501d8
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x4502da
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x450288
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4502db
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45027d
cmp dword [ebp - 0x24], 1
jne 0x45027d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x45d22c
push eax
call fcn.00436052
add esp, 0xc
cmp eax, 1
jne 0x45027d
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4502db
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x4502db
lea ecx, [ebp - 0x18]
push ecx
push 0x450120
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x4502db
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x450301
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.004500a1
cmp eax, ebx
pop ecx
pop ecx
jne 0x450303
inc edi
cmp edi, esi
jl 0x4502ea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004336ce
leave
ret 4
Function at 0x450312
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x46d5b0
je 0x4503ce
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4503b6
mov esi, dword [ebx + 4]
jmp 0x4503b0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4503a0
cmp dword [ebp - 0xc], 4
jne 0x4503a0
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x450398
or dword [eax + 0x9c], ecx
jmp 0x4503a0
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x450364
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x450347
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x450f6d
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x456a6d
call fcn.00436cec
sub esp, 0x11c
mov eax, dword [0x46e580]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x451066
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x45103a
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403590
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00450f6d
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401610
test bl, bl
jne 0x45103a
or dword [ebp - 4], 0xffffffff
jmp 0x450fab
cmp esi, 0x103
je 0x45104a
cmp esi, 0x3f2
jne 0x45105a
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004336ce
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x451bc7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x451bfc
cmp edi, dword [esi + 0xc]
jge 0x451bfc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x451bfc
cmp edi, dword [eax + 8]
jge 0x451bfc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x451bfe
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x451d02
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x451d36
jmp fcn.00444dcf
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x451da7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x451ea0
cmp eax, dword [edi + 0xc]
jge 0x451ea0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x451df8
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x451e89
cmp dword [ebp + 0xc], ebx
je 0x451e89
jmp 0x451e22
push 0x10
call fcn.00451a93
cmp eax, ebx
je 0x451e0e
mov ecx, eax
call fcn.00451cf9
mov esi, eax
jmp 0x451e10
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x451e39
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x451e49
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x451e5b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00444dcf
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00436f00
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x451e9b
cmp ecx, dword [esi + 8]
jge 0x451e9b
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x451ea1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x451f60
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x451f8e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x451fac
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00451eca
jmp 0x451fac
mov eax, dword [esi + 0x14]
test eax, eax
je 0x451fac
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00451eca
test edi, edi
mov eax, edi
jne 0x451f96
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4716cc]
test ecx, ecx
je 0x45205f
jmp 0x451f5f
ret 8

Function at 0x45408a
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x456b20
call fcn.00436cec
sub esp, 0x198
mov eax, dword [0x46e580]
push ebx
push esi
push edi
push 0x451387
mov ecx, 0x4714d8
mov dword [ebp - 0x10], eax
call fcn.00451c27
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x4540ec
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x4540ca
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x45411e
cmp byte [esi], 1
jne 0x454118
cmp byte [esi + 1], 1
jne 0x454118
mov dword [edi + 0xc], 0x454057
call fcn.004517ad
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x45412b
push 0x1c
call fcn.0044a436
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x454122
push 0xa
call fcn.0044582d
jmp 0x454124
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x45418e
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x45415d
push 0x1c
call fcn.0044a436
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x454154
push 0xa
call fcn.0044582d
jmp 0x454156
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x45418b
push 0x1c
call fcn.0044a436
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x454186
push 0xa
call fcn.0044530e
jmp 0x454188
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004336ce
leave
ret 4
Function at 0x404170
Capabilities:
Get hostname

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, 0x3e8
push esi
jbe 0x404182
mov esi, ebx
jmp 0x404199
mov al, byte [0x476929]
mov esi, 0x49ef6c
test al, al
je 0x404199
push 0x64
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
push edi
push 0x476c84
call fcn.00403ca0
add esp, 4
test eax, eax
je 0x4041e4
push 0x476c84
call fcn.00403ca0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x200
jle 0x4041e4
mov eax, dword [0x476590]
push 0xf9
push eax
push 0x476c34
call fcn.004086d0
add esp, 0xc
push 0x200
push 0x476c84
call fcn.00403ca0
add esp, 4
push eax
push 0x49f748
call fcn.004075a0
mov ecx, 0x49f748
add esp, 0xc
test ecx, ecx
je 0x40421b
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x40421d
xor ecx, ecx
mov edx, 0x475df8
mov eax, 0x200
neg edx
sbb edx, edx
sub eax, ecx
neg edx
cmp edx, eax
jle 0x40424c
mov ecx, dword [0x476590]
push 0xfa
push ecx
push 0x476bf8
call fcn.004086d0
add esp, 0xc
push 0x200
push 0x475df8
push 0x49f748
call fcn.00407630
mov edx, 0x49f748
add esp, 0xc
test edx, edx
je 0x40427c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
jmp 0x40427e
xor edx, edx
test esi, esi
je 0x404290
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x404292
xor ecx, ecx
mov eax, 0x200
pop edi
sub eax, edx
cmp ecx, eax
jle 0x4042b7
mov ecx, dword [0x476590]
push 0xfb
push ecx
push 0x476bb4
call fcn.004086d0
add esp, 0xc
push 0x200
push esi
push 0x49f748
call fcn.00407630
add esp, 0xc
cmp ebx, 0x3e8
pop esi
pop ebx
ja 0x40430d
mov al, byte [0x476929]
test al, al
je 0x404306
push 0
push 0x49f748
call fcn.004133c0
add esp, 8
test eax, eax
je 0x404306
push 0
push 0
push 0x1fd
push 0x49f748
call fcn.00409ba0
add esp, 0x10
mov byte [0x476929], 0
mov eax, 0x49f748
ret

Function at 0x408950
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push 1
call fcn.00409230
add esp, 4
call fcn.00408830
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 4]
mov byte [0x4b1140], 1
mov dword [0x4b113c], ecx
add esp, 0x24
ret
Function at 0x40b9a0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40b9b0
ret
cmp word [eax + 0xa], 4
je 0x40b9d3
mov ecx, dword [0x47b1cc]
push 0x27c
push ecx
push 0x47b340
call fcn.004086d0
add esp, 0xc
xor eax, eax
ret
mov edx, dword [eax + 0xc]
xor ecx, ecx
mov eax, dword [edx]
xor edx, edx
mov cl, byte [eax + 3]
mov dl, byte [eax + 2]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 1]
mov dl, byte [eax]
push ecx
push edx
push 0x47b334
push 0x4b2ed8
call fcn.00451a0d
add esp, 0x18
mov eax, 0x4b2ed8
ret

Function at 0x40bae0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
xor esi, esi
push edi
test ebx, ebx
jle 0x40bb68
mov ebp, dword [esp + 0x124]
mov edi, dword [esp + 0x120]
mov eax, ebx
push 0
sub eax, esi
lea ecx, [esi + ebp]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x40bb62
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40bb75
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0
push eax
lea ecx, [edi + 1]
push 0
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x40bb75
jmp 0x40bb64
add esi, eax
cmp esi, ebx
jl 0x40bb05
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov edx, dword [0x47b1cc]
push 0x35c
push edx
call fcn.004087b0
add esp, 8
mov eax, 0x1390
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x413580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x413593
xor eax, eax
ret
and al, 0x10
neg al
sbb eax, eax
neg eax
inc eax
ret

Function at 0x4136f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call fcn.00454e58
add esp, 0xc
ret