joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b5779
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x30]
lea esi, [ecx + 4]
push edi
push esi
call fcn.00439b90
add esp, 8
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString_5
lea eax, [edi + 0x18]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [edi + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
mov eax, dword [edi + 0x20]
mov edi, dword [edi + 0x90]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x28], 2
test eax, eax
je 0x439afe
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
cmp edx, eax
jne 0x439b05
mov ecx, esi
call fcn.0043a460
mov ecx, dword [esi + 0xc]
add ecx, 0xfffffff0
mov edi, ecx
mov dword [esi + 0xc], ecx
mov dword [esp + 0x30], edi
mov dword [esp + 8], edi
test edi, edi
mov byte [esp + 0x28], 3
je 0x439b4b
lea eax, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
push ecx
lea ecx, [edi + 4]
call sub.MFC42.DLL_CString::CString_3
mov edx, dword [esp + 0x14]
mov dword [edi + 8], edx
mov eax, dword [esp + 0x18]
mov dword [edi + 0xc], eax
inc dword [esi + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x43a9b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b589b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
mov ebx, dword [esp + 0x25c]
push ebp
push esi
push edi
mov edi, ecx
push ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x260], 0
mov ecx, dword [eax - 8]
mov al, byte [ecx + eax - 1]
cmp al, 0x5c
je 0x43aa0a
push 0x4d6160
lea ecx, [esp + 0x14]
call fcn.0045518c
push str..OEM
lea ecx, [esp + 0x14]
call fcn.0045518c
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x43aac3
test byte [esp + 0x14], 0x10
je 0x43aa5a
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x14]
push edx
push ebp
call esi
test eax, eax
je 0x43aa53
test byte [esp + 0x14], 0x10
jne 0x43aa40
test byte [esp + 0x14], 0x10
jne 0x43aabc
lea eax, [esp + 0x154]
push 0
push eax
push 0
lea ecx, [esp + 0x4c]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea edx, [esp + 0x154]
mov ecx, edi
push edx
call sub.MFC42.DLL_CString::operator_1
lea esi, [edi + 4]
push ebx
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esi]
mov ecx, dword [eax - 8]
cmp byte [eax + ecx - 1], 0x5c
je 0x43aaa8
push 0x4d6160
mov ecx, esi
call fcn.0045518c
push edi
mov ecx, esi
call sub.MFC42.DLL_CString::operator_2
push 0x4d8280
mov ecx, esi
call fcn.0045518c
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [edi + 4]
lea esi, [edi + 4]
push eax
call fcn.00455b60
add esp, 4
test eax, eax
jne 0x43ab06
push 0x4db968
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
push 0x4db968
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x260], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x43ab1f
lea ecx, [esp + 0x10]
mov dword [esp + 0x260], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret 4

Function at 0x43ab40
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x104
lea ecx, [esp]
push esi
push eax
push 0x104
push ecx
push 0x4db968
push str.Force
push str.FloatWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea edx, [esp + 4]
push str.OurFriend
push edx
call esi
add esp, 8
test eax, eax
je 0x43aba0
lea eax, [esp + 4]
push str.GLShow
push eax
call esi
add esp, 8
test eax, eax
je 0x43aba0
xor eax, eax
pop esi
add esp, 0x104
ret
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x43abb0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x104
lea ecx, [esp]
push eax
push 0x104
push ecx
push 0x4db968
push str.Force
push str.FloatWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp]
push str.OurFriend
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
neg eax
sbb eax, eax
inc eax
add esp, 0x10c
ret
Function at 0x43ea20
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4b5b8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [esi + 0xe0]
mov dword [esp + 0x10], 2
test eax, eax
je 0x43ea5b
mov eax, dword [eax + 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.0043fa90
push esi
push str.CAdvertDownloadThread::CAdvertDownloadThread___this___lp
push esi
call fcn.004a5240
mov eax, dword [esi + 0x110]
add esp, 0xc
test eax, eax
je 0x43ea90
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x43ea90
mov dword [esi + 0x110], 0
mov eax, dword [esi + 0x10c]
mov dword [esi + 0xfc], 0x4c11e4
test eax, eax
je 0x43eaae
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
add esi, 0xe4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x43ed70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b5bca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x43ede0
push 0x2b0
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x43edb6
mov ecx, eax
call fcn.004598a0
jmp 0x43edb8
xor eax, eax
test eax, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x30], eax
jne 0x43edd9
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov dword [eax + 0x64], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x30]
push ebx
push 0
mov edx, dword [esi + eax*4]
mov eax, dword [esi + eax*4 + 0x14]
mov ebx, dword [ecx]
push eax
push edx
call dword [ebx + 0x50]
mov ecx, dword [esp + 0xc]
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x43f610
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b5cf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov ecx, dword [ecx]
lea edx, [esp + 4]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 4]
mov dword [esp + 0x10], 0
push eax
call fcn.00455e20
add esp, 4
test eax, eax
jne 0x43f674
call fcn.0043fa80
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_5
push 0
mov byte [esp + 0x14], 1
call dword [sym.imp.MSVCRT.dll_time]
mov ecx, dword [esp + 8]
add esp, 4
lea edx, [esp]
push eax
push ecx
push str._s_advert__0d.dat
push edx
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x10]
add esp, 0x10
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x43f6f9
call fcn.0043fa80
lea ecx, [esp]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4417f0
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x4c1350
mov eax, dword [0x4dc790]
cmp eax, ebx
jne 0x44187a
push 0x4dc600
push 0x101
mov dword [0x4dc790], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x441840
push 0x1010
push str.Error
push str.Initial_Windows_Socket_Error
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x4dc794], ebx
jmp 0x441880
cmp word [0x4dc600], 0x101
je 0x44186e
push 0x1010
push str.Error
push str.Initial_Windows_Socket_negotiate_Socket_Version_1.1_Error
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x4dc794], ebx
call sub.WSOCK32.dll_WSACleanup
jmp 0x441880
mov dword [0x4dc794], 1
jmp 0x441880
inc dword [0x4dc790]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
mov word [esi + 0x30], bx
mov dword [esi + 0x34], ebx
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4418d0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
mov dword [esi], 0x4c1350
cmp eax, 0xffffffff
je 0x4418e8
call fcn.00441a70
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp eax, edi
je 0x441916
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x441916
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call ebx
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44192a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x10]
push edx
call ebx
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x34], edi
mov eax, dword [0x4dc790]
mov ecx, eax
dec eax
cmp ecx, edi
mov dword [0x4dc790], eax
jg 0x441954
cmp dword [0x4dc794], edi
je 0x441954
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
pop ebx
ret

Function at 0x441960
Capabilities:
Create tcp socket

Disassembly:
mov eax, dword [0x4dc794]
push esi
test eax, eax
mov esi, ecx
je 0x4419a8
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
test eax, eax
je 0x4419a8
push 0
push 0
push 1
push 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x10], eax
jne 0x4419a4
mov eax, dword [esi + 4]
push eax
call sub.WSOCK32.dll_closesocket
or eax, 0xffffffff
mov dword [esi + 4], eax
pop esi
ret
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x4419e1
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dword [esi + 0x34], ebx
cmp eax, ebx
je 0x441a16
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x441a16
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call edi
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x441a2a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x10]
push edx
call edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [0x4dc794]
cmp eax, ebx
jne 0x441a43
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x441a51
pop edi
pop esi
xor eax, eax
pop ebx
ret
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x441a70
Capabilities:
Set socket configuration
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dword [esi + 0x34], ebx
cmp eax, ebx
je 0x441aa7
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x441aa7
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call edi
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x441abb
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x10]
push edx
call edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [0x4dc794]
cmp eax, ebx
jne 0x441ad5
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x441ae4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x80
push 0xffff
push eax
mov word [esp + 0x20], 1
mov word [esp + 0x22], bx
call sub.WSOCK32.dll_setsockopt
cmp eax, ebx
jne 0x441b1b
mov edx, dword [esi + 4]
push edx
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x441cf0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x318
mov eax, dword [0x4dc794]
push ebx
push esi
push edi
test eax, eax
mov dword [esp + 0xc], ecx
jne 0x441d15
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x318
ret 0x10
mov ecx, dword [ecx + 4]
cmp ecx, 0xffffffff
jne 0x441d2b
pop edi
pop esi
or eax, ecx
pop ebx
add esp, 0x318
ret 0x10
push ebp
mov ebp, dword [esp + 0x338]
test ebp, ebp
je 0x441d60
mov eax, 0x10624dd3
imul ebp
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x14], edx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, ebp
shl edx, 3
sub eax, edx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x32c]
mov edi, dword [esp + 0x330]
mov esi, edx
mov ebx, dword [esp + 0x334]
neg esi
sbb esi, esi
lea eax, [esp + 0x1c]
and esi, eax
lea eax, [esp + 0x120]
neg edi
sbb edi, edi
and edi, eax
lea eax, [esp + 0x224]
neg ebx
sbb ebx, ebx
and ebx, eax
test esi, esi
je 0x441da5
mov dword [esi], 0
test edi, edi
je 0x441daf
mov dword [edi], 0
test ebx, ebx
je 0x441db9
mov dword [ebx], 0
test esi, esi
je 0x441dcd
mov eax, dword [esi]
cmp eax, 0x40
jae 0x441dcd
mov dword [esi + eax*4 + 4], ecx
mov eax, dword [esi]
inc eax
mov dword [esi], eax
test edi, edi
je 0x441de8
mov eax, dword [edi]
cmp eax, 0x40
jae 0x441de8
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
mov dword [edi + eax*4 + 4], ecx
mov eax, dword [edi]
inc eax
mov dword [edi], eax
test ebx, ebx
je 0x441e03
mov eax, dword [ebx]
cmp eax, 0x40
jae 0x441e03
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
mov dword [ebx + eax*4 + 4], ecx
mov eax, dword [ebx]
inc eax
mov dword [ebx], eax
test edx, edx
je 0x441e0d
mov dword [edx], 0
mov eax, dword [esp + 0x330]
test eax, eax
je 0x441e1e
mov dword [eax], 0
mov eax, dword [esp + 0x334]
test eax, eax
je 0x441e2f
mov dword [eax], 0
test ebp, ebp
pop ebp
je 0x441e3b
lea edx, [esp + 0x10]
push edx
jmp 0x441e3d
push 0
push ebx
push edi
push esi
push 0
call sub.WSOCK32.dll_select
test eax, eax
jne 0x441e5c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x318
ret 0x10
cmp eax, 0xffffffff
jne 0x441e6f
pop edi
pop esi
or eax, eax
pop ebx
add esp, 0x318
ret 0x10
test esi, esi
je 0x441e94
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x441e98
mov ecx, dword [esp + 0x328]
mov dword [ecx], 1
jmp 0x441e98
mov esi, dword [esp + 0xc]
test edi, edi
je 0x441eb7
mov edx, dword [esi + 4]
push edi
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x441eb7
mov eax, dword [esp + 0x32c]
mov dword [eax], 1
test ebx, ebx
je 0x441ed6
mov ecx, dword [esi + 4]
push ebx
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x441ed6
mov edx, dword [esp + 0x330]
mov dword [edx], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x318
ret 0x10
Function at 0x442280
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, ecx
xor edi, edi
mov esi, dword [esp + 0x18]
sub esi, edi
je 0x4422c1
mov eax, dword [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.00441fd0
test eax, eax
je 0x4422ca
mov edx, dword [ebx + 4]
push 0
lea ecx, [edi + ebp]
push esi
push ecx
push edx
call sub.WSOCK32.dll_recv
test eax, eax
je 0x4422d6
cmp eax, 0xffffffff
je 0x4422df
add edi, eax
jmp 0x44228c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0xc

Function at 0x4422f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, ecx
xor edi, edi
mov esi, dword [esp + 0x18]
sub esi, edi
je 0x44232d
mov eax, dword [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.00442020
test eax, eax
je 0x442336
mov edx, dword [ebx + 4]
push 0
lea ecx, [edi + ebp]
push esi
push ecx
push edx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x442342
add edi, eax
jmp 0x4422fc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0xc

Function at 0x442350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b5f87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
call fcn.0041bbf0
xor ebx, ebx
mov dword [esi + 0x20], 0x4c1360
mov dword [esp + 0x18], ebx
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString_5
lea eax, [esi + 0x40]
mov dword [esi + 0x3c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x58], ebx
push ebx
push 1
push 1
push ebx
mov byte [esi + 0x5c], bl
mov dword [esi], 0x4c135c
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x4423dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4423dd
mov dword [esi + 0x58], ebx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x442540
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x442577
call fcn.00442650
mov eax, dword [esi + 0x3c]
push 0x1388
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x442577
mov edx, dword [esi + 0x3c]
push 0xffffffffffffffff
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret
Function at 0x442680
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b6033
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00442cd0
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x4427a8
push esi
mov ecx, edi
call fcn.00442d50
mov ebx, dword [esp + 0x30]
test al, al
jne 0x4426d9
push esi
push ebx
mov ecx, edi
call fcn.00442d90
test al, al
jne 0x4426d9
push esi
mov ecx, edi
call fcn.00442c70
jmp 0x4427a8
mov dword [esp + 0x14], ebx
mov ebx, 0x4c1364
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ebp
call fcn.00442fd0
test al, al
je 0x44278b
lea ebp, [esi + 8]
lea ecx, [edi + 0x34]
push ebp
call sub.MFC42.DLL_CString::operator
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
mov dword [edi + 0x38], eax
call fcn.004427c0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString
push esi
mov ecx, edi
call fcn.00442b50
lea ecx, [esp + 0x10]
call fcn.00442fb0
push eax
lea ecx, [esp + 0x14]
call fcn.00442fc0
push eax
push esi
mov ecx, edi
call fcn.00442bf0
mov dword [esp + 0x30], esi
mov ecx, ebp
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 4]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
push esi
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
mov dword [esp + 0x10], ebx
je 0x4427a8
jmp 0x44279f
push esi
mov ecx, edi
call fcn.00442c70
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
cmp eax, ebp
je 0x4427a8
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4

Function at 0x4427c0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4b605f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_5
mov edx, dword [esi + 4]
xor eax, eax
mov ax, word [esi]
xor ecx, ecx
mov cx, word [esi + 2]
push eax
push ecx
push edx
lea eax, [esp + 0x10]
push str._sGLShow_03d_0d.dat
push eax
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CString::Format_1
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x443bb0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push edi
push eax
lea edi, [esi + 4]
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi], eax
jne 0x443bd7
pop edi
pop esi
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push eax
call edi
mov ecx, dword [esi]
push 2
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push 3
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push 4
push eax
call edi
mov ecx, dword [esi]
push 5
push ecx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x443c80
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00443d30
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x443cab
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x443cc4
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [esp + 0xc]
push eax
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x443cde
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [edi]
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push str.VarFileInfoTranslation
push ecx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x443d02
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax]
mov cx, word [eax]
shr edx, 0x10
shl ecx, 0x10
or edx, ecx
mov eax, 1
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4