joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4359c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x435993
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop ecx
pop ebp
ret

Function at 0x4386be
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x171d164], ebx
push 0
push ebx
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x44fa1c
push 0x45ca8f
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x171d168], eax
push dword [ebp + 0xc]
push dword [0x171d168]
call sub.USER32.dll_ShowWindow
push dword [0x171d168]
call sub.USER32.dll_UpdateWindow
pop ebx
pop ebp
ret

Function at 0x43a514
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa20
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x5e0]
push eax
push 0x5dc
call sub.KERNEL32.dll_GetTempPathA
cmp eax, 0x5dc
jg 0x43a541
test eax, eax
jne 0x43a552
push ebx
push 0x45d9e0
push esi
call fcn.004452e0
add esp, 0xc
jmp 0x43a568
push ebx
lea edx, [ebp - 0x5e0]
push edx
push 0x45d9e7
push esi
call fcn.004452e0
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43b2e2
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x44fa38], 0
je 0x43b392
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
push eax
push 0x1abff2c
call fcn.0043babc
add esp, 8
push 0x2711
push 0x45dc5d
push 0x1abff2c
call fcn.0043c02b
add esp, 0xc
push 0x1abff2c
call fcn.0043bafe
pop ecx
test eax, eax
jne 0x43b34c
push 0
push 0x45dcce
push 0x45dc67
push 0
call sub.USER32.dll_MessageBoxA
push 0
call fcn.00449498
pop ecx
cmp byte [0x45db7c], 0
jne 0x43b379
push 0x23
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1abff2c
call fcn.0043bacf
pop ecx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
mov dword [0x45db78], eax
inc byte [0x45db7c]
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x45db78], eax
push 1
push 0x1abff2c
call fcn.0043c0ab
add esp, 8
pop ebp
ret

Function at 0x43bb73
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push edi
call fcn.0043bafe
pop ecx
test eax, eax
jne 0x43bb8e
xor eax, eax
jmp 0x43bbcd
xor esi, esi
test ebx, ebx
je 0x43bbcb
mov eax, ebx
cmp eax, 0x1388
jle 0x43bba2
mov eax, 0x1388
push dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0xc]
add edx, esi
push edx
push dword [edi + 0x1c]
call sub.WSOCK32.dll_recv
test eax, eax
jg 0x43bbc3
push edi
call fcn.0043bada
pop ecx
xor eax, eax
jmp 0x43bbcd
add esi, eax
sub ebx, eax
test ebx, ebx
jne 0x43bb94
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43bbd2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x43bbdb
mov eax, dword [ebp - 4]
add esp, 0xfffff1e4
push ebx
push esi
mov ebx, dword [ebp + 8]
push 2
push 0x4e20
lea eax, [ebp - 0x4e20]
push eax
push dword [ebx + 0x1c]
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jge 0x43bc24
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x43bc83
push ebx
call fcn.0043bada
pop ecx
jmp 0x43bc83
mov eax, esi
add eax, dword [ebx + 0x14]
cmp eax, dword [ebx + 0x10]
jbe 0x43bc5f
mov dword [ebx + 0x10], eax
cmp eax, 0x989680
jle 0x43bc41
push ebx
call fcn.0043bada
pop ecx
jmp 0x43bc83
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.00448cdc
add esp, 8
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0xc], 0
jne 0x43bc5f
push ebx
call fcn.0043bada
pop ecx
push 0
push esi
mov edx, dword [ebx + 0xc]
add edx, dword [ebx + 0x14]
push edx
push dword [ebx + 0x1c]
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jge 0x43bc80
push ebx
call fcn.0043bada
pop ecx
jmp 0x43bc83
add dword [ebx + 0x14], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43c02b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0043b988
pop ecx
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
mov ax, word [ebp + 0x10]
push eax
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
cmp dword [ebx + 0x1c], 0xffffffff
jne 0x43c06a
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 0x1c], eax
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [ebx + 0x1c]
call sub.WSOCK32.dll_connect
mov esi, eax
cmp byte [0x45df34], 0
jne 0x43c093
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x45df30], eax
inc byte [0x45df34]
inc esi
jne 0x43c0a2
push ebx
call fcn.0043bada
pop ecx
or eax, 0xffffffff
jmp 0x43c0a5
mov eax, dword [ebx + 0x1c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43d7cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x43d7d5
mov eax, dword [ebp - 4]
add esp, 0xfffff8f4
push ebx
push esi
push edi
xor ebx, ebx
cmp dword [ebp + 8], 0xffffffff
je 0x43d866
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea edx, [ebp - 0x2710]
push edx
call fcn.0044533c
add esp, 0xc
push 0x45e500
lea ecx, [ebp - 0x2710]
push ecx
call fcn.00440fd4
add esp, 8
lea eax, [ebp - 0x2710]
push eax
call fcn.00441094
pop ecx
mov edi, eax
xor esi, esi
cmp ebx, edi
jge 0x43d866
push 0
mov eax, edi
sub eax, ebx
push eax
lea edx, [ebp - 0x2710]
add edx, ebx
push edx
push dword [ebp + 8]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x43d85e
cmp eax, 0x2733
jne 0x43d866
inc esi
cmp esi, 0x64
jg 0x43d866
jmp 0x43d82e
xor esi, esi
add ebx, eax
cmp ebx, edi
jl 0x43d832
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ee10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call sub.USER32.dll_GetWindowTextLengthA
inc eax
cmp eax, dword [ebx + 4]
jle 0x43ee31
push eax
push ebx
call fcn.0043ea42
add esp, 8
push dword [ebx + 4]
push dword [ebx + 8]
push esi
call sub.USER32.dll_GetWindowTextA
pop esi
pop ebx
pop ebp
ret

Function at 0x43ff30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, 0xffffffff
jmp 0x43ff5a
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x45e9a4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
mov ebx, ecx
add ecx, 0xffffffff
test ebx, ebx
jne 0x43ff3f
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43ff69
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x45eda4
push dword [ebp + 8]
call fcn.00443f30
add esp, 8
mov esi, eax
test esi, esi
jne 0x43ff89
xor eax, eax
jmp 0x43fff0
xor edx, edx
mov dl, byte [esi + 0x16]
push edx
call fcn.00446554
pop ecx
test eax, eax
jne 0x43ffa4
push esi
call fcn.00443ba0
pop ecx
xor eax, eax
jmp 0x43fff0
or ebx, 0xffffffff
jmp 0x43ffbf
xor edi, ebx
and edi, 0xff
mov eax, dword [edi*4 + 0x45e9a4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
dec dword [esi + 8]
js 0x43ffcd
mov edx, dword [esi]
inc dword [esi]
movzx edi, byte [edx]
jmp 0x43ffd6
push esi
call fcn.004444b4
pop ecx
mov edi, eax
cmp edi, 0xffffffff
jne 0x43ffa9
xor ebx, 0xffffffff
push esi
call fcn.00443ba0
pop ecx
test ebx, ebx
jne 0x43ffee
mov ebx, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43fff8
Capabilities:
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8a4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x45ee2c
lea edi, [ebp - 0x1b4]
mov ecx, 0x6c
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x45efdf
lea edi, [ebp - 0x274]
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
lea eax, [ebp - 0x274]
push eax
lea edx, [ebp - 0x75c]
push edx
call fcn.004452e0
add esp, 0xc
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1b4]
push ecx
lea eax, [ebp - 0x5dc]
push eax
call fcn.004452e0
add esp, 0x14
push 0
lea edx, [ebp - 0x5dc]
push edx
call fcn.00441094
pop ecx
push eax
lea ecx, [ebp - 0x5dc]
push ecx
push ebx
call sub.WSOCK32.dll_send
push 0
push edi
push esi
push ebx
call sub.WSOCK32.dll_send
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44010e
Capabilities:
Delete file
Move file
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd0c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push edi
push 0x45f342
lea eax, [ebp - 0x2f4]
push eax
call fcn.004452e0
add esp, 0xc
call fcn.0040166c
push 0x45f34d
lea edx, [ebp - 0x2f4]
push edx
call fcn.00443f30
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x440175
push 0
push 0x45f36f
push 0x45f350
push dword [0x171d168]
call sub.USER32.dll_MessageBoxA
xor eax, eax
jmp 0x44029b
test ebx, ebx
je 0x4401d8
mov eax, ebx
cmp eax, 0xe7
jle 0x440187
mov eax, 0xe7
push 0
push eax
lea edx, [ebp - 0xec]
push edx
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jle 0x4401b6
push dword [ebp - 4]
push esi
push 1
lea eax, [ebp - 0xec]
push eax
call fcn.004443d4
add esp, 0x10
jmp 0x4401c0
xor edx, edx
mov dword [0x1ac12a4], edx
jmp 0x4401d8
sub ebx, esi
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
sub ecx, ebx
push ecx
push edi
call fcn.0044009e
add esp, 0xc
test ebx, ebx
jne 0x440179
push dword [ebp - 4]
call fcn.00443ba0
pop ecx
call fcn.0040166c
lea eax, [ebp - 0x2f4]
push eax
call fcn.0043ff69
pop ecx
cmp eax, dword [ebp + 0x14]
je 0x440216
call fcn.0040166c
lea edx, [ebp - 0x2f4]
push edx
call sub.KERNEL32.dll_DeleteFileA
xor ecx, ecx
mov dword [0x1ac12a4], ecx
jmp 0x440296
push 0x45f380
push edi
call fcn.00441038
add esp, 8
test eax, eax
jne 0x44024a
mov dword [0x45edb8], 1
call fcn.0040166c
push 0x45f38d
lea eax, [ebp - 0x2f4]
push eax
call sub.KERNEL32.dll_MoveFileA
jmp 0x440286
call fcn.0040166c
push edi
call sub.KERNEL32.dll_DeleteFileA
call fcn.0040166c
push edi
lea edx, [ebp - 0x2f4]
push edx
call sub.KERNEL32.dll_MoveFileA
push 0x45f39a
push edi
call fcn.00441038
add esp, 8
test eax, eax
jne 0x440286
push 1
call fcn.0041a1ad
pop ecx
call fcn.004099c1
push 0x45f3a6
push dword [0x1ac1288]
call sub.USER32.dll_SetWindowTextA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4409ca
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, 0x45f1ea
call fcn.004409c9
call fcn.0040166c
lea eax, [ebx + 0x3d9]
push eax
call fcn.00446a7c
pop ecx
lea edx, [ebx + 0x3dd]
push edx
call fcn.00446a7c
pop ecx
lea ecx, [ebx + 0x3e9]
push ecx
call fcn.00446a7c
pop ecx
lea eax, [ebx + 0x400]
push eax
call fcn.00446a7c
pop ecx
lea edx, [ebx + 0x41c]
push edx
call fcn.00446a7c
pop ecx
lea ecx, [ebx + 0x424]
push ecx
call fcn.00446a7c
pop ecx
lea eax, [ebx + 0x42c]
push eax
call fcn.00446a7c
pop ecx
lea edx, [ebx + 0x43f]
push edx
call fcn.00446a7c
pop ecx
lea ecx, [ebx + 0x457]
push ecx
call fcn.00446a7c
pop ecx
mov eax, dword [ebp + 0xc]
mov dword [0x45edb0], eax
mov edx, dword [ebp + 0x10]
mov dword [0x1ac1288], edx
cmp dword [0x45eda8], 0
jne 0x440a81
mov dword [0x45eda8], 1
push 0x1ac128c
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x1ac128c
call sub.KERNEL32.dll_EnterCriticalSection
cmp dword [0x45edb4], 0
je 0x440aa0
push 0x1ac128c
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x440adf
inc dword [0x45edb4]
push 0x1ac128c
call sub.KERNEL32.dll_LeaveCriticalSection
cmp dword [0x45f0a0], 0
je 0x440ac7
lea ecx, [ebp - 4]
push ecx
push 0x45f0a0
call sub.KERNEL32.dll_GetExitCodeThread
push 0x45f0a0
push 0
push dword [ebp + 8]
push 0x440901
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop ebx
pop ecx
pop ebp
ret
Function at 0x440ae3
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Reference http user-agent string
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x440aec
mov eax, dword [ebp - 4]
add esp, 0xfffffdc4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x45f645
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x440b1a
xor eax, eax
jmp 0x440cf6
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
xor edx, edx
mov dl, byte [ecx]
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
movzx ecx, byte [ecx + 1]
shl ecx, 8
add edx, ecx
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
add edx, ecx
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
xor ecx, ecx
mov cl, byte [eax + 3]
shl ecx, 0x18
add edx, ecx
mov eax, edx
mov dword [ebp - 0x15c], eax
mov word [ebp - 0x160], 2
push 0x50
call sub.WSOCK32.dll_htons
mov word [ebp - 0x15e], ax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x440b86
xor eax, eax
jmp 0x440cf6
push 0x10
lea edx, [ebp - 0x160]
push edx
push esi
call sub.WSOCK32.dll_connect
inc eax
jne 0x440ba5
push esi
call sub.WSOCK32.dll_closesocket
xor eax, eax
jmp 0x440cf6
push esi
push edi
mov esi, 0x45f0a4
lea edi, [ebp - 0x148]
mov ecx, 0x51
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
push 0
lea eax, [ebp - 0x148]
push eax
call fcn.00441094
pop ecx
push eax
lea edx, [ebp - 0x148]
push edx
push esi
call sub.WSOCK32.dll_send
mov dword [ebp - 0x14c], 1
xor ecx, ecx
mov dword [ebp - 0x150], ecx
push 0
push dword [ebp - 0x14c]
lea eax, [ebp - 0x3240]
add eax, dword [ebp - 0x150]
push eax
push esi
call sub.WSOCK32.dll_recv
test eax, eax
jle 0x440cee
add dword [ebp - 0x150], eax
push 0x7d0
lea edx, [ebp - 0x930]
push edx
lea ecx, [ebp - 0x150]
push ecx
lea eax, [ebp - 0x3240]
push eax
call fcn.0043d8ff
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x440bec
push 1
push 0x100
lea eax, [ebp - 0xa30]
push eax
push ebx
lea edx, [ebp - 0x930]
push edx
call fcn.0043d86d
add esp, 0x14
push 0x45f658
lea ecx, [ebp - 0xa30]
push ecx
call fcn.00441038
add esp, 8
test eax, eax
jne 0x440cbd
push 2
push 0x100
lea eax, [ebp - 0xb30]
push eax
push ebx
lea edx, [ebp - 0x930]
push edx
call fcn.0043d86d
add esp, 0x14
lea ecx, [ebp - 0xb30]
push ecx
push edi
call fcn.00441064
add esp, 8
push esi
call sub.WSOCK32.dll_closesocket
push edi
call fcn.00441094
pop ecx
test eax, eax
jne 0x440cb6
xor eax, eax
jmp 0x440cf6
mov eax, 1
jmp 0x440cf6
push 0x7d0
lea edx, [ebp - 0x930]
push edx
lea ecx, [ebp - 0x150]
push ecx
lea eax, [ebp - 0x3240]
push eax
call fcn.0043d8ff
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x440c3d
jmp 0x440bec
push esi
call sub.WSOCK32.dll_closesocket
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440de4
Capabilities:
Create udp socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
lea esi, [ebp - 0x418]
mov dword [ebp - 4], 1
xor ebx, ebx
push 0x7fff
call sub.WSOCK32.dll_htons
mov word [ebp - 0x16], ax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00440d00
add esp, 8
test eax, eax
je 0x440f0d
push dword [ebp + 0xc]
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0xc], eax
xor edx, edx
mov byte [esi + ebx], 0xff
inc ebx
inc edx
cmp edx, 6
jl 0x440e31
xor edx, edx
xor eax, eax
mov cl, byte [ebp + eax - 0x14]
mov byte [esi + ebx], cl
inc ebx
inc eax
cmp eax, 6
jl 0x440e40
inc edx
cmp edx, 0x10
jl 0x440e3e
push 0x10
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.00440fa4
add esp, 0xc
mov word [ebp - 0x428], 2
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x424], edx
mov cx, word [ebp - 0x16]
mov word [ebp - 0x426], cx
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
test edi, edi
jge 0x440ea8
push 0x45f660
call fcn.004447ac
pop ecx
push 1
call fcn.00449498
pop ecx
push 4
lea eax, [ebp - 4]
push eax
push 0x20
push 0xffff
push edi
call sub.WSOCK32.dll_setsockopt
mov dword [ebp - 8], eax
test eax, eax
jge 0x440eef
call fcn.0044917c
push dword [eax]
call fcn.0044917c
push dword [eax]
call fcn.004411dc
pop ecx
push eax
push dword [ebp - 8]
push 0x45f677
call fcn.004447ac
add esp, 0x10
push 1
call fcn.00449498
pop ecx
push 0x10
lea edx, [ebp - 0x428]
push edx
push 0
push ebx
push esi
push edi
call sub.WSOCK32.dll_sendto
mov dword [0x1ac12cc], eax
push edi
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44632c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x1ac14b0
call fcn.004465a0
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x1ac14b0
call fcn.00443ae8
add esp, 0x14
push 0x4605a0
lea ecx, [ebp - 8]
push ecx
call fcn.00440fd4
add esp, 8
mov byte [0x1ac14b0], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x1ac14b0
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x44639f
mov eax, 0x1ac14b0
jmp 0x4463a1
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x4463a8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x446418
cmp dword [ebx + 4], 0xffffffff
jne 0x446418
mov dword [esi + 8], 8
mov eax, dword [ebx + 0xc]
push eax
call fcn.0044632c
pop ecx
mov edi, eax
test edi, edi
je 0x44640e
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x4464d8
call fcn.00446a48
jmp 0x4464d8
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x446425
cmp eax, 0xfffffffe
jne 0x44644c
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x44645c
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x446467
call fcn.00446a48
jmp 0x4464d8
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x44647b
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x446418
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446a7c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
dec eax
je 0x446aaa
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x446aa3
push 5
call fcn.004469fc
pop ecx
pop ebp
ret
call fcn.00446a68
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x446b98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x446bb4
call fcn.00446a68
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x446bd0
test bl, 1
je 0x446bd0
call fcn.0044917c
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x446d04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0044663c
test byte [ebp + 0xd], 0xc0
jne 0x446d28
mov eax, dword [0x45ffb4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x446d35
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x446d62
je 0x446d74
sub ecx, 0x100
je 0x446d82
sub ecx, 0x100
je 0x446d89
sub ecx, 0x100
je 0x446d7b
jmp 0x446d90
sub ecx, 0x600
je 0x446d89
sub ecx, 0x100
je 0x446d74
jmp 0x446d90
mov edi, 1
jmp 0x446d95
mov edi, 2
jmp 0x446d95
mov edi, 4
jmp 0x446d95
mov edi, 5
jmp 0x446d95
mov edi, 3
test byte [ebp + 0xd], 1
je 0x446dbc
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x460584]
test al, 0x80
je 0x446db5
mov ebx, 0x80
jmp 0x446dce
mov ebx, 1
jmp 0x446dce
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x446dce
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x446de0
je 0x446de9
dec eax
je 0x446df2
jmp 0x446dfb
mov dword [ebp - 4], 0x80000000
jmp 0x446e0a
mov dword [ebp - 4], 0x40000000
jmp 0x446e0a
mov dword [ebp - 4], 0xc0000000
jmp 0x446e0a
push 1
call fcn.004469fc
pop ecx
mov ebx, eax
jmp 0x446ef6
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x446e26
sub eax, 0x10
je 0x446e2d
sub eax, 0x10
je 0x446e36
sub eax, 0x10
je 0x446e3f
jmp 0x446e3f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x446e46
mov dword [ebp - 8], 1
jmp 0x446e46
mov dword [ebp - 8], 2
jmp 0x446e46
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x446eaf
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x446ea4
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x446ea4
add ebx, 0xffffffb2
push ebx
call fcn.004469fc
pop ecx
mov ebx, eax
jmp 0x446ef6
mov edi, esi
push edi
call fcn.00446c68
pop ecx
test eax, eax
je 0x446ec3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x446ecf
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0044673c
add esp, 8
mov ebx, eax
inc eax
jne 0x446ef6
push 4
call fcn.004469fc
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.00446670
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448b10
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret