joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443ea1
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x443ea5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x443eaf
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x443eb9
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x443f70
Capabilities:
Read file on windows

Disassembly:
call fcn.0043a0b0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443f81
jmp dword [ecx*4 + 0x443fd8]
xor eax, eax
jmp case.default.0x443f81
push 0xfffffffffffffff6
jmp 0x443f96
push 0xfffffffffffffff5
jmp 0x443f96
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00444780
add esp, 8
call fcn.0043a0b0
mov eax, esi
pop esi
ret
Function at 0x443f88
Capabilities:
Read file on windows

Disassembly:
call fcn.0043a0b0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443f81
jmp dword [ecx*4 + 0x443fd8]
xor eax, eax
jmp case.default.0x443f81
push 0xfffffffffffffff6
jmp 0x443f96
push 0xfffffffffffffff5
jmp 0x443f96
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00444780
add esp, 8
call fcn.0043a0b0
mov eax, esi
pop esi
ret

Function at 0x443f8c
Capabilities:
Read file on windows

Disassembly:
call fcn.0043a0b0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443f81
jmp dword [ecx*4 + 0x443fd8]
xor eax, eax
jmp case.default.0x443f81
push 0xfffffffffffffff6
jmp 0x443f96
push 0xfffffffffffffff5
jmp 0x443f96
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00444780
add esp, 8
call fcn.0043a0b0
mov eax, esi
pop esi
ret

Function at 0x443f90
Capabilities:
Read file on windows

Disassembly:
call fcn.0043a0b0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443f81
jmp dword [ecx*4 + 0x443fd8]
xor eax, eax
jmp case.default.0x443f81
push 0xfffffffffffffff6
jmp 0x443f96
push 0xfffffffffffffff5
jmp 0x443f96
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00444780
add esp, 8
call fcn.0043a0b0
mov eax, esi
pop esi
ret

Function at 0x443f94
Capabilities:
Read file on windows

Disassembly:
call fcn.0043a0b0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443f81
jmp dword [ecx*4 + 0x443fd8]
xor eax, eax
jmp case.default.0x443f81
push 0xfffffffffffffff6
jmp 0x443f96
push 0xfffffffffffffff5
jmp 0x443f96
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00444780
add esp, 8
call fcn.0043a0b0
mov eax, esi
pop esi
ret
Function at 0x443ff0
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push dword [esp + 0x10]
call fcn.00443a20
push dword [esp + 0x18]
mov ebx, eax
call fcn.00443a20
add esp, 8
mov edi, eax
call fcn.0043a0b0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00444780
add esp, 8
call fcn.0043a0b0
test ebx, ebx
je 0x44403c
push ebx
call fcn.00470430
add esp, 4
test edi, edi
je 0x444049
push edi
call fcn.00470430
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x444050
Capabilities:
Delete directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00443a20
add esp, 4
mov edi, eax
call fcn.0043a0b0
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00444780
add esp, 8
call fcn.0043a0b0
test edi, edi
je 0x44408f
push edi
call fcn.00470430
add esp, 4
pop edi
mov eax, esi
pop esi
ret

Function at 0x444220
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
call fcn.0043a0b0
push dword [esp + 0x10]
call fcn.00443a20
mov ebx, dword [esp + 0x18]
add esp, 4
mov edx, ebx
mov ecx, ebx
and edx, 1
mov edi, eax
mov esi, edx
mov eax, ebx
or esi, 2
and cl, 2
cmove esi, edx
mov ecx, esi
or ecx, 4
and al, 4
cmove ecx, esi
mov eax, ecx
or eax, 0x20
and bl, 0x20
cmove eax, ecx
mov ecx, 0x80
test eax, eax
cmove eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00444780
add esp, 8
test edi, edi
je 0x444293
push edi
call fcn.00470430
add esp, 4
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4442c0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x40
mov eax, dword [0x7be9b8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x58]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call fcn.004c93f0
mov ebp, dword [esp + 0x6c]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push ebp
call fcn.004c9a30
call fcn.0043a0b0
push 0
push 0x42
push esi
call fcn.00443cf0
mov esi, eax
xor ebx, ebx
add esp, 0x30
cmp esi, 0xffffffff
setne bl
je 0x4443f3
test edi, edi
jle 0x444341
test ebp, ebp
js 0x444341
xorps xmm0, xmm0
movups xmmword [esp + 0x3c], xmm0
jmp 0x44434c
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test edi, edi
jle 0x44436e
movzx eax, word [esp + 0x10]
mov word [esp + 0x3c], ax
movzx eax, word [esp + 0x14]
mov word [esp + 0x3e], ax
movzx eax, word [esp + 0x18]
mov word [esp + 0x42], ax
test ebp, ebp
js 0x44439a
movzx eax, word [esp + 0x1c]
mov word [esp + 0x44], ax
movzx eax, word [esp + 0x20]
mov word [esp + 0x46], ax
movzx eax, word [esp + 0x24]
mov word [esp + 0x48], ax
movzx eax, word [esp + 0x28]
mov word [esp + 0x4a], ax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x4443e0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [esp + 0x2c]
push eax
push eax
push 0
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
jmp 0x4443e2
xor ebx, ebx
push 0
push ebx
call fcn.00444780
push esi
call fcn.00442c80
add esp, 0xc
call fcn.0043a0b0
mov ecx, dword [esp + 0x4c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004daa4c
add esp, 0x40
ret
Function at 0x4444f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x444571
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44453a
jmp dword [edi*4 + 0x44462c]
xor esi, esi
jmp case.default.0x44453a
push 0xfffffffffffffff6
jmp 0x44454f
push 0xfffffffffffffff5
jmp 0x44454f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x444603
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44457a
jmp dword [edi*4 + 0x44463c]
xor eax, eax
jmp 0x4445a5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x4445a5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x4445a5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x4445a5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4445e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4445e0
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x444650
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ecx
push esi
xor esi, esi
call fcn.0043a0b0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 1]
cmp dword [esp + 0x14], esi
je 0x4446c1
cmp ecx, 3
ja case.default.0x44466b
jmp dword [ecx*4 + 0x444704]
xor eax, eax
jmp case.default.0x44466b
push 0xfffffffffffffff6
jmp 0x444680
push 0xfffffffffffffff5
jmp 0x444680
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
test ecx, ecx
push 0
cmovne esi, dword [esp + 8]
xor eax, eax
test ecx, ecx
setne al
push eax
call fcn.00444780
add esp, 8
call fcn.0043a0b0
mov eax, esi
pop esi
pop ecx
ret
cmp ecx, 3
ja case.default.0x4446c6
jmp dword [ecx*4 + 0x444714]
xor eax, eax
jmp case.default.0x4446c6
push 0xfffffffffffffff6
jmp 0x4446db
push 0xfffffffffffffff5
jmp 0x4446db
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
add esp, 8
call fcn.0043a0b0
mov eax, esi
pop esi
pop ecx
ret
Function at 0x446f70
Capabilities:
Connect socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
cmp dword [esp + 0x28], 0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
jg 0x446f93
jl 0x446f8f
test ebp, ebp
jae 0x446f93
xor edi, edi
jmp 0x446fd0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
mov edi, eax
cmp edi, 0xffffffff
je 0x446fb7
xor eax, eax
jmp 0x446fbd
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
call fcn.00447d40
add esp, 4
mov eax, 1
test edi, edi
cmove edi, eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebx
call dword [sym.imp.WSOCK32.dll_connect]
mov esi, eax
test esi, esi
jne 0x446fe9
xor ebx, ebx
jmp 0x446ff1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ebx, eax
push ebx
call fcn.00447d40
add esp, 4
test esi, esi
je 0x44705a
mov eax, dword [esp + 0x28]
test eax, eax
jl 0x44705a
jg 0x44700c
test ebp, ebp
jb 0x44705a
cmp ebx, 0x2733
jne 0x44705a
push eax
push ebp
mov ebp, dword [esp + 0x20]
push ebp
call fcn.00447a20
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x447040
call fcn.00464760
xor esi, esi
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
jmp 0x44705e
jne 0x44705e
call fcn.00464760
or esi, 0xffffffff
mov dword [eax + 0xc], 2
mov dword [eax + 0x10], 0
jmp 0x44705e
mov ebp, dword [esp + 0x18]
test edi, edi
jle 0x4470d4
call fcn.00464760
mov edi, dword [eax + 0x10]
test edi, edi
je 0x447072
xor ebx, ebx
jmp 0x44707a
call fcn.00464760
mov ebx, dword [eax + 0xc]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0x8004667e
push ebp
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x44709c
xor eax, eax
jmp 0x4470a2
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
call fcn.00447d40
add esp, 4
test edi, edi
je 0x4470c5
push edi
call fcn.00447d40
add esp, 4
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.00464760
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 0
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x447140
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x48
mov eax, dword [0x7be9b8]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [esp + 0x50]
mov dword [esp + 4], 0
call fcn.0043a0b0
mov eax, dword [esp + 0x54]
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
push esi
call fcn.00447d40
add esp, 4
call fcn.0043a0b0
test esi, esi
jne 0x447323
mov edx, dword [esp + 4]
xor ecx, ecx
mov eax, edx
test eax, eax
je 0x447308
mov eax, dword [eax + 0x1c]
inc ecx
test eax, eax
jne 0x4471b0
test ecx, ecx
je 0x447308
push ebp
push ecx
call fcn.004587e0
mov ecx, dword [esp + 0xc]
mov esi, eax
mov eax, ecx
mov dword [esp + 0x10], esi
add esp, 4
mov dword [esp + 0x10], eax
xor ebp, ebp
test eax, eax
je 0x4472e0
push ebx
push edi
mov edx, dword [ecx + 0x10]
xor ebx, ebx
mov ecx, dword [ecx + 0x18]
test ecx, ecx
je 0x4471fb
test edx, edx
je 0x4471fb
movzx eax, word [ecx]
jmp 0x4471fe
or eax, 0xffffffff
sub eax, 2
jne 0x447229
cmp edx, 0x10
jb 0x447229
push 0x16
lea eax, [esp + 0x40]
push eax
lea eax, [ecx + 4]
push eax
push 2
call sub.WS2_32.dll_inet_ntop
test eax, eax
je 0x447229
push eax
call fcn.004c8e20
add esp, 4
mov ebx, eax
call fcn.00464760
xor edx, edx
mov ecx, 4
test ebx, ebx
cmovne ecx, edx
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], ecx
je 0x4472ba
lea edi, [edx + 1]
cmp ebp, edi
jl 0x447292
nop dword [eax]
push edi
push dword [esp + 0x18]
mov esi, ebx
call fcn.00451ea0
add esp, 8
nop
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x447280
test cl, cl
je 0x44727c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x447280
add eax, 2
add esi, 2
test cl, cl
jne 0x447260
xor eax, eax
jmp 0x447285
sbb eax, eax
or eax, 1
test eax, eax
je 0x4472d2
inc edi
cmp edi, ebp
jle 0x447250
mov esi, dword [esp + 0x14]
mov ecx, ebx
inc ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447298
sub ecx, edx
push ecx
push ebx
push ebp
push esi
call fcn.00452a40
add esp, 0x10
test eax, eax
jne 0x4472ba
push ebx
call fcn.00470430
add esp, 4
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4472de
mov ecx, dword [esp + 0x10]
jmp 0x4471e6
push ebx
call fcn.00470430
mov esi, dword [esp + 0x18]
jmp 0x4472b7
pop edi
pop ebx
push ebp
push esi
call fcn.00452df0
mov edx, dword [esp + 0x10]
add esp, 8
pop ebp
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004daa4c
add esp, 0x48
ret
push edx
xor esi, esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004daa4c
add esp, 0x48
ret
mov ecx, dword [esp + 0x48]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004daa4c
add esp, 0x48
ret