joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f18f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x41f197
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41f1a6
xor al, al
ret
shr eax, 4
not eax
and eax, 1
ret

Function at 0x42330f
Capabilities:
Read file on windows

Disassembly:
push 0x444
mov eax, 0x4e963c
call fcn.0044b094
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
mov edi, ecx
mov dword [ebp - 0x440], eax
mov dword [eax + 0x10], ebx
jb 0x423339
mov eax, dword [eax]
xor ecx, ecx
push 0xc
mov word [eax], cx
call fcn.00445be7
mov esi, eax
pop ecx
mov dword [ebp - 0x444], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x4233a3
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00422df2
test al, al
jne 0x4233a5
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x43c], str.HashImplementation::reset_failed
call fcn.0044508d
push 0x503828
lea eax, [ebp - 0x450]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::runtime_error.0
call fcn.0044abc5
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x43c], ebx
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
jb 0x4233bb
mov eax, dword [edi]
jmp 0x4233bd
mov eax, edi
push 0x4fbb44
push eax
call fcn.004484c8
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4233e8
test esi, esi
je 0x4233e0
call fcn.004232bc
push esi
call fcn.00445b41
pop ecx
xor al, al
call fcn.0044b0f0
ret
push edi
call fcn.0044a134
pop ecx
push edi
test eax, eax
jne 0x423436
push 0x400
lea eax, [ebp - 0x41c]
push 1
push eax
call fcn.0044901f
add esp, 0x10
test eax, eax
je 0x4233e8
push eax
lea eax, [ebp - 0x41c]
push eax
mov eax, ebx
call fcn.00422e41
test al, al
jne 0x4233e8
push edi
call fcn.0044854c
pop ecx
test ebx, ebx
je 0x4233e0
mov esi, ebx
call fcn.004232bc
push ebx
jmp 0x4233da
call fcn.0044854c
pop ecx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x43c]
call fcn.004232f6
mov ecx, dword [ebp - 0x440]
push 0xffffffffffffffff
push 0
mov byte [ebp - 4], 3
call fcn.004029a2
push 1
xor edi, edi
lea esi, [ebp - 0x438]
call fcn.00402a3c
test ebx, ebx
je 0x423482
mov esi, ebx
call fcn.004232bc
push ebx
call fcn.00445b41
pop ecx
mov al, 1
jmp 0x4233e2

Function at 0x423653
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x423684
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push edx
sub eax, ecx
push 1
push eax
push ecx
call fcn.00449193
add esp, 0x10
cmp eax, 1
jne 0x423680
mov al, al
jmp 0x423686
mov byte [esi + 0x18], 1
xor al, al
pop esi
pop ebp
ret 4
Function at 0x423b04
Capabilities:
Read http header

Disassembly:
push 0x64
mov eax, 0x4e7843
call fcn.0044b05e
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
mov edi, ecx
push 0x16
push edi
mov dword [ebp - 0x6c], ebx
call esi
cmp eax, ebx
jne 0x423ba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x423ba1
push str.WinHttpQueryHeaders_failed:
lea eax, [ebp - 0x2c]
push eax
call fcn.0040525a
mov ecx, dword [ebp - 0x68]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.004029a2
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00402a3c
lea eax, [ebp - 0x48]
push eax
call fcn.00419ed4
pop ecx
mov esi, dword [ebp - 0x68]
push ebx
push eax
inc edi
or eax, 0xffffffff
mov dword [ebp - 4], edi
call fcn.0040687d
push edi
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00402a3c
xor al, al
call fcn.0044b0e1
ret
mov eax, dword [ebp - 0x6c]
shr eax, 1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00412165
push ebx
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 4], 2
push dword [ebp - 0x20]
push ebx
push 0x16
push edi
call esi
test eax, eax
jne 0x423c34
push str.WinHttpQueryHeaders_failed:
lea eax, [ebp - 0x48]
push eax
call fcn.0040525a
mov ecx, dword [ebp - 0x68]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.004029a2
push 1
xor edi, edi
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00402a3c
lea eax, [ebp - 0x64]
push eax
call fcn.00419ed4
pop ecx
mov esi, dword [ebp - 0x68]
push ebx
push eax
or eax, 0xffffffff
mov byte [ebp - 4], 4
call fcn.0040687d
push 1
lea esi, [ebp - 0x64]
call fcn.00402a3c
lea esi, [ebp - 0x20]
call fcn.0041d4a8
mov al, bl
jmp 0x423b9b
mov esi, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
mov ecx, esi
call fcn.0041191a
cmp dword [esi + 0x14], 8
jb 0x423c49
mov esi, dword [esi]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
sar eax, 1
add eax, eax
push eax
push dword [ebp - 0x20]
push esi
call fcn.004451a0
add esp, 0xc
mov bl, 1
jmp 0x423c25
Function at 0x425512
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x50f634]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x19c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x425557
cmp byte [ebp - 0x19c], 2
jne 0x425551
mov eax, dword [ebp - 0x19c]
shr eax, 8
cmp al, 2
je 0x425557
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 8]
inc dword [0x5154ac]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.00444c31
leave
ret 4

Function at 0x4255b4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x425621
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4255d7
xor al, al
jmp 0x42562c
mov cx, word [eax + 8]
mov word [esi], cx
mov ecx, dword [eax + 0xc]
xor edi, edi
cmp dword [ecx], edi
je 0x4255d3
mov eax, ecx
add eax, 4
inc edi
cmp dword [eax], 0
jne 0x4255e9
test edi, edi
je 0x4255d3
mov eax, dword [0x5160d8]
xor edx, edx
div edi
cmp dword [0x5160d8], 0xffffffff
mov eax, dword [ecx + edx*4]
mov eax, dword [eax]
mov dword [esi + 4], eax
jne 0x425619
and dword [0x5160d8], 0
jmp 0x42562a
inc dword [0x5160d8]
jmp 0x42562a
push 2
pop ecx
mov word [esi], cx
mov dword [esi + 4], eax
mov al, 1
pop edi
pop ebp
ret

Function at 0x42562f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x50f634]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
je 0x425650
push 6
pop eax
jmp 0x4256f5
mov eax, dword [esi + 4]
push edi
push 2
pop edi
cmp eax, edi
jne 0x425661
push 6
push 1
jmp 0x42566d
cmp eax, 1
jne 0x4256f1
push 0x11
push edi
push edi
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x4256e8
push 0x7f000001
mov word [ebp - 0x14], di
call dword [sym.imp.WS2_32.dll_htonl]
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4256e3
cmp dword [esi + 4], 1
jne 0x4256d0
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push dword [esi + 8]
mov dword [ebp - 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
jmp 0x4256de
push 0x7fffffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4256ed
call fcn.00425704
push 0xa
pop eax
jmp 0x4256f4
xor eax, eax
jmp 0x4256f4
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00444c31
leave
ret 4
Function at 0x425718
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e6213
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x50f634]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
mov eax, dword [0x50f634]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
cmp dword [esi + 4], eax
jne 0x425857
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x425776
push 2
pop eax
jmp 0x425857
push 0x10
push ecx
push 0
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x425855
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x4257b2
push ebx
push dword [ebp + 0x10]
mov edx, esi
push 2
pop ecx
call fcn.0042587c
jmp 0x425857
lea eax, [esp + 0xc]
push eax
call fcn.004021e7
and dword [esp + 0xd0], 0
lea eax, [esp + 0xc]
push str.sendto_failed_as
push eax
call fcn.004035ab
pop ecx
pop ecx
push edi
lea eax, [esp + 0x10]
push eax
call fcn.0040c4ad
lea edx, [esp + 0xa4]
lea ecx, [esp + 0xc]
call fcn.00402860
mov byte [esp + 0xd0], 1
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x425810
lea eax, [esp + 0xa4]
push eax
push 4
pop ecx
call fcn.00417f5f
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xa8]
call fcn.00402a3c
or dword [esp + 0xd0], 0xffffffff
lea ecx, [esp + 0x5c]
call fcn.00402251
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x60], vtable.std::ios_base.0
call fcn.004441d6
pop ecx
push 0xa
jmp 0x425770
xor eax, eax
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00444c31
mov esp, ebp
pop ebp
ret 0xc
Function at 0x426fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7783
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x50f634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push 0x208
lea ecx, [ebp - 0x21e]
xor eax, eax
push edi
mov dword [ebp - 0x240], edi
push ecx
mov dword [ebp - 0x244], esi
mov word [ebp - 0x220], ax
call fcn.004459b0
add esp, 0xc
lea edx, [ebp - 0x220]
push edx
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jge 0x427063
xor eax, eax
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], edi
mov word [ebp - 0x23c], ax
push str.SHGetFolderPath_failed
mov dword [ebp - 4], 1
call fcn.00445853
add esp, 4
mov ecx, str.SHGetFolderPath_failed
lea esi, [ebp - 0x23c]
call fcn.00402e37
push 0x17
mov ecx, str.srcClientPaths.cpp
mov eax, esi
mov dword [ebp - 4], 2
call fcn.00408581
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], cx
lea edx, [ebp - 0x220]
push edx
mov dword [ebp - 4], 3
call fcn.00445853
add esp, 4
lea ecx, [ebp - 0x220]
call fcn.00402e37
mov dword [ebp - 4], edi
push str.NVIDIAUpdatus_
mov dword [ebp - 0x240], 1
call fcn.00445853
add esp, 4
mov edi, eax
push str.NVIDIAUpdatus_
mov eax, esi
call fcn.00406556
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00444c31
mov esp, ebp
pop ebp
ret
Function at 0x4433c1
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x50f634]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp dword [0x5154b4], ebx
jne 0x44341c
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x443402
xor al, al
jmp 0x443424
cmp byte [esp + 0x10], 2
jne 0x443414
mov eax, dword [esp + 0x10]
shr eax, 8
cmp al, 2
je 0x44341c
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4433fe
inc dword [0x5154b4]
mov al, 1
mov byte [esi + 0x1c], al
cmp al, bl
jne 0x443440
xor ecx, ecx
push str.Couldnt_initialize_sockets.
inc ecx
call fcn.00417f5f
pop ecx
push 0xffffffffffffffff
call fcn.0044e96a
or dword [esi + 0x64], 0xffffffff
push 0x10
lea edi, [esi + 0x20]
push ebx
push edi
mov byte [esi + 0x1d], bl
mov dword [esi + 8], ebx
call fcn.004459b0
add esp, 0xc
push 2
pop eax
mov word [edi], ax
mov dword [esi + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10
mov dword [esi + 0x6c], eax
push ebx
add esi, 0x30
push esi
call fcn.004459b0
mov ecx, dword [esp + 0x1b0]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00444c31
mov esp, ebp
pop ebp
ret

Function at 0x443677
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x50f634]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x64], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
jne 0x4436b4
mov eax, dword [ebx + 0x5c]
mov ecx, eax
xor edx, edx
dec ecx
je 0x4436a4
dec ecx
jne 0x4436a7
push 0x11
jmp 0x4436a6
push 6
pop edx
push edx
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x64]
cmp eax, 0xffffffff
jne 0x4436c3
xor al, al
jmp 0x443748
cmp byte [ebx + 0x68], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x4436f6
push 1
lea ecx, [ebp - 0x15]
push ecx
push 4
push 0xffff
push eax
mov byte [ebx + 0x68], 1
mov byte [ebp - 0x15], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4436f6
call edi
mov dword [ebx + 0x60], eax
push esi
push 0x10
pop esi
push esi
push dword [ebp - 0x1c]
push dword [ebx + 0x64]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x443713
call edi
mov dword [ebx + 0x60], eax
jmp 0x44372c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x64]
mov dword [ebp - 0x20], esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x443730
xor al, al
jmp 0x443746
cmp dword [ebx + 0x5c], 2
lea edi, [ebx + 0x20]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x443744
mov byte [ebx + 0x1d], 1
mov al, 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00444c31
leave
ret 4
Function at 0x443756
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push 0xe8
mov eax, 0x4e5a6b
call fcn.0044b05e
mov esi, ecx
cmp byte [esi + 0x1c], 0
mov edi, edx
jne 0x443776
xor al, al
jmp 0x4438b1
cmp dword [esi + 0x64], 0xffffffff
jne 0x44378b
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x64], eax
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x44386e
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x443867
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.0041d97e
pop ecx
pop ecx
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0xf4]
push eax
call fcn.004021e7
lea eax, [ebp - 0xf4]
push str.updtSocket::Connect:_Unknown_hostname_
push eax
mov byte [ebp - 4], 1
call fcn.004035ab
lea eax, [ebp - 0xf4]
push eax
mov ecx, esi
call fcn.00404b18
add esp, 0xc
lea eax, [ebp - 0xf4]
push 0x27
push eax
call fcn.00404ca1
pop ecx
pop ecx
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xf4]
call fcn.00402860
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x44381c
lea eax, [ebp - 0x40]
push eax
push 2
pop ecx
call fcn.00417f5f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.00402a3c
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0
call fcn.00402251
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], vtable.std::ios_base.0
call fcn.004441d6
pop ecx
push 1
lea esi, [ebp - 0x5c]
call fcn.00402a3c
jmp 0x44376f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 2
pop ecx
push dword [ebp + 8]
mov word [ebp - 0x24], cx
mov dword [ebp - 0x20], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
push 0x10
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x64]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4438ab
push dword [esi + 0x64]
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [esi + 0x64], 0xffffffff
jmp 0x44376f
mov byte [esi + 0x1d], 1
mov al, 1
call fcn.0044b0e1
ret 4
Function at 0x443946
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x50f634]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x64]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x208], eax
mov eax, dword [ebp + 0xc]
cdq
mov ecx, 0x3e8
idiv ecx
push ebx
push esi
xor esi, esi
inc esi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x20c], esi
imul edx, edx, 0x3e8
mov dword [ebp - 0x214], eax
xor eax, eax
mov dword [ebp - 0x210], edx
cmp byte [ebp + 8], bl
je 0x4439a9
lea ecx, [ebp - 0x108]
jmp 0x4439af
lea eax, [ebp - 0x108]
cmp dword [ebp + 0xc], ebx
jl 0x4439bc
lea edx, [ebp - 0x214]
jmp 0x4439be
xor edx, edx
push edx
lea edx, [ebp - 0x20c]
push edx
push ecx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jne 0x4439d7
xor eax, eax
jmp 0x443a09
cmp eax, 0xffffffff
jne 0x4439e1
or eax, 0xffffffff
jmp 0x443a09
mov ebx, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea eax, [ebp - 0x20c]
push eax
push dword [edi + 0x64]
call ebx
test eax, eax
je 0x443a07
lea eax, [ebp - 0x108]
push eax
push dword [edi + 0x64]
call ebx
test eax, eax
je 0x4439dc
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00444c31
leave
ret 8

Function at 0x443a19
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
push ebx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, eax
call fcn.0041a2cc
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov byte [ebp - 1], 1
jmp 0x443aa6
jle 0x443a49
add dword [ebp - 8], eax
sub dword [ebp + 0xc], eax
add dword [ebp + 8], eax
jmp 0x443a56
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x443ac1
cmp dword [ebp + 0xc], 0
je 0x443ab7
cmp byte [ebp - 1], 0
mov ecx, dword [ebp + 0x10]
jne 0x443a94
test ecx, ecx
js 0x443a94
lea esi, [ebp - 0x10]
call fcn.0041a2cc
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
sbb ecx, dword [ebp - 0x14]
push 0
push 0x2710
push ecx
push eax
call fcn.0045d5c0
mov ecx, dword [ebp + 0x10]
sub ecx, eax
test ecx, ecx
jle 0x443ab7
push ecx
push 1
call fcn.00443946
mov byte [ebp - 1], 0
test eax, eax
js 0x443ac1
je 0x443ab7
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x64]
call ebx
test eax, eax
jne 0x443a3c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
or eax, 0xffffffff
jmp 0x443aba

Function at 0x444c31
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50f634]
jne 0x444c3b
repz ret
jmp fcn.0044d293
Function at 0x45bbfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x50f634]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0044eeb8
and dword [ebp - 0x14], 0
cmp dword [0x512d28], 0
mov dword [ebp - 0x18], eax
jne 0x45bcaf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45bd57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x45bd57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x512d28], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x512d2c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x512d30], eax
call edi
push eax
call esi
mov dword [0x512d38], eax
test eax, eax
je 0x45bcaf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x512d34], eax
mov eax, dword [0x512d34]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x45bd08
cmp dword [0x512d38], ecx
je 0x45bd08
push eax
call esi
push dword [0x512d38]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45bd08
test ebx, ebx
je 0x45bd08
call edi
test eax, eax
je 0x45bcff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45bcff
test byte [ebp - 8], 1
jne 0x45bd08
or dword [ebp + 0x10], 0x200000
jmp 0x45bd3b
mov eax, dword [0x512d2c]
cmp eax, dword [ebp - 0x18]
je 0x45bd3b
push eax
call esi
test eax, eax
je 0x45bd3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45bd3b
mov eax, dword [0x512d30]
cmp eax, dword [ebp - 0x18]
je 0x45bd3b
push eax
call esi
test eax, eax
je 0x45bd3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x512d28]
call esi
test eax, eax
je 0x45bd57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45bd59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444c31
leave
ret

Function at 0x462930
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edx]
xor eax, eax
test cx, cx
je 0x462956
lea ebx, [ebx]
imul eax, eax, 0xf4243
movzx ecx, cx
add edx, 2
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x462940
ret
Function at 0x4dd350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x4dd382
lea esp, [esp]
test cl, 3
je 0x4dd382
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4f2c38]
add ecx, 1
sub esi, 1
jne 0x4dd360
cmp esi, 0x20
push ebx
push edi
jb 0x4dd56c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4f3038]
xor edx, dword [ebx*4 + 0x4f3438]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4f2c38]
add ecx, 4
xor edx, dword [eax*4 + 0x4f3838]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4f3038]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4f3438]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4f2c38]
add ecx, 4
xor eax, dword [edx*4 + 0x4f3838]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4f3038]
xor edx, dword [ebx*4 + 0x4f3438]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4f2c38]
xor edx, dword [eax*4 + 0x4f3838]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4f3038]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4f3438]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4f2c38]
xor eax, dword [edx*4 + 0x4f3838]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4f3038]
xor edx, dword [ebx*4 + 0x4f3438]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4f2c38]
xor edx, dword [eax*4 + 0x4f3838]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4f3038]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4f3438]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4f2c38]
and edx, 0xff
xor eax, dword [edx*4 + 0x4f3838]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4f3038]
xor edx, dword [ebx*4 + 0x4f3438]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4f2c38]
add ecx, 4
xor edx, dword [eax*4 + 0x4f3838]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4f3038]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4f3438]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4f2c38]
and edx, 0xff
xor eax, dword [edx*4 + 0x4f3838]
sub edi, 1
jne 0x4dd392
cmp esi, 4
jb 0x4dd5b9
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x4f3038]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4f3438]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4f2c38]
and eax, 0xff
xor edi, dword [eax*4 + 0x4f3838]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x4dd576
test esi, esi
pop edi
pop ebx
je 0x4dd5dd
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4f2c38]
add ecx, 1
sub esi, 1
jne 0x4dd5c0
not eax
pop esi
ret