joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444380
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00443e30
add esp, 4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x444538
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00443e30
add esp, 4
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x44452e
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00444110
add esp, 8
test eax, eax
je 0x444524
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00444290
add esp, 8
test eax, eax
je 0x444524
mov dword [ebp - 0x3c], 0
jmp 0x44440b
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x14
jge 0x444446
mov ecx, dword [ebp - 0x3c]
movzx edx, byte [ebp + ecx - 0x60]
sar edx, 4
and edx, 0xf
mov eax, dword [ebp - 0x3c]
mov cl, byte [edx + str.0123456789abcdef]
mov byte [ebp + eax*2 - 0x34], cl
mov edx, dword [ebp - 0x3c]
movzx eax, byte [ebp + edx - 0x60]
and eax, 0xf
mov ecx, dword [ebp - 0x3c]
mov dl, byte [eax + str.0123456789abcdef]
mov byte [ebp + ecx*2 - 0x33], dl
jmp 0x444402
mov eax, dword [ebp - 0x3c]
mov byte [ebp + eax*2 - 0x34], 0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
je 0x444524
push 0
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x38], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x38]
add eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44451a
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4444f3
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x44]
mov byte [ecx], 0
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0045d5d0
add esp, 8
test eax, eax
je 0x4444f3
mov dword [ebp - 0x4c], 1
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0x4000
mov eax, dword [ebp - 0x38]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret
Function at 0x444c90
Capabilities:
Create new key via cryptacquirecontext
Get file size
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x444ccd
push 8
push 1
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x444def
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0x8004
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x444de3
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x444dd9
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
push 4
push 0x1000
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x444dcf
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x444dae
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x444dae
mov dword [ebp - 0x14], 0x14
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 2
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x444dae
mov dword [ebp - 0x1c], 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0x4000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x444ec0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x445038
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x240], 0x224
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x44502e
mov dword [ebp - 8], 0x104
mov edx, dword [ebp - 4]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00435e10
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x444fb0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x444fb0
cmp dword [ebp - 4], 0
je 0x444fb0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add eax, 1
cmp eax, dword [ebp - 8]
ja 0x444f8b
jmp 0x444fb0
mov ecx, dword [ebp - 8]
shl ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00435e10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x444f66
cmp dword [ebp - 4], 0
je 0x44500d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00444a10
add esp, 4
test eax, eax
jne 0x44500b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp dword [ebp - 0x224], eax
je 0x44500b
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x444fe9
jmp 0x444fd6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x44500b
mov dword [ebp - 0x10], 0
jmp 0x44502e
jmp 0x445016
mov dword [ebp - 0x10], 0
jmp 0x44502e
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x444f25
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret
Function at 0x445060
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 1
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x445088
mov dword [ebp - 4], 0
push 0x47788c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49006c], eax
cmp dword [0x49006c], 0
jne 0x4450ac
mov dword [ebp - 4], 0
push 0x47787c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48ff14], eax
cmp dword [0x48ff14], 0
jne 0x4450d0
mov dword [ebp - 4], 0
push str.LoadLibraryExA
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48fed8], eax
cmp dword [0x48fed8], 0
jne 0x4450f4
mov dword [ebp - 4], 0
push 0x47785c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48fedc], eax
cmp dword [0x48fedc], 0
jne 0x445118
mov dword [ebp - 4], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x445133
mov dword [ebp - 4], 0
push str.LdrLoadDll
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48ff0c], eax
cmp dword [0x48ff0c], 0
jne 0x445157
mov dword [ebp - 4], 0
push str.LdrGetDllHandle
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48fecc], eax
cmp dword [0x48fecc], 0
jne 0x44517b
mov dword [ebp - 4], 0
push str.RtlImageNtHeader
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48fed4], eax
cmp dword [0x48fed4], 0
jne 0x44519f
mov dword [ebp - 4], 0
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4451ba
mov dword [ebp - 4], 0
push str.CryptCATAdminCalcHashFromFileHandle
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48fed0], eax
cmp dword [0x48fed0], 0
jne 0x4451de
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.imagehlp.dll_ImageGetDigestStream]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x445b20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push str.rasapi32.dll
call fcn.00436c50
add esp, 4
mov dword [0x48db68], eax
cmp dword [0x48db68], 0
je 0x445c36
push str.RasEnumConnectionsA
mov eax, dword [0x48db68]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db70], eax
push str.RasEnumEntriesA
mov ecx, dword [0x48db68]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db74], eax
push str.RasHangUpA
mov edx, dword [0x48db68]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db78], eax
push str.RasDialA
mov eax, dword [0x48db68]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db7c], eax
push str.RasGetEntryDialParamsA
mov ecx, dword [0x48db68]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db80], eax
push str.RasGetConnectStatusA
mov edx, dword [0x48db68]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db84], eax
push str.RasGetErrorStringA
mov eax, dword [0x48db68]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db88], eax
cmp dword [0x48db70], 0
je 0x445c1f
cmp dword [0x48db74], 0
je 0x445c1f
cmp dword [0x48db78], 0
je 0x445c1f
cmp dword [0x48db7c], 0
je 0x445c1f
cmp dword [0x48db80], 0
je 0x445c1f
cmp dword [0x48db84], 0
je 0x445c1f
cmp dword [0x48db88], 0
jne 0x445c36
mov ecx, dword [0x48db68]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x48db68], 0
cmp dword [0x48db68], 0
je 0x445c90
push str.rasdlg.dll
call fcn.00436c50
add esp, 4
mov dword [0x48db6c], eax
cmp dword [0x48db6c], 0
je 0x445c90
push str.RasDialDlgA
mov edx, dword [0x48db6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48db8c], eax
cmp dword [0x48db8c], 0
jne 0x445c90
mov eax, dword [0x48db6c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x48db6c], 0
pop ebp
ret
Function at 0x44a130
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 4
push 0
push 0x4742d3
push 0
push str.SoftwareSota
push 0x80000001
call fcn.00438920
add esp, 0x24
test eax, eax
jne 0x44a287
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20006
push 0
push 0x4742d3
push 0
push 0x476394
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00438920
add esp, 0x24
test eax, eax
jne 0x44a26e
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0x4742d3
push 0
push str.Options
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00438920
add esp, 0x24
test eax, eax
jne 0x44a255
mov dword [ebp - 8], 0
jmp 0x44a1e3
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
push str.Host_d
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0045b942
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x44a20c
jmp 0x44a20e
jmp 0x44a1da
mov dword [ebp - 8], 0
jmp 0x44a220
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
push str.History_d
lea eax, [ebp - 0x2c]
push eax
call fcn.0045b942
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x44a249
jmp 0x44a24b
jmp 0x44a217
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Options
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x476394
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret
Function at 0x44a2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.0045d5a0
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x48d470], 0
jne 0x44a3d3
push str.FFFTP.reg
lea eax, [ebp - 0x1018]
push eax
call fcn.0045ad80
add esp, 8
push 1
push 0x402
push 0x4787f0
push 0x4787c0
push 0x4787a4
lea ecx, [ebp - 0x1018]
push ecx
call fcn.00431b60
push eax
call fcn.0043e4e0
add esp, 0x1c
cmp eax, 1
jne 0x44a3d1
lea edx, [ebp - 0x1018]
push edx
push str._e___s__HKEY_CURRENT_USERSoftware_sotaFFFTP
lea eax, [ebp - 0xc10]
push eax
call fcn.0045b942
add esp, 0xc
lea ecx, [ebp - 0x410]
push ecx
push 0x400
call fcn.004386a0
add esp, 8
test eax, eax
jbe 0x44a3d1
push 0x400
lea edx, [ebp - 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x44a3d1
lea eax, [ebp - 0x1420]
push eax
call fcn.00438720
add esp, 4
test eax, eax
je 0x44a3d1
push 5
push 0
lea ecx, [ebp - 0xc10]
push ecx
push str.regedit
push str.open
push 0
call fcn.00439b40
add esp, 0x18
cmp eax, 0x20
ja 0x44a3c2
push 0
push 0x476394
push 0x47872c
push 0
call fcn.00436d10
add esp, 0x10
lea edx, [ebp - 0x410]
push edx
call fcn.00438720
add esp, 4
jmp 0x44a42e
push str.FFFTP_Backup.ini
lea eax, [ebp - 0x1018]
push eax
call fcn.0045ad80
add esp, 8
push 1
push 0x402
push 0x478714
push 0x4786e4
push 0x4787a4
lea ecx, [ebp - 0x1018]
push ecx
call fcn.00431b60
push eax
call fcn.0043e4e0
add esp, 0x1c
cmp eax, 1
jne 0x44a42e
push 0
lea edx, [ebp - 0x1018]
push edx
call fcn.004353a0
push eax
call fcn.0043a870
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret
Function at 0x44a440
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1428
call fcn.0045d5a0
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x414], 0
push 0x4742d3
lea eax, [ebp - 0x1020]
push eax
call fcn.0045ad80
add esp, 8
push 0
push 0x1000
push 0x4742d3
push str.Reg
push 0x478864
lea ecx, [ebp - 0x1020]
push ecx
call fcn.00431b60
push eax
call fcn.0043e4e0
add esp, 0x1c
cmp eax, 1
jne 0x44a615
lea edx, [ebp - 0x1020]
push edx
call fcn.0045acf0
add esp, 4
cmp eax, 5
jb 0x44a5a0
push 0x47885c
lea eax, [ebp - 0x1020]
push eax
call fcn.0045acf0
add esp, 4
lea ecx, [ebp + eax - 0x1024]
push ecx
call fcn.0045b50d
add esp, 8
test eax, eax
jne 0x44a5a0
lea edx, [ebp - 0x1020]
push edx
push str.__s_
lea eax, [ebp - 0xc18]
push eax
call fcn.0045b942
add esp, 0xc
lea ecx, [ebp - 0x410]
push ecx
push 0x400
call fcn.004386a0
add esp, 8
test eax, eax
jbe 0x44a59e
push 0x400
lea edx, [ebp - 0x1428]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x44a59e
lea eax, [ebp - 0x1428]
push eax
call fcn.00438720
add esp, 4
test eax, eax
je 0x44a59e
push 5
push 0
lea ecx, [ebp - 0xc18]
push ecx
push str.regedit
push str.open
push 0
call fcn.00439b40
add esp, 0x18
cmp eax, 0x20
ja 0x44a585
push 0
push 0x476394
push 0x47872c
push 0
call fcn.00436d10
add esp, 0x10
jmp 0x44a58f
mov dword [ebp - 0x414], 1
lea edx, [ebp - 0x410]
push edx
call fcn.00438720
add esp, 4
jmp 0x44a615
lea eax, [ebp - 0x1020]
push eax
call fcn.0045acf0
add esp, 4
cmp eax, 5
jb 0x44a5ff
push 0x47884c
lea ecx, [ebp - 0x1020]
push ecx
call fcn.0045acf0
add esp, 4
lea edx, [ebp + eax - 0x1024]
push edx
call fcn.0045b50d
add esp, 8
test eax, eax
jne 0x44a5ff
push 0
call fcn.004353a0
push eax
lea eax, [ebp - 0x1020]
push eax
call fcn.0043a870
add esp, 0xc
mov dword [ebp - 0x414], 1
jmp 0x44a615
push 0
push 0x476394
push str..reg.ini.
push 0
call fcn.00436d10
add esp, 0x10
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret
Function at 0x44aca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call fcn.0045acf0
add esp, 4
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
test eax, eax
je 0x44ad86
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx]
shr edx, 4
and edx, 3
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax]
and ecx, 0xf
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 1]
and eax, 0xf
shl eax, 4
or ecx, eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
shl ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
and eax, 1
je 0x44ad25
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0xff
mov edx, dword [ebp - 8]
sar edx, 8
and edx, 0xff
or ecx, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov byte [edx], cl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x14]
jne 0x44ad81
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x44acd0
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0
mov esp, ebp
pop ebp
ret
Function at 0x453540
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x38
push 0x405
mov eax, dword [0x48e0a8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x453603
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x453601
mov dword [ebp - 8], 0
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
jne 0x4535c8
push 0x10
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00453320
add esp, 0xc
cmp eax, 1
je 0x4535c8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004353c0
cmp eax, 1
jne 0x4535c6
mov edx, dword [ebp + 0x14]
mov dword [edx], 1
jmp 0x45358c
mov eax, dword [ebp + 0x14]
cmp dword [eax], 1
jne 0x4535d2
jmp 0x453601
cmp dword [ebp - 8], 0
jne 0x4535e1
mov dword [ebp - 4], 0
jmp 0x4535f2
mov ecx, dword [ebp - 8]
push ecx
push str._Connect:_Error_d
call fcn.00456e80
add esp, 8
cmp dword [ebp - 4], 0
je 0x453601
cmp dword [ebp - 8], 0x2733
je 0x453585
jmp 0x453617
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._Connect:_AsyncSelect_error___d_
call fcn.00456e80
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x454d70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x48fe48], 0
jne 0x454d97
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
jmp 0x454e02
push 0x48fe20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00454440
add esp, 4
mov dword [ebp - 4], eax
push 0x48fe20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], 0
jne 0x454dda
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x454e02
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [0x48fe00]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x454dff
or eax, 0xffffffff
jmp 0x454e02
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x454e10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x48fe48], 0
jne 0x454e3a
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x454ec9
push 0x48fe20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00454440
add esp, 4
mov dword [ebp - 4], eax
push 0x48fe20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], 0
jne 0x454e7d
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x454ec9
mov eax, dword [ebp + 0x14]
and eax, 2
je 0x454ea1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [0x48fd74]
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x454ebb
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [0x48fda4]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x454ec6
or eax, 0xffffffff
jmp 0x454ec9
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret