joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434a90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x434b7b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x434b03
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.0040624c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x434b60
mov eax, dword [ebp - 4]
call fcn.0040624c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x434b60
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.00406404
mov eax, dword [ebp - 0xc]
call fcn.00405bbc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x434b60
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406404
mov eax, dword [ebp - 0x10]
call fcn.00405bbc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434b82
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405524
ret

Function at 0x435214
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004197c0
test eax, eax
je 0x4352c5
cmp word [eax + 0x18], 0x20b
jne 0x435252
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x435264
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x4352c5
jmp 0x4352bf
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x43527b
push ebp
call fcn.00435054
pop ecx
jmp 0x4352c5
cmp dword [esi + 0x10], 0
je 0x4352bc
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x4352b7
cmp edi, dword [ebx]
jne 0x4352b4
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4352b4
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x435289
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x43526a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436514
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x436699
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.004061c0
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x43666d
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x43666d
cmp dword [0x52eccc], 0
jne 0x436596
push 0x4366a8
push 0x4366d4
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00409134
mov dword [0x52eccc], eax
cmp dword [0x52eccc], 0
je 0x4365c8
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x52eccc]
test eax, eax
je 0x4365c8
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004063c0
jmp 0x4365ff
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4365ff
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.004057b4
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.004063dc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x43662b
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.00433e9c
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040e5b0
cmp dword [edi], 0
je 0x43666d
mov eax, dword [edi]
call fcn.00406470
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x43666d
test bl, bl
je 0x436658
mov eax, edi
mov edx, 0x4366f8
call fcn.00406514
jmp 0x43666d
mov eax, dword [edi]
call fcn.00406470
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.004068e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4366a0
lea eax, [ebp - 0x21c]
call fcn.004061b0
lea eax, [ebp - 0x218]
call fcn.00405500
lea eax, [ebp - 4]
call fcn.00408064
ret
Function at 0x437144
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004061a8
xor eax, eax
push ebp
push 0x4371fa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x437178
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4371e4
lea eax, [ebp - 4]
call fcn.004056e0
call fcn.00406470
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x4371df
lea eax, [ebp - 4]
call fcn.004056e0
call fcn.00406470
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.0040624c
mov edx, esi
pop ecx
call fcn.00403248
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437201
lea eax, [ebp - 4]
call fcn.004061b0
ret
Function at 0x439398
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x43954c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.004392cc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43952a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x524ea4], 0
jne 0x4394fe
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.00434c50
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040cce0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x43956c
call fcn.00405944
mov eax, dword [ebp - 0x2c]
call fcn.00405bbc
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x439472
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040cce0
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x43956c
call fcn.00405944
mov eax, dword [ebp - 0x34]
call fcn.00405bbc
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x43948d
xor esi, esi
push 0
push 0x439584
push 0x439590
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x4394ed
test bl, bl
je 0x4394d4
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.00409dc0
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x4394ed
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x4394fe
mov eax, esi
call fcn.00467714
mov dword [0x524ea4], esi
cmp dword [0x524ea4], 0
je 0x439514
mov eax, dword [0x524ea4]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439531
mov eax, dword [ebp - 8]
call fcn.00439384
ret

Function at 0x43d5a0
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x524ed0], 0
jne 0x43d633
xor eax, eax
call fcn.00418f60
mov dword [0x524ed0], eax
cmp dword [0x524ed0], 0
je 0x43d633
mov eax, 0x43d404
xor ecx, ecx
xor edx, edx
call fcn.00419464
mov dword [0x524ed4], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x524ee4], eax
push 0x524ec8
push 4
push 0
push 0x43d44c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x524ecc], eax
cmp dword [0x524ecc], 0
je 0x43d633
mov edx, 0x43d640
mov eax, dword [0x524ec8]
call fcn.004358ac
push 2
mov eax, dword [0x524ecc]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x524ecc]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x43d67c
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x524ed0], 0
je 0x43d74d
mov ebx, dword [0x524ee4]
xor eax, eax
mov dword [0x524ee4], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x524ee0], 0
je 0x43d6c5
mov ebx, dword [0x524ee0]
xor eax, eax
mov dword [0x524ee0], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x524edc], 0xffffffff
mov eax, 0x43d404
xor ecx, ecx
xor edx, edx
call fcn.00419690
push 0x1f4
mov eax, dword [0x524ecc]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43d712
push 0
mov eax, dword [0x524ecc]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x524ee8], 0
je 0x43d712
mov eax, dword [0x524ee8]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
mov dword [0x524ee8], eax
mov eax, dword [0x524ecc]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x524ec8]
call fcn.00435620
xor eax, eax
mov dword [0x524ecc], eax
xor eax, eax
mov dword [0x524ec8], eax
xor eax, eax
mov dword [0x524ed0], eax
pop ebx
ret
Function at 0x4456b4
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00405bbc
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4456e0
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4456e0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4472dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x52456c], 0
je 0x447302
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00447274
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.0043355c
test al, al
jne 0x447382
cmp esi, 0x80090318
jne 0x44738a
test edi, edi
je 0x44738a
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4473ba
cmp dword [ebp - 0x24], 0
je 0x4473ba
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4473b0
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4473ce
cmp dword [ebp - 0x18], 0
je 0x4473ce
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4473dc
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeac
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x447461
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x52458c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x44759b
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x44759b
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
mov dword [esp + 0x160], 2
xor eax, eax
mov dword [esp + 0x164], eax
lea eax, [esp + 0x160]
push eax
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00447274
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.004472dc
mov ebp, eax
sub ebp, 0x80090318
je 0x447593
sub ebp, 0x7ff6fce8
je 0x447510
sub ebp, 0x90312
je 0x447558
sub ebp, 0xe
je 0x447584
jmp 0x44759b
cmp dword [esp + 0x30], 5
jne 0x447552
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403248
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x44759b
cmp dword [esp + 0x30], 5
jne 0x44757d
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.00403248
mov esi, dword [esp + 0x2c]
jmp 0x4473f6
xor esi, esi
jmp 0x4473f6
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x4473f6
or edi, 0xffffffff
jmp 0x4473f6
movzx eax, byte [esp]
add esp, 0x154
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4475ac
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405bac
xor eax, eax
push ebp
push 0x447729
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.00405bbc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405710
call fcn.00405894
mov edi, eax
mov dword [ebp - 0x10], 0x400
cmp dword [ebx + 8], 0
je 0x447705
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x68]
jbe 0x447705
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
jmp 0x447705
cmp edi, dword [ebp - 0x10]
jbe 0x447622
mov esi, dword [ebp - 0x10]
jmp 0x447624
mov esi, edi
cmp dword [ebx + 8], 0
je 0x4476ea
mov edx, dword [ebx + 0x78]
add edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.00403248
push 3
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
add eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 3
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x6c]
push eax
push 3
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], 6
xor eax, eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
push 3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00447274
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebx + 0x54]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x4476df
push 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4476e3
xor eax, eax
jmp 0x4476e5
mov al, 1
mov byte [ebp - 5], al
jmp 0x447700
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg byte [ebp - 5]
add dword [ebp - 0xc], esi
sub edi, esi
cmp byte [ebp - 5], 0
je 0x447713
test edi, edi
ja 0x447618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447730
lea eax, [ebp - 4]
call fcn.00405500
ret
Function at 0x44849c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x448703
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4486bf
cmp byte [0x524574], 0
jne 0x448527
mov eax, ebx
call fcn.00435324
test al, al
je 0x448564
push 0x448724
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.0040e2a0
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041b2dc
push dword [ebp - 0x21c]
push 0x44873c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405a10
jmp 0x448573
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00406404
push 0x44874c
lea eax, [ebp - 0x228]
mov edx, dword [0x524f58]
mov ecx, 0
call fcn.004057b4
push dword [ebp - 0x228]
push 0x44875c
push 0x44876c
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.004460fc
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.00406404
push dword [ebp - 0x22c]
push 0x448788
push dword [ebp - 4]
push 0x4487a0
push 0x44875c
push 0x4487b0
push 0x44875c
push 0x4487e0
push dword [ebp - 4]
push 0x4487a0
push 0x44875c
push 0x44875c
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.00405a10
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.004475ac
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x4486bf
cmp esi, 0xff
jbe 0x448631
mov ebx, 0xff
jmp 0x448633
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x448653
cmp ebx, dword [ebp - 0x14]
je 0x448665
mov edx, 0x44875c
mov eax, edi
call fcn.004475ac
mov byte [ebp - 0xd], 0
jmp 0x4486bf
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.0041b1a4
lea eax, [ebp - 0x234]
mov edx, 0x44875c
call fcn.004058c8
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.004475ac
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x4486b7
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x448622
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44870a
lea eax, [ebp - 0x234]
call fcn.00405500
lea eax, [ebp - 0x230]
call fcn.004061b0
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.00405524
lea eax, [ebp - 4]
call fcn.00405500
ret
Function at 0x44a8c8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44a9ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x44a912
mov dword [ebp - 0x10], 0x600
jmp 0x44a919
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00405d5c
test esi, esi
jbe 0x44a9d1
cmp esi, dword [ebp - 0x10]
jae 0x44a93f
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.00405d5c
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405710
call fcn.00405894
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44a97a
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405710
call fcn.00405894
cmp eax, dword [ebp - 0x14]
je 0x44a97e
xor ebx, ebx
jmp 0x44a9d1
cmp byte [ebp + 8], 0
je 0x44a99d
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0041b2dc
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00449c0c
mov ebx, eax
jmp 0x44a9a9
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00449c0c
mov ebx, eax
test bl, bl
je 0x44a9d1
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0044a1a0
test esi, esi
ja 0x44a92e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a9f6
lea eax, [ebp - 0x18]
call fcn.00405500
lea eax, [ebp - 4]
call fcn.00405500
ret
Function at 0x4501ec
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004061a8
xor eax, eax
push ebp
push 0x450340
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040e5b0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406214
cmp dword [ebp - 4], 0
je 0x450316
lea eax, [ebp - 4]
call fcn.004056e0
call fcn.00406470
mov ebx, eax
lea eax, [ebp - 4]
call fcn.004056e0
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x45026a
lea eax, [ebp - 4]
call fcn.004056e0
call fcn.00406470
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004068e4
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4502b6
mov eax, dword [ebp - 4]
call fcn.0040624c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x4502b2
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004501ec
pop ecx
test al, al
je 0x4502ae
push 0
mov eax, dword [ebp - 4]
call fcn.0040624c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4502b2
xor ebx, ebx
jmp 0x450318
mov bl, 1
jmp 0x450318
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406404
mov eax, dword [ebp - 0xc]
call fcn.00405bbc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x450312
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004501ec
pop ecx
test al, al
je 0x45030e
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406404
mov eax, dword [ebp - 0x10]
call fcn.00405bbc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x450312
xor ebx, ebx
jmp 0x450318
mov bl, 1
jmp 0x450318
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450347
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405524
lea eax, [ebp - 8]
mov edx, 2
call fcn.004061b8
ret