joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422800
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 + 0x190]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
shl eax, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x1b8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 4]
sub edx, dword [ecx + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x438]
mov edx, dword [ecx + 0x3c]
and edx, 3
test edx, edx
je 0x42293a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax*4 + 0x1a8], 0x4229a0
jne 0x42293a
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x42287b
cmp dword [ebp - 0xc], 0
je 0x42293a
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call fcn.004104d0
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x42293a
mov ecx, dword [ebp - 0x10]
and ecx, 1
test ecx, ecx
je 0x42293a
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x4228ec
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x8000
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [0x4777f4]
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
mov dword [edx + 8], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x422930
xor ecx, ecx
test ecx, ecx
jne 0x4228f4
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 8]
push ecx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x42292e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + 8], edx
jmp 0x42293a
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422ff0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x423042
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0x2733
sete al
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42303b
mov eax, 0x51
jmp 0x42304c
mov eax, 0x38
jmp 0x42304c
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4233f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1a0], 0
je 0x42342d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x12c]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
call dword [ecx + 0x1a0]
add esp, 0x14
jmp 0x423484
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jl 0x423482
cmp dword [ebp - 4], 2
jle 0x423441
jmp 0x423482
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x128]
push ecx
push 1
push 2
mov edx, dword [ebp + 0xc]
imul edx, edx, 3
add edx, 0x46ac40
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x128]
push ecx
push 1
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4269e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x8c], 2
jne 0x426a08
jmp 0x426bed
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3a0], 0
jne 0x426be1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x410], 0
jne 0x426be1
mov dword [ebp - 4], 0x80
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x426a88
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00429fa0
add esp, 8
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
push str.getpeername___failed_with_errno__d:__s
mov edx, dword [ebp - 0x108]
push edx
call fcn.004224c0
add esp, 0x10
jmp 0x426bed
mov dword [ebp - 4], 0x80
push 0x80
push 0
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x426afe
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00429fa0
add esp, 8
push eax
mov eax, dword [ebp - 0x10c]
push eax
push str.getsockname___failed_with_errno__d:__s
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.004224c0
add esp, 0x10
jmp 0x426bed
mov edx, dword [ebp + 8]
add edx, 0x130
push edx
mov eax, dword [ebp + 8]
add eax, 0x102
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.00426c00
add esp, 0xc
test eax, eax
jne 0x426b64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00429fa0
add esp, 8
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
push str.ssrem_inet_ntop___failed_with_errno__d:__s
mov edx, dword [ebp - 0x108]
push edx
call fcn.004224c0
add esp, 0x10
jmp 0x426bed
push 0x2e
mov eax, dword [ebp + 8]
add eax, 0x102
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x58
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x164
push edx
mov eax, dword [ebp + 8]
add eax, 0x134
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.00426c00
add esp, 0xc
test eax, eax
jne 0x426be1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00429fa0
add esp, 8
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
push str.ssloc_inet_ntop___failed_with_errno__d:__s
mov edx, dword [ebp - 0x108]
push edx
call fcn.004224c0
add esp, 0x10
jmp 0x426bed
mov eax, dword [ebp + 8]
push eax
call fcn.00426930
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4272f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 6
push 4
lea edx, [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x427350
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00429fa0
add esp, 8
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
mov eax, dword [ebp - 4]
push eax
call fcn.00422440
add esp, 0xc
jmp 0x427361
push str.TCP_NODELAY_set_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.00422440
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427370
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x4020
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
cmp dword [0x477af8], 0
jne 0x4273c1
push 3
push 2
push 0
push 6
call fcn.00431b80
add esp, 0x10
test eax, eax
je 0x4273b7
mov dword [0x477af8], 2
jmp 0x4273c1
mov dword [0x477af8], 1
cmp dword [0x477af8], 2
jne 0x4273cc
jmp 0x427410
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4273f6
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jle 0x4273f6
jmp 0x427410
push 4
lea ecx, [ebp - 4]
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427830
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x528], 0
setne cl
mov dword [ebp - 4], ecx
push 4
lea edx, [ebp - 4]
push edx
push 8
push 0xffff
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x427880
mov ecx, dword [ebp + 0xc]
push ecx
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov edx, dword [ebp + 8]
push edx
call fcn.00422440
add esp, 0xc
jmp 0x427916
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x52c]
push ecx
call fcn.00431330
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
imul edx, edx, 0x3e8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x530]
push edx
call fcn.00431330
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x427916
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov edx, dword [ebp + 0xc]
push edx
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov eax, dword [ebp + 8]
push eax
call fcn.00422440
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428180
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1d8], 0
je 0x4281ab
mov ecx, dword [ebp + 8]
push ecx
call fcn.004129f0
add esp, 4
test eax, eax
jne 0x4281a9
xor eax, eax
jmp 0x4281e0
jmp 0x4281db
mov edx, dword [ebp + 8]
cmp dword [edx + 0x190], 0xffffffff
jne 0x4281bb
xor eax, eax
jmp 0x4281e0
push 2
push 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x190]
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4281db
xor eax, eax
jmp 0x4281e0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4284c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4284f1
cmp dword [ebp - 4], 0xffffffff
jne 0x4284f5
xor eax, eax
jmp 0x4284f8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x428ad0
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x429350
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.00428a60
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
cmp dword [0x477b00], 0
je 0x4288a8
mov eax, dword [ebp + 8]
and eax, 0xffff
mov eax, dword [eax*8 + 0x47784c]
jmp 0x428a4b
push 0x104
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4288c3
jmp 0x42899d
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x238]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ws2_32
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42892c
push str.getaddrinfo
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x42892c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x428934
jmp 0x42899d
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x238]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.wship6
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42899d
push str.getaddrinfo
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x42899d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x428a32
mov dword [ebp - 0x24], 0
jmp 0x4289b9
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [0x46b29c]
jge 0x4289fc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + ecx*8 - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 0x24]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x4289fa
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
jmp 0x4289fc
jmp 0x4289b0
cmp dword [ebp - 4], 0
je 0x428a32
mov dword [ebp - 0x24], 0
jmp 0x428a14
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [0x46b29c]
jge 0x428a32
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + ecx*8 - 0x18]
mov dword [eax*8 + 0x47784c], edx
jmp 0x428a0b
mov dword [0x477b00], 1
mov eax, dword [ebp + 8]
and eax, 0xffff
mov eax, dword [eax*8 + 0x47784c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429190
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x429261
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x42923b
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x42923b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x4291f8
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x42923b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
mov ax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00428f60
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x42922e
mov eax, 8
jmp 0x4292a6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 4], ecx
jmp 0x4291ef
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp + 0x18]
mov byte [edx + 0x400], 0
xor eax, eax
jmp 0x4292a6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x2af9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
ja case.default.0x42927e
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x4292af]
mov eax, 0x2af9
jmp 0x4292a6
mov eax, 0x2afa
jmp 0x4292a6
mov eax, 0x2afb
jmp 0x4292a6
mov eax, 0x2af9
jmp 0x4292a6
mov eax, 0x2af9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x42fa80
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x42fab0
mov eax, 2
jmp 0x42fae7
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x42fad9
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x42fae7
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
call fcn.004312c0
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431d00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x431d32
xor eax, eax
jmp 0x431e82
push str.LoadLibraryExA
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x46de88
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strpbrk]
add esp, 8
test eax, eax
je 0x431d88
cmp dword [ebp - 8], 0
je 0x431d70
push 8
push 0
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jmp 0x431d7d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
jmp 0x431e7f
cmp dword [ebp - 8], 0
je 0x431db7
push str.AddDllDirectory
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431db7
push 0x800
push 0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x431e7f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x431e7f
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [eax + edx + 1]
push ecx
call dword [0x4777f4]
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x431e72
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x431e72
push 0x46de74
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, eax
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, eax
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [ebp - 8], 0
je 0x431e5f
push 8
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 8]
mov dword [ebp - 0x20], eax
jmp 0x431e6c
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
push eax
call dword [0x4777f8]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43cdd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
Function at 0x440bd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
push esi
push edi
xor eax, eax
test eax, eax
jne 0x440bdc
mov word [ebp - 8], 2
lea ecx, [ebp - 0x198]
push ecx
mov dx, word [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x440c1f
mov eax, dword [ebp - 4]
push eax
push str.WSAStartup_failed___d_
mov ecx, dword [ebp + 8]
push ecx
call fcn.004224c0
add esp, 0xc
mov eax, 2
jmp 0x440c98
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 0x198]
and edx, 0xffff
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 8]
and eax, 0xffff
and eax, 0xff
and eax, 0xff
cmp edx, eax
jne 0x440c7e
mov ecx, dword [ebp - 0x198]
and ecx, 0xffff
shr ecx, 8
and ecx, 0xff
mov edx, dword [ebp - 8]
and edx, 0xffff
shr edx, 8
and edx, 0xff
cmp ecx, edx
je 0x440c96
push str.insufficient_winsock_version_to_support_telnet
mov eax, dword [ebp + 8]
push eax
call fcn.004224c0
add esp, 8
mov eax, 2
jmp 0x440c98
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x440f50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0xff
mov dl, byte [ebp + 0xc]
mov byte [ebp - 3], dl
mov al, byte [ebp + 0x10]
mov byte [ebp - 2], al
push 0
push 3
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x190]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x440fb0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.Sending_data_failed___d_
mov edx, dword [ebp - 0x10]
push edx
call fcn.004224c0
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SENT
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00440fe0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret