joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de6c
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0xe4]
push ecx
lea edx, [ebp - 0xe8]
push edx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040cc5e
add esp, 0x18
push 0
mov eax, dword [ebp - 0x80]
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffff
jne 0x40ded0
xor eax, eax
jmp 0x40e04b
mov ecx, dword [ebp - 0xec]
push ecx
call fcn.0040cf9d
add esp, 4
cmp dword [ebp - 0x80], 2
jne 0x40def1
mov dword [ebp - 0xf0], 0
jmp 0x40df0a
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xec]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0xf0], eax
mov ecx, dword [ebp - 0xf0]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x40df3d
mov edx, dword [ebp - 8]
push edx
call fcn.0040db51
add esp, 4
test eax, eax
je 0x40df3d
mov eax, dword [ebp - 0xec]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x40e04b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xec]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e04f
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40df75
mov edx, dword [ebp - 0xec]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x40e04b
mov eax, dword [ebp - 4]
add eax, 0x14
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x80]
sub eax, 2
neg eax
sbb eax, eax
and al, 8
add eax, 0x100
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x58], eax
cmp dword [ebp - 0xe8], 0
je 0x40e048
call fcn.00401713
push eax
call section..text
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
je 0x40e022
lea ecx, [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x44]
push eax
call fcn.0040d00e
add esp, 8
test eax, eax
jne 0x40e022
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x44]
push eax
call fcn.0040cfbf
add esp, 8
test eax, eax
jne 0x40e022
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x44]
push edx
call fcn.00403292
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x40], 0
jne 0x40e032
mov eax, dword [ebp - 4]
push eax
call fcn.0040c91c
add esp, 4
xor eax, eax
jmp 0x40e04b
mov ecx, dword [ebp - 0xec]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
push eax
call fcn.004032e5
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40e132
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041dcd0
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0xffffffff
je 0x40e1a9
cmp dword [ebp + 0x10], 0
je 0x40e1a9
cmp dword [ebp + 0x14], 0x2000
jae 0x40e1a9
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2004], ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2000]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
mov edx, dword [ebp + 0x14]
add edx, 4
push edx
lea eax, [ebp - 0x2004]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0
push 1
lea eax, [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esp, ebp
pop ebp
ret

Function at 0x40e1ad
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push 0x14
push 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xffffffff
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0xffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
lea edx, [ebp - 0x190]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 2
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.0040c53f
add esp, 8
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0xffffffff
je 0x40e1f5
cmp dword [0x43359c], 0
jne 0x40e22c
call fcn.00403288
mov edx, dword [0x43359c]
add edx, 1
mov dword [0x43359c], edx
mov esp, ebp
pop ebp
ret

Function at 0x40e304
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40f835
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x411151
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
sub eax, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
push fcn.0041980d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18c]
push ecx
call fcn.0040de6c
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4111a2
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x58]
or ecx, 0x10
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [eax + 0x58], ecx
xor eax, eax
jmp 0x411268
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x58]
or edx, 0x800000
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], edx
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x194], 6
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [edx + 0x190], eax
push 0x431170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4111fe
push 0
push 0x13
push str.HTTP_1.1_200_OK_r_n_r_n
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x411263
push 7
push 0x431178
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x411227
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
add eax, 7
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x411253
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
movsx ecx, byte [eax]
cmp ecx, 0x2f
je 0x411253
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp 0x411227
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0041126c
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x412212
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041dcd0
cmp dword [ebp + 8], 0xffffffff
je 0x41222e
cmp dword [ebp + 8], 0x400
jb 0x412235
xor eax, eax
jmp 0x4122f5
mov dword [ebp - 0x1004], 0
mov dword [ebp - 0x1008], 0
jmp 0x41225a
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1004]
jae 0x41227e
mov edx, dword [ebp - 0x1008]
mov eax, dword [ebp + edx*4 - 0x1000]
cmp eax, dword [ebp + 8]
jne 0x41227c
jmp 0x41227e
jmp 0x41224b
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1004]
jne 0x4122b7
cmp dword [ebp - 0x1004], 0x400
jae 0x4122b7
mov edx, dword [ebp - 0x1008]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x1000], eax
mov ecx, dword [ebp - 0x1004]
add ecx, 1
mov dword [ebp - 0x1004], ecx
xor edx, edx
test edx, edx
jne 0x41223f
push 0
push 0
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x1004]
and eax, ecx
push eax
mov edx, dword [ebp + 0xc]
neg edx
sbb edx, edx
lea eax, [ebp - 0x1004]
and edx, eax
push edx
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x412b63
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412b96
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x431658
mov eax, dword [ebp + 8]
push eax
call fcn.00412a88
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x41389e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4008
call fcn.0041dcd0
mov dword [ebp - 0x4008], 0
cmp dword [ebp + 8], 0
jne 0x4138cb
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x413994
push 0x2254
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x4008], eax
cmp dword [ebp - 0x4008], 0
jne 0x4138f5
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x413994
push 0x2000
lea eax, [ebp - 0x4000]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004116c6
add esp, 0xc
lea edx, [ebp - 0x4000]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x4004], eax
cmp dword [ebp - 0x4004], 0xffffffff
je 0x41397a
mov eax, dword [ebp - 0x4004]
and eax, 0x10
cmp eax, 0x10
jne 0x41397a
push 0x431a24
lea ecx, [ebp - 0x4000]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
mov edx, dword [ebp - 0x4008]
add edx, 4
push edx
lea eax, [ebp - 0x4000]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x4008]
mov dword [ecx], eax
mov edx, dword [ebp - 0x4008]
mov byte [edx + 0x254], 0
jmp 0x413994
mov eax, dword [ebp - 0x4008]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [ebp - 0x4008], 0
mov eax, dword [ebp - 0x4008]
mov esp, ebp
pop ebp
ret

Function at 0x414482
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041dcd0
mov eax, dword [ebp + 0xc]
push eax
push 0x2000
push 1
lea ecx, [ebp - 0x2000]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x2004], eax
cmp dword [ebp - 0x2004], 0
jbe 0x4144d5
mov edx, dword [ebp - 0x2004]
push edx
lea eax, [ebp - 0x2000]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040ea27
add esp, 0xc
jmp 0x41448f
mov esp, ebp
pop ebp
ret

Function at 0x414c91
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x417ab1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x1f4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x170], 0
jbe 0x417ad1
mov dword [ebp - 4], 0x19f
jmp 0x417b25
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
test eax, eax
jne 0x417aeb
mov dword [ebp - 4], 0xc9
jmp 0x417b25
call dword [sym.imp.MSVCRT.dll__errno]
cmp dword [eax], 0x11
jne 0x417aff
mov dword [ebp - 4], 0x195
jmp 0x417b25
call dword [sym.imp.MSVCRT.dll__errno]
cmp dword [eax], 0xd
jne 0x417b13
mov dword [ebp - 4], 0x193
jmp 0x417b25
call dword [sym.imp.MSVCRT.dll__errno]
cmp dword [eax], 2
jne 0x417b25
mov dword [ebp - 4], 0x199
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004117c6
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x417b3b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00412fbb
add esp, 8
test eax, eax
je 0x417b6a
push 0
push 0x194
mov edx, dword [ebp + 8]
push edx
call fcn.004117c6
add esp, 0xc
jmp 0x417bd5
mov eax, dword [ebp - 0x2a]
and eax, 0xffff
and eax, 0x4000
test eax, eax
je 0x417b9c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00417bd9
add esp, 4
push 0
push 0xcc
mov edx, dword [ebp + 8]
push edx
call fcn.004117c6
add esp, 0xc
jmp 0x417bd5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
test eax, eax
jne 0x417bc2
push 0
push 0xcc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004117c6
add esp, 0xc
jmp 0x417bd5
push 0
push 0x1a7
mov edx, dword [ebp + 8]
push edx
call fcn.004117c6
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x417bd9
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.0041dcd0
mov eax, dword [ebp + 8]
push eax
call fcn.0041389e
add esp, 4
mov dword [ebp - 0x2038], eax
cmp dword [ebp - 0x2038], 0
jne 0x417c08
xor eax, eax
jmp 0x417cf3
mov ecx, dword [ebp - 0x2038]
push ecx
call fcn.004139f5
add esp, 4
mov dword [ebp - 0x2004], eax
cmp dword [ebp - 0x2004], 0
je 0x417cd2
push 0x431fb4
mov edx, dword [ebp - 0x2004]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x417c5a
push 0x431fb8
mov eax, dword [ebp - 0x2004]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x417c5c
jmp 0x417c08
mov ecx, dword [ebp - 0x2004]
push ecx
push 0x2f
mov edx, dword [ebp + 8]
push edx
push 0x431fbc
push 0x2000
lea eax, [ebp - 0x2000]
push eax
call fcn.0040f13a
add esp, 0x18
lea ecx, [ebp - 0x2034]
push ecx
lea edx, [ebp - 0x2000]
push edx
call fcn.00412fbb
add esp, 8
mov eax, dword [ebp - 0x202e]
and eax, 0xffff
and eax, 0x4000
test eax, eax
je 0x417cbd
lea ecx, [ebp - 0x2000]
push ecx
call fcn.00417bd9
add esp, 4
jmp 0x417ccd
lea edx, [ebp - 0x2000]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
jmp 0x417c08
mov eax, dword [ebp - 0x2038]
push eax
call fcn.0041399e
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll__rmdir]
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x417f65
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.0041dcd0
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2008], ecx
jmp 0x417f98
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2008], eax
push 0x2f
mov ecx, dword [ebp - 0x2008]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418039
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 8]
cmp edx, 0x2000
jl 0x417fca
or eax, 0xffffffff
jmp 0x41803e
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2004]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 8]
mov byte [ebp + eax - 0x2004], 0
lea ecx, [ebp - 0x2038]
push ecx
lea edx, [ebp - 0x2004]
push edx
call fcn.00412fbb
add esp, 8
test eax, eax
je 0x418025
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
test eax, eax
je 0x418025
or eax, 0xffffffff
jmp 0x41803e
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 1]
test edx, edx
jne 0x418034
xor eax, eax
jmp 0x41803e
jmp 0x417f86
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x419f2f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0041dcd0
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x38], 0x4000
jbe 0x419f50
jmp 0x41a059
mov edx, dword [ebp + 8]
add edx, 0x1a8
mov dword [ebp - 0x2008], edx
mov eax, dword [ebp - 0x2008]
cmp dword [eax + 4], 0
jg 0x419f8c
jl 0x419f7b
mov ecx, dword [ebp - 0x2008]
cmp dword [ecx], 0x2000
jae 0x419f8c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1a8]
mov dword [ebp - 0x200c], eax
jmp 0x419f96
mov dword [ebp - 0x200c], 0x2000
mov ecx, dword [ebp - 0x200c]
push ecx
lea edx, [ebp - 0x2000]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x190]
push ecx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov dword [ebp - 0x2004], eax
cmp dword [ebp - 0x2004], 0
ja 0x419fd7
mov edx, dword [ebp + 8]
push edx
call fcn.00414669
add esp, 4
jmp 0x41a059
cmp dword [ebp - 0x2004], 0
jbe 0x41a059
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2004]
xor edx, edx
mov esi, dword [eax + 0x1a8]
sub esi, ecx
mov eax, dword [eax + 0x1ac]
sbb eax, edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a8], esi
mov dword [ecx + 0x1ac], eax
mov edx, dword [ebp - 0x2004]
push edx
lea eax, [ebp - 0x2000]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.0040d330
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x1a8
mov dword [ebp - 0x2010], eax
mov ecx, dword [ebp - 0x2010]
cmp dword [ecx + 4], 0
jg 0x41a059
jl 0x41a04d
mov edx, dword [ebp - 0x2010]
cmp dword [edx], 0
ja 0x41a059
mov eax, dword [ebp + 8]
push eax
call fcn.00414669
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a9a8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push str.STARTING_mongoose
push 0x4327b8
call fcn.0041ab7c
add esp, 8
call fcn.0041ace1
push str.initialized_utf8_argv
push 0x4327d4
call fcn.0041ab7c
add esp, 8
call fcn.0041adc3
push str.initialized_server_name
push 0x4327f0
call fcn.0041ab7c
add esp, 8
push str.initialized_texts
push 0x432808
call fcn.0041ab7c
add esp, 8
push 0x28
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x28], 0x41af00
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x433920
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push str.registered_window_class
push 0x432824
call fcn.0041ab7c
add esp, 8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xcf0000
push 0x433920
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
push str.created_window
push 0x432838
call fcn.0041ab7c
add esp, 8
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.shown_windows
push 0x43284c
call fcn.0041ab7c
add esp, 8
mov dword [0x4339b8], 0x58
mov dword [0x4339c0], 0x96
mov dword [0x4339c4], 7
push 0
push 0x10
push 0x10
push 1
push 0x96
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x4338f8], eax
mov ecx, dword [0x4338f8]
mov dword [0x4339cc], ecx
mov edx, dword [ebp - 4]
mov dword [0x4339bc], edx
push 0x433920
push 0x432850
push 0x40
push 0x4339d0
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov dword [0x4339c8], 0x400
push 0x4339b8
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push str.created_systray_icon
push 0x43286c
call fcn.0041ab7c
add esp, 8
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jle 0x41ab66
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41ab3a
push str.EXITING_mongoose
call fcn.0041ab7c
add esp, 4
mov eax, dword [ebp - 0x40]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ace1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0041dcd0
push 0x433880
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41ad9b
push 4
mov eax, dword [0x433880]
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov dword [0x433884], eax
mov dword [ebp - 0x2008], 0
jmp 0x41ad41
mov ecx, dword [ebp - 0x2008]
add ecx, 1
mov dword [ebp - 0x2008], ecx
mov edx, dword [ebp - 0x2008]
cmp edx, dword [0x433880]
jge 0x41ad91
push 0x2000
lea eax, [ebp - 0x2004]
push eax
mov ecx, dword [ebp - 0x2008]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4]
push eax
call fcn.0041ad9f
add esp, 0xc
lea ecx, [ebp - 0x2004]
push ecx
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov edx, dword [ebp - 0x2008]
mov ecx, dword [0x433884]
mov dword [ecx + edx*4], eax
jmp 0x41ad32
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esp, ebp
pop ebp
ret

Function at 0x41b8c3
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
movsx eax, byte [0x4336e0]
test eax, eax
jne 0x41b953
push 0xc8
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x41b933
lea edx, [ebp - 0xc8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
je 0x41b933
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x432bbc
push 0x32
push 0x4336e0
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
movsx ecx, byte [0x4336e0]
test ecx, ecx
jne 0x41b953
push str.127.0.0.1
push 0x32
push 0x4336e0
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0xc
mov eax, 0x4336e0
mov esp, ebp
pop ebp
ret

Function at 0x41b99f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [ebp + 8]
push eax
call fcn.0041b7e6
push eax
push str._s_s
push 0xc8
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
push 5
push 0
push 0
lea edx, [ebp - 0xc8]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret
Function at 0x41ba3b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov dword [0x433a18], eax
push 0x41bcc4
push 0
call fcn.0041a588
add esp, 8
mov dword [0x433a14], eax
cmp dword [0x433a14], 0
jne 0x41ba75
push str.Failed_to_start_Mongoose.
push 0x432c38
call fcn.0041bb29
add esp, 8
push str.created_server
push 0x432c4c
call fcn.0041ab7c
add esp, 8
cmp dword [ebp + 8], 1
jle 0x41bae0
push 0x432c50
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x41bae0
cmp dword [ebp + 8], 6
je 0x41bab0
call fcn.0041bb92
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ecx
call fcn.0041a678
add esp, 0x10
neg eax
sbb eax, eax
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
cmp dword [ebp + 8], 2
jne 0x41bb1b
push 0x432c54
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x41bb16
push str.__help
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x41bb1b
call fcn.0041bb92
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041c9b4
add esp, 4
pop ebp
ret

Function at 0x41bb50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x40
push edx
call dword [sym.imp.MSVCRT.dll_vfprintf]
add esp, 0xc
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
push 0xa
call dword [sym.imp.MSVCRT.dll_fputc]
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x41bb90
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop ebp
ret