joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401985
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call sym._VMCISock_GetAFValue
mov dword [my_addr.svm_zero], eax
call dbg.debug_is_active
test eax, eax
je 0x401a00
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408056
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.vmci_listening_in_port__d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [my_addr.svm_zero]
mov dword [esp], eax
call sym._socket_12
sub esp, 0xc
mov dword [my_addr.svm_cid], eax
cmp dword [my_addr.svm_cid], 0
jns 0x401a3f
mov dword [esp], str.error_creating_socket
call dbg.psockerror
mov dword [esp], 1
call sym._exit
call dbg.debug_is_active
test eax, eax
je 0x401aab
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408056
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [my_addr.svm_cid]
mov dword [esp + 8], eax
mov dword [esp + 4], str.vmci_socket_d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [my_addr.svm_family], 0
mov dword [my_addr.svm_port], 0
mov eax, dword [my_addr.svm_zero]
mov word [ebp - 0x20], ax
mov dword [my_addr.svm_family], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [my_addr.svm_cid]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._bind_12
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x401b74
mov dword [esp], str.bind
call dbg.psockerror
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x33
mov dword [esp + 4], 1
mov dword [esp], str.Maybe_you_are_not_running_as_root_or_Administrator_n
call sym._fwrite
cmp dword [ebp + 8], 0x3ff
jg 0x401b62
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 1
mov dword [esp], str.Listening_in_ports_lower_than_1024_require_running_as_root_or_Administrator_n
call sym._fwrite
mov eax, dword [my_addr.svm_cid]
mov dword [esp], eax
call dbg.socket_close
mov eax, 0xffffffff
jmp 0x401ba5
mov eax, dword [my_addr.svm_cid]
mov dword [esp + 4], 0x64
mov dword [esp], eax
call sym._listen_8
sub esp, 8
cmp eax, 0xffffffff
jne 0x401ba2
mov dword [esp], str.listen
call dbg.psockerror
mov eax, 0xffffffff
jmp 0x401ba5
mov eax, dword [my_addr.svm_cid]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x401baa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call sym._VMCISock_GetAFValue
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffffff
call dbg.debug_is_active
test eax, eax
je 0x401c2c
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408056
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.vsocket_is_available__VMware_vmci_address_familly_d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
cmp dword [ebp - 0x10], 0
jle 0x401ca6
call dbg.VMCISock_GetLocalCID
mov dword [ebp - 0xc], eax
call dbg.debug_is_active
test eax, eax
je 0x401ca6
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408056
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.VMware_vmci_local_CID_u
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
cmp dword [ebp - 0x10], 0
jle 0x401d32
cmp dword [ebp - 0xc], 0xffffffff
je 0x401d32
call dbg.debug_is_active
test eax, eax
je 0x401d2b
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408056
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.TRUE
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 1
jmp 0x401daa
call dbg.debug_is_active
test eax, eax
je 0x401da5
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408056
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.FALSE__d__d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x401db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._VMCISock_GetAFValue
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], str.VMware_vsockets_environment_properties_n
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x28
mov dword [esp + 4], 1
mov dword [esp], str._n
call sym._fwrite
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.VMware_vmci_address_familly_d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
cmp dword [ebp - 0xc], 0
jle 0x401efc
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.VMware_vmci_is_present_n
call sym._fwrite
call dbg.VMCISock_GetLocalCID
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.VMware_vmci_local_CID_u_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
cmp dword [ebp - 0x10], 2
jne 0x401eae
mov dword [esp + 8], 2
mov dword [esp + 4], str.VMware_Hypervisor_host_machine_detected__CID_u__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
jmp 0x401ef5
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401ed6
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.Physical_machine_without_hypervisor_installation_detected__CID_u__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
jmp 0x401ef5
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Guest_machine_detected__CID_u__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, 1
jmp 0x401f29
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], str.vmci_is_NOT_present_n
call sym._fwrite
mov eax, 0
leave
ret
Function at 0x401ff1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
call sym._GetLastError_0
mov edx, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x100
lea eax, [ebp - 0x108]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0x1200
call sym._FormatMessageA_28
sub esp, 0x1c
call sym._WSAGetLastError_0
mov edx, eax
lea eax, [ebp - 0x108]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:__WinSock_error__d___s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
call sym._WSAGetLastError_0
cmp eax, 0x273f
jne 0x4020ef
call dbg.VMCISock_GetAFValue
mov dword [esp + 8], eax
mov dword [esp + 4], str.Seems_vSockets_protocol___d__not_registred_in_WinSock_protocols_catalog_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x29
mov dword [esp + 4], 1
mov dword [esp], str.Please_check:_netsh_winsock_show_catalog_n
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 1
mov dword [esp], str.Or:_HKLMSYSTEMCurrentControlSetServicesWinSock2Parameters_n
call sym._fwrite
nop
leave
ret
Function at 0x4024e6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call dbg.debug_is_active
test eax, eax
je 0x402570
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sock_delete_list_traverse_func__socket_entry_u_socket2delete_u_
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jne 0x40261b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
test eax, eax
je 0x402596
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc]
mov word [eax + 0x10], 1
call dbg.debug_is_active
test eax, eax
je 0x402614
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str._sock_delete_list_traverse_func
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
jmp 0x402620
mov eax, 1
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x402626
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
call dbg.debug_is_active
test eax, eax
je 0x402699
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._socket_list_delete__socket_u_
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.sock_delete_list_traverse_func
lea edx, [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._liblist_list_traverse
cmp eax, 1
jne 0x40273e
call dbg.debug_is_active
test eax, eax
je 0x402737
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x19
mov dword [esp + 4], 1
mov dword [esp], str._socket_list_delete_TRUE_
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 1
jmp 0x4027b8
call dbg.debug_is_active
test eax, eax
je 0x4027b3
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 1
mov dword [esp], str._socket_list_delete_FALSE_
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x4028ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call dbg.debug_is_active
test eax, eax
je 0x402929
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], 0x408600
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x10]
test ax, ax
jne 0x402a1d
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x12]
test ax, ax
jne 0x4029af
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp eax, 0x3f
ja 0x402a1d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.___WSAFDIsSet_8
sub esp, 8
test eax, eax
jne 0x402a1d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [eax + 1]
mov edx, dword [ebp - 0x18]
mov dword [edx], ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edx + eax*4 + 4], ecx
jmp 0x402a1d
call dbg.debug_is_active
test eax, eax
je 0x402a1d
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str.file_descriptor__d_ignored
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
call dbg.debug_is_active
test eax, eax
je 0x402a92
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str._sock_fdset_list_traverse_func
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x402ad8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call dbg.debug_is_active
test eax, eax
je 0x402b53
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sock_remove_marked_for_removal_list_traverse_func__socket_entry_u__
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x10]
test ax, ax
je 0x402bdb
call dbg.debug_is_active
test eax, eax
je 0x402bd4
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x32
mov dword [esp + 4], 1
mov dword [esp], str._sock_remove_marked_for_removal_list_traverse_func
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
jmp 0x402be0
mov eax, 1
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x402c5e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call dbg.debug_is_active
test eax, eax
je 0x402cda
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x25
mov dword [esp + 4], 1
mov dword [esp], 0x4086d8
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x12]
test ax, ax
jne 0x402d35
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.___WSAFDIsSet_8
sub esp, 8
test eax, eax
je 0x402d5e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
jmp 0x402d5e
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.sock_handle_poll_for_special_descriptor_event
test eax, eax
je 0x402d5e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
call dbg.debug_is_active
test eax, eax
je 0x402dd3
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x25
mov dword [esp + 4], 1
mov dword [esp], str._sock_handle_event_list_traverse_func
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40320b
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov dword [ebp - 0x7fc], 0x10
mov dword [ebp - 0x800], 0x10
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x7fc]
mov dword [esp + 8], edx
lea edx, [ebp - 0x7e8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._getsockname_12
sub esp, 0xc
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x800]
mov dword [esp + 8], edx
lea edx, [ebp - 0x7f8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._getpeername_12
sub esp, 0xc
lea eax, [ebp - 0x7e8]
mov dword [esp], eax
call dbg.socket_addr2string
mov dword [esp + 4], eax
lea eax, [ebp - 0x3f0]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x7f8]
mov dword [esp], eax
call dbg.socket_addr2string
mov dword [esp + 4], eax
lea eax, [ebp - 0x7d8]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x7d8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3f0]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s____s
mov dword [esp], global_buffer.2
call sym._sprintf
mov eax, global_buffer.2
leave
ret

Function at 0x4032db
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1c4
mov word [ebp - 0xa], 0x202
movzx eax, word [ebp - 0xa]
lea edx, [ebp - 0x1a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._WSAStartup_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x403380
call dbg.debug_is_active
test eax, eax
je 0x403379
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408475
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WSAStartup_failed_with_error:__d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
jmp 0x4033c1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.stdin_read_thread
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [0x410f90], eax
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret