joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464080
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push 0x90
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0056cde0
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
seta al
mov esp, ebp
pop ebp
ret

Function at 0x464150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x404
test eax, eax
jne 0x464231
mov word [ebp - 0x404], ax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
lea eax, [ebp - 0x404]
mov dword [ebp + 0xc], 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4642ad
mov eax, dword [ebp - 4]
push esi
push edi
cmp eax, 1
je 0x4641b2
cmp eax, 2
jne 0x464264
mov esi, dword [ebp + 0xc]
and esi, 0xfffffffe
mov dword [ebp + 0xc], esi
cmp esi, 0xbebc200
jae 0x4642a6
mov eax, esi
xor ecx, ecx
shr eax, 1
mov edx, 2
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056b4bb
add esp, 4
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0xc]
xor edx, edx
shr ecx, 1
mov word [edi + ecx*2], dx
mov ecx, dword [ebp - 4]
cmp ecx, 1
je 0x464218
cmp ecx, 2
jne 0x46425b
cmp eax, 0xea
jne 0x464270
push edi
call fcn.0056b4c4
add esp, 4
lea esi, [esi*2 + 0xfa0]
jmp 0x4641b8
push 0x200
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x46416b
mov eax, 0x57
mov esp, ebp
pop ebp
ret
push edi
call fcn.0056b4c4
add esp, 4
pop edi
pop esi
mov eax, 0xd
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
push 0xa
push esi
push dword [ebp + 0x10]
push edi
call fcn.0046d7a0
push edi
mov ebx, eax
call fcn.0056b4c4
add esp, 0x14
test ebx, ebx
jne 0x464293
cmp word [edi], bx
jne 0x464264
xor eax, eax
mov ecx, 0xea
cmp ebx, esi
pop edi
pop esi
cmovg eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xe
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x464470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x464480
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
not eax
test edi, edi
je 0x4644c2
lea ecx, [ecx]
mov cl, byte [esi]
lea esi, [esi + 1]
movzx edx, cl
mov ecx, edx
shr edx, 4
xor ecx, eax
shr eax, 4
and ecx, 0xf
xor eax, dword [ecx*4 + 0x5d04c0]
mov ecx, eax
shr eax, 4
and ecx, 0xf
xor edx, ecx
xor eax, dword [edx*4 + 0x5d04c0]
sub edi, 1
jne 0x464490
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x4741b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x654074], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
je 0x4741ec
cmp esi, 0xc0
jl 0x4741ec
mov edi, dword [ebp + 0xc]
mov eax, esi
shr eax, 6
dec eax
push eax
push edi
push dword [ebp + 8]
call fcn.00474210
mov eax, esi
add esp, 0xc
and eax, 0x3f
sub esi, eax
add edi, esi
mov esi, eax
jmp 0x4741ef
mov edi, dword [ebp + 0xc]
push 0x5da780
push esi
push edi
push dword [ebp + 8]
call fcn.00474370
add esp, 0x10
pop edi
pop esi
pop ebp
ret

Function at 0x474210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x40
mov eax, dword [ebp + 8]
movaps xmm3, xmmword [0x5dc790]
movups xmm4, xmmword [edx]
push esi
movups xmm5, xmmword [edx + 0x10]
mov esi, dword [eax]
movups xmm6, xmmword [edx + 0x20]
push edi
movups xmm7, xmmword [edx + 0x30]
add edx, 0x40
cmp esi, 0xffffffff
jne 0x474247
movaps xmm2, xmmword [0x5dc780]
jmp 0x47428a
xor edi, edi
mov ecx, 0x5b358fd3
test esi, esi
je 0x47426f
mov eax, esi
sar eax, 0x1f
and eax, ecx
xor edi, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
add esi, esi
jne 0x474252
xor eax, eax
movd xmm0, edi
xorps xmm2, xmm2
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm2, xmm1
pclmulqdq xmm2, xmm3, 0x11
mov eax, dword [ebp + 0x10]
pxor xmm2, xmm7
test eax, eax
jle 0x474309
lea edx, [edx + 0x40]
movaps xmm1, xmm4
movups xmm0, xmmword [edx - 0x40]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm4, xmm3, 0
pxor xmm4, xmm1
movaps xmm1, xmm5
pxor xmm4, xmm0
movups xmm0, xmmword [edx - 0x30]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm5, xmm3, 0
pxor xmm5, xmm1
movaps xmm1, xmm6
pxor xmm5, xmm0
movups xmm0, xmmword [edx - 0x20]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm6, xmm3, 0
pxor xmm6, xmm1
movaps xmm1, xmm2
pxor xmm6, xmm0
movups xmm0, xmmword [edx - 0x10]
pclmulqdq xmm2, xmm3, 0
pclmulqdq xmm1, xmm3, 0x11
pxor xmm2, xmm1
pxor xmm2, xmm0
sub eax, 1
jne 0x474295
xor eax, eax
xor edi, edi
movups xmmword [ebp - 0x40], xmm4
movups xmmword [ebp - 0x30], xmm5
movups xmmword [ebp - 0x20], xmm6
movups xmmword [ebp - 0x10], xmm2
lea ecx, [ecx]
xor eax, dword [ebp + edi*4 - 0x40]
inc edi
movzx ecx, al
shr eax, 8
mov esi, dword [ecx*4 + 0x5db380]
movzx ecx, al
shr eax, 8
mov edx, eax
shr edx, 8
xor esi, dword [ecx*4 + 0x5daf80]
movzx ecx, al
mov eax, dword [edx*4 + 0x5da780]
xor eax, dword [ecx*4 + 0x5dab80]
xor eax, esi
cmp edi, 0x10
jl 0x474320
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x4866b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x18], 0x20
jb 0x4866cc
xor al, al
mov esp, ebp
pop ebp
ret
push 0x5dee4c
call fcn.00486780
add esp, 4
test eax, eax
jne 0x4866f6
push str.AuthenticAMD
call fcn.00486780
add esp, 4
test eax, eax
jne 0x4866f6
xor cl, cl
mov al, cl
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
setne cl
test eax, eax
je 0x486776
mov eax, dword [ebp - 4]
push edi
cmp dword [ebp - 8], eax
je 0x486741
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push eax
push esi
call edi
test eax, eax
setne cl
test eax, eax
je 0x48673e
push dword [ebp - 8]
push esi
call edi
test eax, eax
setne cl
mov eax, dword [ebp - 4]
test cl, cl
je 0x486775
cmp eax, 1
jbe 0x486775
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov esi, eax
push esi
call edi
test eax, eax
je 0x486773
push eax
push esi
call edi
test eax, eax
pop edi
setne cl
pop esi
mov al, cl
mov esp, ebp
pop ebp
ret
xor cl, cl
pop edi
pop esi
mov al, cl
mov esp, ebp
pop ebp
ret

Function at 0x486ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push ebx
push esi
mov esi, ecx
mov cl, byte [ebp + 0xc]
mov byte [esi], al
mov byte [esi + 1], cl
cmp cl, al
jbe 0x48700b
mov byte [esi + 1], al
mov cl, al
xor edx, edx
movzx eax, al
movzx ecx, cl
div ecx
mov dl, 8
mov cl, 0x80
dec al
jmp 0x487020
test al, cl
jne 0x48702a
dec dl
shr cl, 1
jne 0x487020
mov bl, byte [esi + 1]
mov cl, 8
mov byte [esi + 2], dl
dec bl
mov al, 0x80
test bl, al
jne 0x487040
dec cl
shr al, 1
jne 0x487036
mov al, 8
mov byte [esi + 4], cl
sub al, cl
or bl, 0xff
sub al, dl
movzx ecx, cl
mov byte [esi + 6], al
movzx eax, dl
or dl, 0xff
add ecx, eax
shl dl, cl
mov ecx, eax
shl bl, cl
mov al, bl
mov byte [esi + 7], dl
not bl
xor al, dl
mov byte [esi + 3], bl
mov byte [esi + 5], al
pop esi
pop ebx
pop ebp
ret 8

Function at 0x581b27
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x581b62
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x581b49
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x581b5a
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x581b64
inc edi
add eax, 0x28
cmp edi, esi
jb 0x581b3f
xor eax, eax
pop edi
pop esi
ret
Function at 0x581ed2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00581af7
push eax
push esi
push dword [ebp + 8]
call fcn.00581aac
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00581af7
push eax
push esi
push dword [ebp + 8]
call fcn.00581aac
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00581ae7
mov byte [0x889e4a4c], al
popfd
jl 0x581f6c
invalid
invalid

Function at 0x58217b
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x58219b
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x582196
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x582180
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
or byte [ecx], al
adc ebx, ebp
invalid
or byte [ecx], al
adc ebx, ebp
or byte [ebx], bh
ror dword [edi], cl
test dword [esi + 1], ecx
add byte [eax], al
cmp edx, ebx
jne 0x5822d6
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x582157
add eax, dword [eax + 4]
jmp 0x582144
invalid
mov dword [ebp + 0xc], ebx
jmp 0x5821a6
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x5821be
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x5821dc
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
invalid
ja 0x58223a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x582221
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x58222a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x582234
add ecx, eax
or byte [ecx], 4
inc eax
invalid
Function at 0x58219a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x58219b
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x582196
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x582180
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
or byte [ecx], al
adc ebx, ebp
invalid
or byte [ecx], al
adc ebx, ebp
or byte [ebx], bh
ror dword [edi], cl
test dword [esi + 1], ecx
add byte [eax], al
cmp edx, ebx
jne 0x5822d6
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x582157
add eax, dword [eax + 4]
jmp 0x582144
invalid
mov dword [ebp + 0xc], ebx
jmp 0x5821a6
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x5821be
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x5821dc
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
invalid
ja 0x58223a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x582221
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x58222a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x582234
add ecx, eax
or byte [ecx], 4
inc eax
invalid

Function at 0x5869e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00586856

Function at 0x58a227
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00589d7a
Function at 0x405282
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.WinMain_start__lpCmdLine_is:
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
cmp dword [esp + 0x14], edi
jne 0x4052a2
mov eax, str.NULL
push eax
call esi
push str.WinMain_start__parameter_is:
call esi
push str.package.nameZoom.msipackage.versionlatestpackage.size8255kdownloadRoothttps:__launcher.zoom.us_clientactionjoinbrowserfirefoxconfiddGlkPTIwNTlhZTlmNDU5OWVlZThmNDk4NWU2NTE5YmViNGMwconfno178901575zc0mcv0.92.11227.0929tk1PJpphvom2wTBUpc1mNsCB9kwqDtcWsmlFZdPEsfw3M.DQEAAAAACqnSRxZ1WU5JbkJmRFQ2YTgxN1k1Vld2cGhBAAstafalseinstaller.exeInstaller.exe
call esi
push 0x444
call fcn.00407475
pop ecx
cmp eax, edi
je 0x4052ce
mov edx, dword [esp + 0xc]
push eax
call fcn.0040538c
jmp 0x4052d0
xor eax, eax
push str.zoom.us_Downloader_Mutex_1.0.0.0
push edi
push 0x1f0001
mov dword [0x41ddb8], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, edi
je 0x4052f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4052fc
call fcn.00406405
test eax, eax
jne 0x40531c
push edi
push str.zoom.us_Boot_Downloader
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x405341
push edi
push edi
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x405341
mov ecx, dword [esp + 0x14]
call fcn.004057bb
mov eax, dword [0x41ddb8]
cmp eax, edi
je 0x405334
push eax
call fcn.00405348
push str.WinMain_end
mov dword [0x41ddb8], edi
call esi
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x402180
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45eb98
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x476750]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x476750]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004014f0
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.004020a0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x4021fd
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.0042e770
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x402226
push dword [esp + 0x10]
call fcn.00406ef0
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042dda9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406790
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [eax], 0
cmp ebx, dword [edi + 0x10]
jbe 0x406832
push ebx
lea ecx, [edi + 4]
call fcn.004068d0
mov edx, dword [edi + 4]
mov eax, ebx
sub eax, dword [edi + 0x10]
add edx, dword [edi + 0x10]
push 0
push eax
push edx
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4067e5
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x2749
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
cmp eax, 0xffffffff
jne 0x40682f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xb
je 0x4067db
cmp eax, 0x2733
je 0x4067db
mov ecx, dword [ebp + 0xc]
mov edx, str.Failed_while_reading_from_client_socket._Error_code:
push eax
push ecx
mov dword [ecx], eax
mov ecx, 0x47a470
call fcn.004049e0
add esp, 4
mov ecx, eax
call fcn.00402910
push eax
call fcn.00404c90
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov dword [edi + 0x10], ebx
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x406c00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
jne 0x406ca6
lea eax, [ebp - 0xc]
push eax
call fcn.00406dd0
lea edi, [ebp - 0x14]
xor ecx, ecx
xor edx, edx
cmp edi, eax
je 0x406c37
mov edx, dword [eax + 4]
mov dword [eax + 4], ecx
mov ecx, dword [eax]
mov dword [eax], 0
mov edi, dword [esi + 0xc]
mov dword [esi + 0xc], edx
mov dword [esi + 8], ecx
test edi, edi
je 0x406c69
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x406c69
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x406c69
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edi, dword [ebp - 8]
test edi, edi
je 0x406c95
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x406c95
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x406c95
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
cmp dword [esi + 8], 0
mov dword [esi + 0x10], 0
je 0x406db9
mov ebx, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
push 0
mov dword [ebx], 0
movzx edi, word [eax]
sub edi, ecx
lea edx, [ecx + eax]
push edi
push edx
push dword [esi]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x406d11
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xb
je 0x406d0d
cmp eax, 0x2733
je 0x406d0d
push eax
push ecx
mov edx, str.Failed_while_sending_data_to_socket._Error_code:
mov dword [ebx], eax
mov ecx, 0x47a470
call fcn.004049e0
add esp, 4
mov ecx, eax
call fcn.00402910
push eax
call fcn.00404c90
add esp, 4
xor eax, eax
jmp 0x406d1b
test eax, eax
jne 0x406d1b
mov dword [ebx], 0x2749
add dword [esi + 0x10], eax
cmp eax, edi
jb 0x406dc4
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00406dd0
lea edi, [ebp - 0x1c]
xor ecx, ecx
xor edx, edx
cmp edi, eax
je 0x406d4a
mov edx, dword [eax + 4]
mov dword [eax + 4], ecx
mov ecx, dword [eax]
mov dword [eax], 0
mov edi, dword [esi + 0xc]
mov dword [esi + 0xc], edx
mov dword [esi + 8], ecx
test edi, edi
je 0x406d7c
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x406d7c
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x406d7c
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edi, dword [ebp - 8]
test edi, edi
je 0x406da8
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x406da8
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x406da8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x406cb0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407680
Capabilities:
Convert ip address from string
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x476750]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x4d2
mov edi, ecx
mov edx, str.Creating_ipc_server._ip:
push ecx
mov ecx, 0x47a470
call fcn.004049e0
mov edx, str.127.0.0.1
mov ecx, eax
call fcn.004049e0
mov edx, str.__port:
mov ecx, eax
call fcn.004049e0
add esp, 4
mov ecx, eax
call fcn.00402ab0
push eax
call fcn.00404c90
add esp, 4
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40770d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.Error_while_creating_socket._Error_core:
mov ecx, 0x47a470
call fcn.004049e0
add esp, 4
mov ecx, eax
call fcn.00402910
jmp 0x4077f3
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x407756
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.ioctlsocket_error:
mov ecx, 0x47a470
call fcn.004049e0
add esp, 4
mov ecx, eax
call fcn.00402910
jmp 0x4077f3
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0x14], xmm0
push 0x4d2
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
push str.127.0.0.1
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4077c3
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.Error_while_socket_binding._Error_code:
mov ecx, 0x47a470
call fcn.004049e0
add esp, 4
mov ecx, eax
call fcn.00402910
jmp 0x4077f3
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
mov dword [edi], esi
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
push dword [edi]
mov edx, str.Ipc_server_created._Socket:
mov dword [edi + 4], eax
push ecx
mov ecx, 0x47a470
call fcn.004049e0
add esp, 4
mov ecx, eax
call fcn.00402ab0
push eax
call fcn.00404c90
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.0042dda9
mov esp, ebp
pop ebp
ret 8