joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4220fa
Capabilities:
Get file size

Disassembly:
push ebp
mov eax, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
add eax, 0x68
mov dword [ebp - 0x1c], eax
je 0x42229b
push edx
push edx
mov ebx, ecx
push 0
push eax
call fcn.00403579
test eax, eax
pop esi
pop edi
js 0x42229b
mov dword [ebp - 0x20], eax
push esi
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push eax
lea eax, [edi + edi + 0x28]
push eax
call fcn.00428e70
add esp, 0x10
test eax, eax
mov esi, eax
je 0x42229b
mov ecx, dword [ebp - 0x20]
push eax
push edi
push esi
push ecx
call fcn.004035ff
mov ecx, dword [ebp - 0x20]
push eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + edi], 0
lea eax, [esi + edi + 8]
push edx
push edx
lea edx, [edi + 1]
mov dword [ebp - 0x20], eax
push edx
push esi
push eax
call fcn.00428f18
add esp, 0x20
mov edx, esi
mov eax, 1
mov cl, byte [edx]
test cl, cl
je 0x42219d
cmp cl, 0xa
sete cl
inc edx
movzx ecx, cl
add eax, ecx
jmp 0x422189
add eax, 3
sub esp, 0xc
imul eax, eax, 0x18
add eax, 0x38
push eax
call fcn.00428e70
add esp, 0x10
test eax, eax
mov edi, eax
jne 0x4221c6
push ebx
push dword [ebp - 0x1c]
push str.DNS:_No_enought_memory_to_load__s_r_n
jmp 0x42228d
push ecx
push 0
mov ecx, eax
push dword [ebp - 0x20]
push 0
call fcn.0041ee36
add eax, 0x10
push edx
push edx
push eax
call fcn.00428e70
add esp, 0xc
mov ecx, edi
push 0
push esi
push eax
call fcn.0041ee36
push ecx
push ecx
push esi
call fcn.00428e54
add esp, 0x10
cmp dword [edi + 0x24], 6
jne 0x422266
mov esi, dword [edi + 0x34]
sub esp, 0xc
push esi
call fcn.00428f74
lea esi, [esi + eax + 1]
mov dword [esp], esi
call fcn.00428f74
lea eax, [esi + eax + 1]
mov ecx, dword [eax]
mov dword [ebx + 0x10], ecx
pop edx
push dword [eax + 4]
call fcn.004293d0
mov ecx, 0x14
cmp eax, 0x14
mov dword [ebx + 4], edi
cmovb eax, ecx
mov ecx, 0x15180
cmp eax, 0x15181
cmovae eax, ecx
add ebx, 0x18
mov dword [ebx - 4], eax
mov dword [esp], eax
push dword [ebp - 0x1c]
push ebx
push str.DNS:_domain__s_loaded_from_file__s_refresh_set_to__u_r_n
push dword [0x45c29c]
call fcn.0040418c
add esp, 0x20
jmp 0x42229b
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x422279
sub esp, 0xc
push eax
call fcn.00428e54
add esp, 0x10
sub esp, 0xc
push edi
call fcn.00428e54
add esp, 0xc
push dword [ebp - 0x1c]
push str.DNS:_Bad_domain_file__s_r_n
push dword [0x45c29c]
call fcn.0040418c
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4222a3
Capabilities:
Get file size

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
cmp dword [ebp + 8], 0
je 0x422499
push esi
push esi
push 0
push dword [ebp + 8]
call fcn.00403579
mov edi, eax
test edi, edi
pop eax
pop edx
jns 0x4222e5
push 0x10
push dword [ebp + 8]
push str.Unable_to_open_hosts_file
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x422499
push ecx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [eax + eax + 0x28]
push ebx
push eax
call fcn.00428e70
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x4222cc
push ecx
push esi
push eax
push edi
call fcn.004035ff
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + esi + 8]
mov byte [ebx + esi], 0
inc esi
push edx
push edx
push esi
push ebx
mov esi, 1
push eax
mov dword [ebp - 0x1c], eax
call fcn.00428f18
add esp, 0x20
mov eax, ebx
mov dl, byte [eax]
test dl, dl
jne 0x422344
mov eax, ebx
xor edi, edi
jmp 0x422352
cmp dl, 0xa
sete dl
inc eax
movzx edx, dl
add esi, edx
jmp 0x422338
push edx
push edx
push str._IF_
push eax
call fcn.004034b5
add esp, 0x10
test eax, eax
je 0x42236a
inc edi
inc eax
jmp 0x422352
add esi, 2
sub esp, 0xc
imul esi, esi, 0x18
lea eax, [esi + 0x38]
mov dword [ebp - 0x20], eax
lea eax, [edi + 3]
imul eax, eax, 0x18
add eax, dword [ebp - 0x20]
push eax
call fcn.00428e70
add esp, 0x10
test edi, edi
mov esi, eax
je 0x42239b
mov eax, dword [ebp - 0x20]
add eax, esi
mov dword [0x4729cc], eax
push edx
push dword [0x4729cc]
mov ecx, esi
push dword [ebp - 0x1c]
push 0
mov dword [0x472c08], 0
mov dword [0x472c0c], 0
call fcn.0041ee36
add eax, 0x10
push ecx
push ecx
push eax
call fcn.00428e70
add esp, 0xc
push dword [0x4729cc]
mov ecx, esi
push ebx
push eax
mov edi, eax
call fcn.0041ee36
push eax
push eax
push 0x4729d4
call fcn.00403666
mov eax, dword [0x472c10]
add esp, 0x10
mov dword [0x472c10], esi
test eax, eax
je 0x42240b
sub esp, 0xc
push eax
call fcn.00428e54
add esp, 0x10
mov eax, dword [0x4729d8]
test eax, eax
je 0x422420
sub esp, 0xc
push eax
call fcn.00428e54
add esp, 0x10
sub esp, 0xc
mov dword [0x4729d8], edi
mov dword [0x4729d4], 0
push ebx
call fcn.00428e54
mov eax, dword [esi + 8]
add esp, 0x10
mov dword [0x4656bc], eax
mov eax, dword [0x472c08]
test eax, eax
je 0x42246a
mov ecx, dword [0x472c0c]
mov edx, 0x4412e2
test ecx, ecx
je 0x42245f
mov edx, dword [ecx + 0x14]
push edx
push dword [eax + 0x14]
push str.Provders_DNS:__s__s
jmp 0x422471
push eax
push eax
push str.No_providers_servers...
push dword [0x45c29c]
call fcn.0040418c
mov ebx, dword [0x4729ec]
add esp, 0x10
test ebx, ebx
je 0x422494
mov ecx, ebx
call fcn.004220fa
mov ebx, dword [ebx]
jmp 0x422485
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4224a1
Capabilities:
Create thread

Disassembly:
cmp dword [0x4656bc], 0
je 0x422534
push ebp
mov ebp, esp
sub esp, 0x24
push dword [0x4656e4]
call fcn.004222a3
add esp, 0x10
test eax, eax
je 0x42251e
push eax
push dword [0x4656bc]
push str.DNS:_Load_host_definetion_file.__u_hosts_now_are_loaded
push dword [0x45c29c]
call fcn.0040418c
add esp, 0x10
cmp dword [0x4729cc], 0
jne 0x4224f2
cmp dword [0x4729ec], 0
je 0x422533
cmp dword [0x4661c0], 0
jne 0x422533
lea eax, [ebp - 0xc]
push edx
push edx
push eax
push 0
push 0
push 0x421f10
push 0x8000
push 0x42a458
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
pop eax
jmp 0x422533
push eax
push eax
push str.Error_loading_host_definetion_file.
push dword [0x45c29c]
call fcn.0040418c
add esp, 0x10
leave
ret

Function at 0x422613
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
push dword [0x433440]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
test eax, eax
mov dword [0x472c24], eax
je 0x4226ba
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SecAccept
push eax
call ebx
test eax, eax
mov dword [0x472c34], eax
pop esi
pop edx
je 0x4226ba
push esi
push esi
push str.SecRecv
push dword [0x472c24]
call ebx
test eax, eax
mov dword [0x472c30], eax
pop edx
pop ecx
je 0x4226ba
push esi
push esi
push str.SecSend
push dword [0x472c24]
call ebx
test eax, eax
mov dword [0x472c2c], eax
pop edx
pop ecx
je 0x4226ba
push esi
push esi
push str.SecClose
push dword [0x472c24]
call ebx
test eax, eax
mov dword [0x472c28], eax
pop edx
pop ecx
je 0x4226ba
push esi
push esi
push str.InitLib
push dword [0x472c24]
call ebx
test eax, eax
mov dword [0x472c38], eax
pop edx
pop ecx
jne 0x4226be
xor esi, esi
jmp 0x422708
mov eax, dword [0x4652e0]
mov esi, 1
test eax, eax
je 0x422708
cmp byte [eax], 0
je 0x422708
push edx
push edx
push str.SetPriority
push dword [0x472c24]
call ebx
test eax, eax
pop ecx
pop ebx
je 0x4226f3
sub esp, 0xc
push dword [0x4652e0]
call eax
jmp 0x422705
push eax
push eax
push str.SetPriority_is_abcent_in_the_library_n
push dword [0x45c294]
call fcn.0040418c
add esp, 0x10
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
Function at 0x4227eb
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x472c48]
test eax, eax
jne 0x422921
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push dword [0x433450]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
test eax, eax
mov dword [0x472c4c], eax
je 0x422900
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.deflateInit2_
push eax
call ebx
push str.inflateInit2_
mov dword [0x472c60], eax
push dword [0x472c4c]
call ebx
cmp dword [0x472c60], 0
mov dword [0x472c54], eax
pop edx
pop ecx
je 0x422900
test eax, eax
je 0x422900
push eax
push eax
push str.deflate
push dword [0x472c4c]
call ebx
test eax, eax
mov dword [0x472c68], eax
pop edx
pop ecx
je 0x422900
push eax
push eax
push str.inflate
push dword [0x472c4c]
call ebx
test eax, eax
mov dword [0x472c64], eax
pop edx
pop ecx
je 0x422900
push eax
push eax
push str.deflateEnd
push dword [0x472c4c]
call ebx
test eax, eax
mov dword [0x472c5c], eax
pop edx
pop ecx
je 0x422900
push ecx
push ecx
push str.inflateEnd
push dword [0x472c4c]
call ebx
test eax, eax
mov dword [0x472c58], eax
pop edx
pop ecx
je 0x422900
push ecx
push ecx
push str.crc32
push dword [0x472c4c]
call ebx
test eax, eax
mov dword [0x472c50], eax
pop ebx
pop edx
je 0x422900
push edx
push edx
push str.External_Zlib_library_has_been_loaded...
push 0x45c2c0
inc dword [0x472c48]
call fcn.0040418c
add esp, 0x10
mov eax, 1
jmp 0x42291d
push eax
push eax
push str.Error_loading_Zlib_library_n
push 0x45c2c0
call fcn.0040418c
dec dword [0x472c48]
add esp, 0x10
or eax, 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x423608
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
push 0
push dword [0x433474]
call fcn.00403579
test eax, eax
pop edx
pop ecx
jle 0x4236c6
mov ebx, eax
push ecx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
pop esi
pop eax
jle 0x42367c
xor edx, edx
mov ecx, 0x64
mov eax, edi
div ecx
test edx, edx
mov esi, eax
je 0x42368b
jmp 0x42367c
imul eax, esi, 0x64
mov edx, dword [0x472ca4]
test esi, esi
mov dword [edx + eax - 0x64], 0
mov eax, 0
mov dword [0x472c84], esi
cmovns eax, esi
inc eax
imul eax, eax, 0x64
add eax, edx
mov dword [0x472ca0], eax
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
jmp 0x4236c6
push eax
push edi
push 8
push dword [section..bss]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
push eax
push ebx
mov dword [0x472ca4], eax
mov dword [0x472c98], edi
call fcn.004035ff
mov eax, dword [0x472ca4]
pop edx
xor edx, edx
add eax, 0x64
cmp edx, esi
jge 0x423650
mov dword [eax - 0x64], eax
inc edx
add eax, 0x64
jmp 0x4236b9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4236ce
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ecx, 0x10
xor eax, eax
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x28]
push ebx
mov edi, esi
sub esp, 0x30
test edi, edi
je 0x4236ec
jecxz 0x4236ec
cld
rep stosb byte es:[edi], al
push 0x11
mov word [ebp - 0x28], 2
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
pop ebx
jne 0x423720
push ecx
push ecx
push str.could_not_get_socket
push dword [0x45c2a4]
call fcn.0040418c
add esp, 0x10
xor edx, edx
jmp 0x423800
sub esp, 0xc
mov ebx, eax
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
push 0x42a4a4
push 4
push 0xffff
push eax
call edi
push 4
push 0x42a4a4
push 0x20
push 0xffff
push ebx
call edi
lea eax, [ebp + 0xc]
push eax
call fcn.00410d76
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
xchg al, ah
mov word [ebp - 0x26], ax
mov eax, dword [sym.imp.WS2_32.dll_bind]
add esp, 0x10
mov dword [ebp - 0x2c], eax
push ecx
push 0x10
push esi
push ebx
call dword [ebp - 0x2c]
test eax, eax
pop edx
je 0x4237d6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub esp, 0xc
push eax
call fcn.0040376b
mov dword [ebp - 0x30], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
push eax
push dword [ebp + 8]
push str.Error._Could_not_bind_socket_to_port__u.___d__s
push dword [0x45c2a4]
call fcn.0040418c
add esp, 0x20
call fcn.0040d4d3
test eax, eax
jne 0x42376d
mov dword [ebp - 0x2c], eax
push eax
push eax
push 2
push ebx
call dword [sym.imp.WS2_32.dll_shutdown]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 0x2c]
add esp, 0xc
jmp 0x423800
sub esp, 0xc
push 4
push 0x42a4a4
push 4
push 0xffff
push ebx
call edi
push 4
push 0x42a4a4
push 0x20
push 0xffff
push ebx
call edi
mov edx, ebx
add esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x424146
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x214
mov eax, dword [ecx]
push 0x4421bb
push dword [eax + 0x24]
call fcn.004139bc
add esp, 0x10
test eax, eax
je 0x4241bf
sub esp, 0xc
mov esi, eax
push eax
call fcn.00408674
add esp, 0x10
test eax, eax
je 0x4241bf
lea edi, [ebp - 0x218]
push esi
push dword [ebx + 0x14]
push 0x4421bd
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
pop eax
pop edx
push 0x42a458
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, str._b_Unable_to_create__.128s__b_
test eax, eax
mov eax, str._b_Created...__b_
cmove eax, edx
add ebx, 4
mov dword [esp], esi
push eax
push ebx
call fcn.004287ba
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x424d76
Capabilities:
Create directory
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x418]
mov ebx, ecx
sub esp, 0x55c
push dword [ecx + 0xe0]
push dword [ecx + 0x14]
push str._.128smbox_.128s.msg
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
pop eax
lea eax, [ebp - 0x558]
pop edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x560], eax
inc eax
pop ecx
pop edi
je 0x424efd
mov dword [ebp - 0x55c], 0
lea eax, [ebp - 0x52c]
sub esp, 0xc
push eax
call fcn.00410c16
add esp, 0xc
mov dword [ebp - 0x564], eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push str.dl_X
push esi
call edi
pop ecx
pop eax
mov eax, dword [ebx]
push esi
push dword [eax + 0x24]
call fcn.004051d7
add esp, 0x10
test eax, eax
je 0x424ecc
sub esp, 0xc
push dword [ebp - 0x564]
push dword [ebx + 0xe0]
push dword [ebx + 0x14]
push 0x44243b
push esi
call edi
mov eax, dword [str.trash]
add esp, 0x20
test eax, eax
je 0x424ebf
push edx
push edx
push eax
push dword [ebx + 0xe0]
call fcn.004034b5
add esp, 0x10
test eax, eax
jne 0x424ebf
lea eax, [ebp - 0x218]
sub esp, 0xc
push dword [ebp - 0x564]
push dword [0x434be4]
push dword [ebx + 0x14]
push str._.128smbox_.64s_8.8X.msg
push eax
call edi
lea eax, [ebp - 0x218]
add esp, 0x18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
pop edx
pop ecx
jne 0x424ecc
mov eax, dword [ebp - 0x55c]
lea edx, [eax + 1]
test eax, eax
mov dword [ebp - 0x55c], edx
jne 0x424ecc
lea eax, [ebp - 0x218]
push dword [0x434be4]
push dword [ebx + 0x14]
push str._.128smbox_.64s
push eax
call edi
pop eax
lea eax, [ebp - 0x218]
pop edx
push 0x42a458
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop ecx
pop eax
jmp 0x424e46
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
push eax
push eax
lea eax, [ebp - 0x558]
push eax
push dword [ebp - 0x560]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
pop edx
pop ecx
jne 0x424dc8
sub esp, 0xc
push dword [ebp - 0x560]
call dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x424f06
Capabilities:
Create directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x434
push 0x442484
mov eax, dword [ecx]
push dword [eax + 0x24]
call fcn.004051d7
add esp, 0x10
test eax, eax
je 0x425023
sub esp, 0xc
push eax
call fcn.00410c16
mov dword [esp], eax
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x428]
push dword [ebx + 0xe0]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebx + 0x14]
push str._smbox_.128s_8.8X.msg
push eax
call edi
mov eax, dword [str.trash]
add esp, 0x20
test eax, eax
je 0x425010
push esi
push esi
push eax
push dword [ebx + 0xe0]
call fcn.004034b5
add esp, 0x10
test eax, eax
jne 0x425010
lea esi, [ebp - 0x220]
sub esp, 0xc
push dword [ebp - 0x42c]
push dword [0x434be4]
push dword [ebx + 0x14]
push str._.128smbox_.64s_8.8X.msg
push esi
call edi
lea eax, [ebp - 0x428]
add esp, 0x18
push esi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x430], eax
call eax
test eax, eax
pop edx
pop ecx
jne 0x425023
push dword [0x434be4]
push dword [ebx + 0x14]
push str._.128smbox_.64s
push esi
call edi
pop eax
pop edx
push 0x42a458
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ecx
push dword [ebp - 0x42c]
push dword [0x434be4]
push dword [ebx + 0x14]
push str._.128smbox_.64s_8.8X.msg
push esi
call edi
lea eax, [ebp - 0x428]
add esp, 0x18
push esi
push eax
call dword [ebp - 0x430]
pop ebx
pop esi
jmp 0x425023
lea eax, [ebp - 0x428]
sub esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42583c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xf34
push 0x442484
mov eax, dword [ecx]
push dword [eax + 0x24]
call fcn.004051d7
add esp, 0x10
test eax, eax
jne 0x425868
or eax, 0xffffffff
jmp 0x425916
sub esp, 0xc
lea edi, [ebp - 0xf1c]
push eax
call fcn.00410c16
mov dword [esp], eax
push dword [ebx + 0xe0]
push dword [ebx + 0x14]
push str._smbox_.128s_8.8X.msg
push edi
mov dword [ebx + 0xdc], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push edi
call fcn.00403579
mov esi, eax
test esi, esi
pop eax
pop edx
js 0x425860
push ecx
push ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
pop edx
pop ecx
jne 0x4258ca
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0xc
jmp 0x425916
lea ecx, [ebx + 4]
push edx
push eax
push str.HTTP_1.0_200_Ok_r_nContent_type:_application_octet_stream_r_nContent_Length:__u_r_n_r_n
push ecx
mov dword [ebp - 0xf2c], ecx
call fcn.004287ba
mov ecx, dword [ebp - 0xf2c]
call fcn.00429150
add esp, 0x10
push ecx
push 0xf00
push edi
push esi
call fcn.004035ff
test eax, eax
pop edx
je 0x4258b9
mov ecx, dword [ebx]
push edx
push edx
push eax
push edi
call fcn.00429114
cmp eax, 0xf00
pop ecx
pop edx
je 0x4258ee
jmp 0x4258b9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4261c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x418]
mov ebx, ecx
sub esp, 0x420
push dword [ecx + 0x14]
push str._swmail.cfg
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp], 0x472cb4
call fcn.00403666
pop edi
pop eax
push 0
push esi
call fcn.00403579
test eax, eax
pop edx
pop ecx
js 0x42629b
mov edi, eax
push eax
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add eax, 0x10008
push edx
push eax
call fcn.00428e70
mov esi, eax
lea eax, [eax + 0x10000]
add esp, 0xc
push 0x1000
push eax
push edi
mov dword [ebp - 0x41c], eax
call fcn.004035ff
mov byte [esi + eax + 0x10000], 0
push ecx
push ecx
push edi
mov edi, 0x433560
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
add esp, 0xc
cmp dword [edx], 0
je 0x426294
push eax
push eax
mov ecx, edx
push ebx
push dword [ebp - 0x41c]
mov dword [ebp - 0x420], edx
call fcn.004260f8
mov edx, dword [ebp - 0x420]
pop ecx
pop eax
add edx, 0x18
jmp 0x42625c
cmp dword [edi + 8], 0
jne 0x426291
mov ecx, edi
call fcn.0042617c
add edi, 0x18
cmp dword [edi], 0
jne 0x426284
jmp 0x4262ca
sub esp, 0xc
push 0x10000
call fcn.00428e70
add esp, 0x10
mov esi, eax
mov eax, 0x433560
add eax, 0x18
cmp dword [eax - 0x18], 0
je 0x4262ca
mov edx, dword [eax - 8]
mov ecx, dword [eax - 0xc]
add edx, ebx
mov dword [eax - 4], edx
mov dword [edx], ecx
jmp 0x4262b2
mov eax, dword [ebx + 0x108]
cmp byte [eax], 0
jne 0x4262de
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x108], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x426396
Capabilities:
Get file size

Disassembly:
push ebp
mov eax, str.__a_href_s153__Badlist__a___nbsp__nbsp_____a_href_s154__Goodlist__a__nbsp__nbsp_____a_href_s155__Graylist__a___nbsp__nbsp_____a_href_s156__Antivirus__a___nbsp__nbsp_____a_href_s157__DNS_hosts__a___nbsp__nbsp_____a_href_s158__Config_file__a____br__br___form_methodpost_namem__n_input_typehidden_names_value_u___center__n_h2__s__h2__n_s_n__center__n_script_languagejavascript___n_nfunction_AddE_a__n_n_document.m.v.value____n_a__n_nfunction_AddEm_a_b__n_n_document.m.v.value____n______a________b________n_n_n__script__n_table_border0_bgcolorF0F8F8__n_tr_valignbottom__n_td__n
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x228
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], ecx
mov esi, dword [ebp - 0x21c]
mov ecx, str.__a_href___wmail___s25__Badlist__a___nbsp__nbsp_____a_href___wmail___s26__Goodlist__a__nbsp__nbsp_____a_href___wmail___s27__Graylist__a___nbsp__nbsp_____a_href___wmail___s28__Forward__a____br__br___form_methodpost_namem__n_input_typehidden_names_value_u___center__n_h2__s__h2__n_s_n__center__n_script_languagejavascript___n_nfunction_AddE_a__n_n_document.m.v.value____n_a__n_nfunction_AddEm_a_b__n_n_document.m.v.value____n______a________b________n_n_n__script__n_table_border0_bgcolorF0F8F8__n_tr_valignbottom__n_td__n
mov ebx, edi
lea edx, [edi + 0x1f]
and ebx, 0x3f
and edi, 0x80
cmove eax, ecx
add esi, 4
push dword [ebx*4 + 0x4334a0]
push dword [ebx*4 + 0x433530]
push edx
push eax
push esi
call fcn.004287ba
add esp, 0x18
push dword [ebx*4 + 0x4334e8]
push esi
call fcn.004287ba
pop eax
pop edx
push str.__ul___n__ul___n_br__br__center__textarea_namev_rows30_cols80__
push esi
call fcn.004287ba
add esp, 0x10
test edi, edi
je 0x426423
mov eax, dword [ebx*4 + 0x433500]
mov eax, dword [eax]
test eax, eax
je 0x4264d8
push ecx
push eax
push 0x44270c
jmp 0x426438
mov eax, dword [ebp - 0x21c]
push dword [ebx*4 + 0x433518]
push dword [eax + 0x14]
push 0x44270f
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x218]
add esp, 0x10
push ecx
push ecx
push 0
push eax
call fcn.00403579
mov edi, eax
test edi, edi
pop eax
pop edx
js 0x4264d8
push eax
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
test ecx, ecx
pop eax
pop edx
je 0x4264cb
lea eax, [ecx + 0x800]
sub esp, 0xc
mov dword [ebp - 0x220], ecx
push eax
call fcn.00428e70
mov ecx, dword [ebp - 0x220]
add esp, 0xc
mov dword [ebp - 0x220], eax
push ecx
push eax
push edi
call fcn.004035ff
mov edx, dword [ebp - 0x220]
mov byte [edx + eax], 0
push ecx
mov ecx, dword [ebp - 0x21c]
push 0x4425bd
push edx
call fcn.00425724
mov edx, dword [ebp - 0x220]
push eax
push edx
call fcn.00428e54
add esp, 0x10
sub esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push eax
push eax
push str.__textarea__n_br__n
push esi
call fcn.004287ba
push str.Submit
push dword [ebx*4 + 0x4334b8]
push dword [ebx*4 + 0x4334d0]
push esi
call fcn.004287ba
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4